Re: error ClamAV daemon

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Peter Lesterhuis wrote:

When I boot I see this message: "ClamAV daemon: ERROR: can't open
>>> > > > /var/log/clamav/clamlog in append mode. Check permissions.
>>> ERROR: > > > problem with internal logger. Please check permissions >>> of > > > /var/log/clamav/clamlog."
>>> > > > I checked the permissions (600) and set them to 666 to be sure
>>> that the > > > file is writable for the owner clamav. (Shouldn't be >>> necessary though).
>>> > > > Still I can't start clamd.
>>> > > > In clamav.conf the option LogFileUnlock is uncommented.
>>> > > > I don't understand why I keep having this error.
>>> > > > Any suggestion is wellcome.
>>>
>> > >   > >
>> > > Do you have SELinux enabled, and if so, are there any messages with
>> > > "avc:  denied" in /var/log/messages or /var/log/audit/audit.log?
>> > >     > Yes, I have.
>> > In /var/log/audit/audit.log I have this message:
>> > type=AVC msg=audit(1149784852.944:133): avc: denied { write } for >> > pid=2352 comm="freshclam" name="log" dev=tmpfs ino=6715 >
>> scontext=system_u:system_r:freshclam_t:s0 > >> tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file
>> > type=SYSCALL msg=audit(1149784852.944:133): arch=40000003
>> syscall=102 > success=no exit=-13 a0=3 a1=bf926000 a2=4f32aff4 a3=15 >> items=1 pid=2352 > auid=4294967295 uid=46 gid=46 euid=46 suid=46 >> fsuid=46 egid=46 sgid=46 > fsgid=46 comm="freshclam" >> exe="/usr/bin/freshclam" >> >> Curious. The AVC seems to relate to denial of sending a syslog message,
>> whereas the error message seems to relate to a regular file
>> (/var/log/clamav/clamlog).
>>
>> Are you on FC4 or FC5? Are your selinux policy packages up to date?
>>     > I have FC5 and yes, selinux packages are up to date.
OK, you can fix this denial as follows:

Set yourself up for making local policy modules:

# yum install checkpolicy
# cd /root
# mkdir selinux.local
# cd selinux.local
# chcon -R -t usr_t .
# ln -s /usr/share/selinux/devel/Makefile .

Make a local policy module for this issue, in this directory:

1. Create a file myfreshclam.te with this content:

policy_module(myfreshclam, 0.1.0)

require {
         type freshclam_t;
};

# Allow freshclam to send syslog messages
logging_send_syslog_msg(freshclam_t)

2. Build the policy module:

# make

3. Finally, install your new policy module:

# semodule -i myfreshclam.pp

That should allow freshclam to send syslog messages, though I'm not convinced that that's the actual problem you're seeing.
When I do the "chcon"-step this is happening:

selinux.local]# chcon -R -t usr_t
chcon: too few arguments
Try `chcon --help' for more information.

What should I do now?

Add the dot as the last parameter of the command.

# chcon -R -t usr_t .

Paul.



[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux