Description of problem: Fresh install - multiple errors that appear identical to https://bugzilla.redhat.com/show_bug.cgi?id=495502 - filed against RHEL. Basically, Clamav + clamav-milter + sendmail doesn't work. Issues include: Configuration files mismatch (i.e., .sock vs. .socket), Permissions hosed - i.e., clamd scanner can't connect properly to the milter... fixing that selinux complains. Fixing that, sendmail can't communicate properly with the milter... many errors (again, pretty much what is documented against RHEL in the above link. Version-Release number of selected component (if applicable): 95-1.2 How reproducible: Totally - just do a clean fedora 11 install including sendmail and clamav + milter. It doesn't work. (I did have this working on Fedora 11 and did try copying config files over... no go). Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Thanks for pointing out the inconsistency in README.fedora about 'clamav.sock' vs. 'clamav-milter.sock'. Regarding SELinux issues you might try to file a bug against selinux-policy with more details. I can not reproduce the issues in #495502 in Fedora 11. Else, I highly suggest a setup which communicates over TCP sockets.
fwiw, I added some comments to README.fedora explaining a sample setup http://cvs.fedora.redhat.com/viewvc/rpms/clamav/devel/README.fedora?root=extras&r1=1.3&r2=1.4
Ok, but I think perhaps suggesting ".sock" would be more consistent with everything else. I also added: allow sendmail_t device_t:file {read write }; allow sendmail_t devpts_1:chr_file write; to my selinux policy based on the AVC denials that seem to be related to clamav-milter. I haven't yet retested everything but will later today.
Ok - I've gotten past AVC errors, but cannot get this (or any other milter) working with unix domain sockets. This worked in F10, doesn't in F11. The failure seems to be directory permissions as checked by the safefile call in sendmail. It's got to be the directory as I get the same error whether the .sock file is present or not. I've tried just about everything except running sendmail in debug (next step I guess). As of now, I've been working with both clamav and mimedefang. I tried forcing both to the smmsp user, changing directory ownership for the milter socket parents to smmsp:smmsp; and smmsp:mail with just about every permutation of permissions possible. No matter the log level, I get only the one relevant message: sendmail[20025]: NOQUEUE: SYSERR(root): /etc/mail/sendmail.cf: line 1782: Xmimedefang: local socket name /var/spool/MIMEDefang/mimedefang.sock unsafe: Permission denied I get the corresponding messages from clamav (and also spamass-milter). I'm going to open a ticket against sendmail.
Again: I highly suggest a setup which communicates over TCP sockets.