Description of problem: Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1.Install clamav-db-0.99.2-2.el6.x86_64 clamd-0.99.2-2.el6.x86_64 clamav-0.99.2-2.el6.x86_64 2. setsebool -P antivirus_can_scan_system 1 3. service clamd start Actual results: Starting Clam AntiVirus Daemon: LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Permission denied LibClamAV Warning: Bytecode: disabling JIT because SELinux is preventing 'execmem' access. Run 'setsebool -P clamd_use_jit on'. Expected results: None of the above Additional info: According to https://bugzilla.redhat.com/show_bug.cgi?id=1295473 this should have been fixed
There's a patch included which was an attempt to change that message in the source, except that it doesn't do anything. The code it changes wrapped in "#if 0/#endif". The actual message comes from the builtin bytecode startup sequence, which is basically a precompiled string. Fixing this properly would involve building the bytecode compiler, recompiling buildin_bc_startup to bytecode, and patching that in. Personally I think that's a rather excessive and fragile amount of work to get one string changed and would honestly just close this WONTFIX but maybe someone wants to have a go.
FYI the same happens in clamav-0.99.2-13.fc27.x86_64
*** Bug 1523184 has been marked as a duplicate of this bug. ***
As reference in [0] we need run [1] to avoid [2] but as directory was already created I had to run also [3], conclusion "setsebool -P clamd_use_jit on" is correct but we also need "setsebool -P antivirus_can_scan_system on" [0] https://blog.fsecurity.co.nz/linux-install-clamav-centos-7/ [1] setsebool -P clamd_use_jit 1 setsebool -P antivirus_can_scan_system 1 [2] system_u:system_r:antivirus_t:s0 49 sock_file create system_u:object_r:var_run_t:s0 denied [3] restorecon -R -v /var/run/clamd.scan
clamd_use_jit (in epel7) is an alias to antivirus_use_jit but after [1] I don't see any SELinux refusal , so seems [2] is enough . Maybe I should report upstream . [1] setsebool -P antivirus_use_jit 0 [2] setsebool -P antivirus_can_scan_system 1
clamav-0.100.2-2.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b6e8b488d2
Sorry my mistake when choosing the bugs fixed on clamav-0.100.2-2.el7 and clamav-0.100.2-2.el7 doesn't fix this bug .
Filed upstream: https://bugzilla.clamav.net/show_bug.cgi?id=12372
EPEL 7 entered end-of-life (EOL) status on 2024-06-30. EPEL 7 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug.