Description of problem:
The /etc/cron.daily/freshclam script is part of the ClamAV package. It is used to update the local anti-virus databases. In /etc/freshclam.conf we have set 'OnUpdateExecute' to run a local perl script. ('OnUpdateExecute' gets run if the local databases are actually updated.) The local script uses 'strict.pm', but SELinux is denying it access to the module. The cron script emails an error message to root that 'strict.pm' cannot be found.

This problem does not exist on our RHEL 5.8 systems despite using the exact same configurations and scripts.


Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-155.el6_3.4.noarch
clamav-0.97.6-1.el6.x86_64

How reproducible:
The problem occurs each time the freshclam script runs in the early morning.

Steps to Reproduce:
1. Install ClamAV, and modify /etc/freshclam.conf to use 'OnUpdateExecute' to run a perl script using strict.pm.
2.
3.
  
Actual results:
Email message sent to root:

=============================
Can't locate strict.pm in @INC (@INC
contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /usr/local/bin/xymon_event line 15.
BEGIN failed--compilation aborted at /usr/local/bin/xymon_event line 15.
=============================

Expected results:
Local script should run with no problems. No email message should be sent to root.

Additional info:

As can be seen above in the message sent to root @INC includes '/usr/share/perl5'. This is where the 'perl' package installs strict.pm:

=========================
ls -l /usr/share/perl5/strict.pm
-rw-r--r--. 1 root root 3716 Jun 22 14:28 /usr/share/perl5/strict.pm
=========================

The /var/log/audit/audit.log' shows SELinux denying access:

=========================
type=AVC msg=audit(1349922579.929:111741): avc:  denied  { getattr } for  pid=29296 comm="xymon_event" path="/usr/share/perl5/strict.pm" dev=sda1 ino=922261 scontext=system_u:system_r:freshclam_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file
=========================

The in-house perl script 'xymon_event' starts with the statement 'use strict.pm;'. This script is part of our monitoring system and works fine throughout the day, and on other 6.3 and 5.8 servers. It is only this freshclam/clamav problem, on RHEL 6.3, that is occurring.

I noticed that on our RHEL 5.8 systems strict.pm is in a 'lib' directory with different attributes:

RHEL 5.8:
=========================
ls -Z /usr/lib/perl5/5.8.8/strict.pm
-rw-r--r--  root root system_u:object_r:lib_t          /usr/lib/perl5/5.8.8/strict.pm
=========================

RHEL 6.3:
=========================
ls -Z /usr/share/perl5/strict.pm
-rw-r--r--. root root system_u:object_r:usr_t:s0       /usr/share/perl5/strict.pm
=========================