Bug 637003
| Summary: | selinux prevents clamdscan from running | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Bradley <bbaetz> |
| Component: | selinux-policy-targeted | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 13 | CC: | dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.7.19-76.fc13 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-12-17 08:43:00 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
What is clamdscan labeled? ls -lZ `which clamdscan` -rwxr-xr-x. root root system_u:object_r:clamscan_exec_t:s0 /usr/bin/clamdscan -rwxr-xr-x. root root system_u:object_r:clamd_exec_t:s0 /usr/sbin/clamd The RPM was installed just before I tested, FWIW clamdscan should be running as clamdscan_t and somehow this is getting clamd to search for ~/eicar, I guess. clamdscan ~/eicar sends to the daemon:
zCONTSCAN /tmp/eicar\0
(from strace) - ie just the filename is passed.
clamdscan - < ~/eicar
does fd passing:
connect(3, {sa_family=AF_FILE, path="/var/run/clamd.scan/clamd.sock"}, 110) = 0
sendto(3, "zFILDES\0", 8, 0, NULL, 0) = 8
sendmsg(3, {msg_name(0)=NULL, msg_iov(1)=[{"\0", 1}], msg_controllen=20, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {0}}, msg_flags=0}, 0) = 1
close(0) = 0
If I use TCP mode rather than socket mode then the second version works (it does read/sendto rather than anything clever) That causes selinux errors when I run it out of procmail, though:
.procmailrc:
:0fw: clamassassin.lock
|clamdscan --no-summary --stdout -
=>
type=AVC msg=audit(1285632008.428:81): avc: denied { write } for pid=3247 comm="clamdscan" path="pipe:[23886]" dev=pipefs ino=23886 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:system_r:sendmail_t:s0 tclass=fifo_file
type=AVC msg=audit(1285632008.428:81): avc: denied { read } for pid=3247 comm="clamdscan" path="/var/spool/mqueue/dfo8S0081f003243" dev=dm-0 ino=262728 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
type=SYSCALL msg=audit(1285632008.428:81): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8d257e54 a1=1f4f3b0 a2=1f4f2f0 a3=8 items=0 ppid=3246 pid=3247 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295 comm="clamdscan" exe="/usr/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0 key=(null)
type=AVC msg=audit(1285632008.431:82): avc: denied { read } for pid=3247 comm="clamdscan" name="resolv.conf" dev=dm-0 ino=97 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
type=SYSCALL msg=audit(1285632008.431:82): arch=c000003e syscall=2 success=no exit=-13 a0=3f9594253f a1=0 a2=1b6 a3=2 items=0 ppid=3246 pid=3247 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295 comm="clamdscan" exe="/usr/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0 key=(null)
type=AVC msg=audit(1285632008.431:83): avc: denied { node_bind } for pid=3247 comm="clamdscan" saddr=127.0.0.1 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1285632008.431:83): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=61fdd0 a2=10 a3=1999999999999999 items=0 ppid=3246 pid=3247 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295 comm="clamdscan" exe="/usr/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0 key=(null)
Fixed in selinux-policy-3.7.19-76.fc13 selinux-policy-3.7.19-76.fc13 has been submitted as an update for Fedora 13. https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-76.fc13 selinux-policy-3.7.19-76.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-76.fc13 selinux-policy-3.7.19-76.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: With selinux running, clamdscan fails to work. Version-Release number of selected component (if applicable): clamav-0.96.1-1300.fc13.x86_64 clamav-data-0.96.1-1300.fc13.noarch clamav-filesystem-0.96.1-1300.fc13.noarch clamav-lib-0.96.1-1300.fc13.x86_64 clamav-scanner-0.96.1-1300.fc13.noarch clamav-scanner-sysvinit-0.96.1-1300.fc13.noarch clamav-server-0.96.1-1300.fc13.x86_64 clamav-server-sysvinit-0.96.1-1300.fc13.noarch clamav-update-0.96.1-1300.fc13.x86_64 selinux-policy-3.7.19-57.fc13.noarch selinux-policy-targeted-3.7.19-57.fc13.noarch How reproducible: Always Steps to Reproduce: 1. Create /tmp/eicar with the eicar text string in it 2. Make sure clamd is running 3. Either: a) clamdscan - < /tmp/eicar OR b) clamdscan /tmp/eicar Actual results: a) STDIN: no reply from clamd and /var/log/messages has: Sep 24 08:56:24 bradley clamd.scan[10801]: Control message truncated, no control data received, 9 bytes read(Is SELinux/AppArmor enabled, and blocking file descriptor passing?) Sep 24 08:56:24 bradley clamd.scan[10801]: Error condition on fd 10 b) /tmp/eicar: Access denied. ERROR Note - Those messages come from the daemon and are just printed by the client program. Expected results: Works just like 'spamc /tmp/eicar' manages to have a separate daemon do the scanning. Additional info: clamscan (ie local rather than using a daemon) works. Works in permissive mode. Nothing in audit.log in either case. If I do 'clamdscan ~/eicar' then I get: type=AVC msg=audit(1285282659.495:34852): avc: denied { search } for pid=26569 comm="clamd" name="home" dev=dm-0 ino=278529 scontext=unconfined_u:system_r:clamd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir