error ClamAV daemon

[Peter Lesterhuis]

>
> When I boot I see this message: "ClamAV daemon: ERROR: can't open   
>   
>>>>>>>>>>> >>>>>> >>> > > > /var/log/clamav/clamlog in append mode. Check 
>>>>>>>>>>>                       
>>>>> >>>>>> permissions.           
>>>>> >>> >>> ERROR: > > > problem with internal logger. Please check 
>>>>>           
>> >>> permissions >>> of > > > /var/log/clamav/clamlog."
>> >>>    
>>     
>>>>>>>>>>> >>>>>> >>> > > > I checked the permissions (600) and set them to 666 to 
>>>>>>>>>>>                       
>>>>> >>>>>> be sure           
>>>>> >>> >>> that the > > > file is writable for the owner clamav. (Shouldn't 
>>>>>           
>> >>> be >>> necessary though).
>> >>>    
>>     
>>>>>>>>>>> >>>>>> >>> > > > Still I can't start clamd.
>>>>>>>>>>> >>>>>> >>> > > > In clamav.conf the option LogFileUnlock is uncommented.
>>>>>>>>>>> >>>>>> >>> > > > I don't understand why I keep having this error.
>>>>>>>>>>> >>>>>> >>> > > > Any suggestion is wellcome.
>>>>>>>>>>>                       
>>>>> >>>>>>           
>>>>> >>> >>>        
>>>>>           
>>>>>>> >>>> >> > >   > >
>>>>>>> >>>> >> > > Do you have SELinux enabled, and if so, are there any 
>>>>>>>               
>>> >>>> messages with
>>>       
>>>>>>> >>>> >> > > "avc:  denied" in /var/log/messages or /var/log/audit/audit.log?
>>>>>>> >>>> >> > >     > Yes, I have.
>>>>>>>               
>>> >>>>       
>>>       
>>>>> >>> >> > In /var/log/audit/audit.log I have this message:
>>>>> >>> >> > type=AVC msg=audit(1149784852.944:133): avc:  denied  { write } 
>>>>>           
>> >>> for  >> > pid=2352 comm="freshclam" name="log" dev=tmpfs ino=6715 >     
>>     
>>> >> >> scontext=system_u:system_r:freshclam_t:s0 > >> 
>>>       
> >> tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file
> >>  
>   
>>>>> >>> >> > type=SYSCALL msg=audit(1149784852.944:133): arch=40000003     
>>>>>           
>>> >> >> syscall=102 > success=no exit=-13 a0=3 a1=bf926000 a2=4f32aff4 
>>>       
> >> a3=15 >> items=1 pid=2352 > auid=4294967295 uid=46 gid=46 euid=46 
> >> suid=46 >> fsuid=46 egid=46 sgid=46 > fsgid=46 comm="freshclam" >> 
> >> exe="/usr/bin/freshclam"
>   
>>> >> >>  >> Curious. The AVC seems to relate to denial of sending a syslog 
>>>       
> >> message,
>   
>>> >> >> whereas the error message seems to relate to a regular file
>>> >> >> (/var/log/clamav/clamlog).
>>> >> >>
>>> >> >> Are you on FC4 or FC5? Are your selinux policy packages up to date?
>>> >> >>     > I have FC5 and yes, selinux packages are up to date.
>>>       
> >>  
> >> OK, you can fix this denial as follows:
> >>
> >> Set yourself up for making local policy modules:
> >>
> >> # yum install checkpolicy
> >> # cd /root
> >> # mkdir selinux.local
> >> # cd selinux.local
> >> # chcon -R -t usr_t .
> >> # ln -s /usr/share/selinux/devel/Makefile .
> >>
> >> Make a local policy module for this issue, in this directory:
> >>
> >> 1. Create a file myfreshclam.te with this content:
> >>
> >> policy_module(myfreshclam, 0.1.0)
> >>
> >> require {
> >>          type freshclam_t;
> >> };
> >>
> >> # Allow freshclam to send syslog messages
> >> logging_send_syslog_msg(freshclam_t)
> >>
> >> 2. Build the policy module:
> >>
> >> # make
> >>
> >> 3. Finally, install your new policy module:
> >>
> >> # semodule -i myfreshclam.pp
> >>
> >> That should allow freshclam to send syslog messages, though I'm not 
> >> convinced that that's the actual problem you're seeing.
> >>   
>   
> > When I do the "chcon"-step this is happening:
> > 
> > selinux.local]# chcon -R -t usr_t
> > chcon: too few arguments
> > Try `chcon --help' for more information.
> > 
> > What should I do now?
>   
>
> Add the dot as the last parameter of the command.
>
> # chcon -R -t usr_t .
>   
You are right; I missed the dot. I built the module following your 
instructions. Still I can't start clamd en the error message during 
booting is still there.
Peter