Bug 1449616 - Still references obsolete SELinux boolean - Run 'setsebool -P clamd_use_jit on'.
Summary: Still references obsolete SELinux boolean - Run 'setsebool -P clamd_use_jit ...
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: clamav
Version: epel7
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Robert Scheck
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1523184 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-10 11:22 UTC by "Linux" Dan White
Modified: 2024-07-09 15:48 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-07-09 15:48:54 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github Cisco-Talos clamav-devel pull 89 0 None None None 2019-08-07 15:44:29 UTC

Description "Linux" Dan White 2017-05-10 11:22:44 UTC
Description of problem:


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.Install clamav-db-0.99.2-2.el6.x86_64 clamd-0.99.2-2.el6.x86_64 clamav-0.99.2-2.el6.x86_64
2. setsebool -P antivirus_can_scan_system 1
3. service clamd start

Actual results:
Starting Clam AntiVirus Daemon: LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Permission denied
LibClamAV Warning: Bytecode: disabling JIT because SELinux is preventing 'execmem' access.
Run  'setsebool -P clamd_use_jit on'.


Expected results:
None of the above

Additional info:
According to https://bugzilla.redhat.com/show_bug.cgi?id=1295473
this should have been fixed

Comment 1 Jason Tibbitts 2017-05-10 22:55:57 UTC
There's a patch included which was an attempt to change that message in the source, except that it doesn't do anything.  The code it changes wrapped in "#if 0/#endif".

The actual message comes from the builtin bytecode startup sequence, which is basically a precompiled string.  Fixing this properly would involve building the bytecode compiler, recompiling buildin_bc_startup to bytecode, and patching that in.  Personally I think that's a rather excessive and fragile amount of work to get one string changed and would honestly just close this WONTFIX but maybe someone wants to have a go.

Comment 2 Davide Repetto 2017-12-12 19:17:42 UTC
FYI the same happens in clamav-0.99.2-13.fc27.x86_64

Comment 3 Sergio Basto 2018-01-08 02:17:32 UTC
*** Bug 1523184 has been marked as a duplicate of this bug. ***

Comment 4 Sergio Basto 2018-07-26 01:13:11 UTC
As reference in [0] we need run [1] to avoid [2] but as directory was already created I had to run also [3], conclusion "setsebool -P clamd_use_jit on" is correct but we also need "setsebool -P antivirus_can_scan_system on" 

[0]
https://blog.fsecurity.co.nz/linux-install-clamav-centos-7/

[1]
setsebool -P clamd_use_jit 1 
setsebool -P antivirus_can_scan_system 1 

[2]
system_u:system_r:antivirus_t:s0 49 sock_file create system_u:object_r:var_run_t:s0 denied 

[3]
restorecon -R -v  /var/run/clamd.scan

Comment 5 Sergio Basto 2018-07-26 02:21:29 UTC
clamd_use_jit (in epel7) is an alias to antivirus_use_jit

but after [1] I don't see any SELinux refusal , so seems [2]  is enough . Maybe I should report upstream .

[1]
setsebool -P antivirus_use_jit 0

[2]
setsebool -P antivirus_can_scan_system 1

Comment 6 Fedora Update System 2018-10-06 17:04:36 UTC
clamav-0.100.2-2.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b6e8b488d2

Comment 7 Sergio Basto 2018-10-07 03:21:20 UTC
Sorry my mistake when choosing the bugs fixed on clamav-0.100.2-2.el7 and clamav-0.100.2-2.el7 doesn't fix this bug .

Comment 8 Orion Poplawski 2019-08-07 14:56:41 UTC
Filed upstream: https://bugzilla.clamav.net/show_bug.cgi?id=12372

Comment 9 Troy Dawson 2024-07-09 15:48:54 UTC
EPEL 7 entered end-of-life (EOL) status on 2024-06-30.  EPEL 7 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug.


Note You need to log in before you can comment on or make changes to this bug.