Ubuntu
clamav package

ClamAV-clamd av-scanner FAILED: CODE(0x36ab6c8) unexpected , output="/var/lib/amavis/tmp/amavis-20160923T095247-01779-3L04SPou/parts: lstat() failed: Permission denied.

  1. Xenial (16.04)
  2. Bug #1628275
Bug #1628275 reported by Trev Peterson
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
ClamAV
Fix Released
Unknown
clamav (Ubuntu)
Fix Released
Medium
Unassigned
Xenial
Confirmed
Undecided
Unassigned

Bug Description

After installing amavisd-new and clamav-daemon clamav fails with the error:
ClamAV-clamd av-scanner FAILED: CODE(0x36ab6c8) unexpected , output="/var/lib/amavis/tmp/amavis-20160923T095247-01779-3L04SPou/parts: lstat() failed: Permission denied. ERROR\n" at (eval 100) line 905.

clamav user is in the amavis group and the permission on that dir are:

drwxr-x--- 3 amavis amavis 4096 Sep 23 09:52 amavis-20160923T095247-01779-3L04SPou

For a workaround I used the suggestion here:
http://askubuntu.com/questions/604446/how-to-fix-amvavis-reporting-permission-denied-for-clamav

Edited /etc/clamav/clamd.conf and changed
AllowSupplementaryGroups false
to true

I believe this is one of the typical use case scenario for clamav-daemon so this option should be included by default. To me this also seems to be the expected behavior by default (if the user the daemon is run as is in groups allowing access I'd assume it has that access). I don't understand why this is an option and not default behavior.

I'm unsure of whether Debian plans to deprecate/remove the AllowSupplementaryGroups configuration option moving forward. If done, it will break clamav-daemon - avamisd-new integration as is done currently. I point this out to prevent future issues.

Thanks for the great work, I hope this helps.

Tags: bitesize
Revision history for this message
Trev Peterson (trev-advanced-reality) wrote :

I see this behavior in package: clamav-daemon 0.99+dfsg-1ubuntu1.2 on ubuntu 16.04

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

You already outlined the Debian dependency to not deprecate the tunable in this case.
I think also changing the default of the config should not be a Ubuntu Delta.

Since the bug (suboptimal default) is present in Debian too it would be best fixed in Debian, and then Ubuntu will pick it up on the next merge.

Would you mind filing a bug with Debian please?

Changed in clamav (Ubuntu):
importance: Undecided → Medium
status: New → Triaged
tags: added: bitesize needs-upstream-report
Revision history for this message
Urs Mueller (info-urs-mueller) wrote :

There is already a bug filed with debian.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822444

Seems that the problems is due to switching to systemd and false settings within the start of clamav.

From the bug report above:

/lib/systemd/system/clamav-daemon.service

Change ExecStart to:
ExecStart=/usr/sbin/clamd -c /etc/clamav/clamd.conf --foreground=true

Add:
User=clamav
Group=clamav

Bug on debian is closed an a fixed clamav-package should be available! But also to ubuntu?

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Thanks for the info Urs!

That comes down to:
   * Drop AllowSupplementaryGroups option which is default now
     (Closes: #822444).

This is already released and available in Yakkety, but not yet in Xenial.
Since there is a confiuration workaround to it I'm not so sure on the priority of the Xenial SRU.

Changed in clamav (Ubuntu):
status: Triaged → Fix Released
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Hmm, I can't see why I can't add a Xenial bug task here ... FYI so you don#t think I consider all fix-released but only >=16.10

Bug Watch Updater (bug-watch-updater)
Changed in clamav:
status: Unknown → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in clamav (Ubuntu Xenial):
status: New → Confirmed
Joshua Powers (powersj)
tags: removed: needs-upstream-report
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.