error ClamAV daemon
Peter Lesterhuis
peterlesterhuis at tiscali.nl
Fri Jun 9 15:10:02 UTC 2006
>
> When I boot I see this message: "ClamAV daemon: ERROR: can't open
>
>>>>> >>> > > > /var/log/clamav/clamlog in append mode. Check permissions.
>>>>>
>> >>> ERROR: > > > problem with internal logger. Please check permissions
>> >>> of > > > /var/log/clamav/clamlog."
>>
>>>>> >>> > > > I checked the permissions (600) and set them to 666 to be sure
>>>>>
>> >>> that the > > > file is writable for the owner clamav. (Shouldn't be
>> >>> necessary though).
>>
>>>>> >>> > > > Still I can't start clamd.
>>>>> >>> > > > In clamav.conf the option LogFileUnlock is uncommented.
>>>>> >>> > > > I don't understand why I keep having this error.
>>>>> >>> > > > Any suggestion is wellcome.
>>>>>
>> >>>
>>
>>> >> > > > >
>>> >> > > Do you have SELinux enabled, and if so, are there any messages with
>>> >> > > "avc: denied" in /var/log/messages or /var/log/audit/audit.log?
>>> >> > > > Yes, I have.
>>>
>> >> > In /var/log/audit/audit.log I have this message:
>> >> > type=AVC msg=audit(1149784852.944:133): avc: denied { write } for
>> >> > pid=2352 comm="freshclam" name="log" dev=tmpfs ino=6715 >
>>
> >> scontext=system_u:system_r:freshclam_t:s0 >
> >> tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file
>
>> >> > type=SYSCALL msg=audit(1149784852.944:133): arch=40000003
>>
> >> syscall=102 > success=no exit=-13 a0=3 a1=bf926000 a2=4f32aff4 a3=15
> >> items=1 pid=2352 > auid=4294967295 uid=46 gid=46 euid=46 suid=46
> >> fsuid=46 egid=46 sgid=46 > fsgid=46 comm="freshclam"
> >> exe="/usr/bin/freshclam"
> >>
> >> Curious. The AVC seems to relate to denial of sending a syslog message,
> >> whereas the error message seems to relate to a regular file
> >> (/var/log/clamav/clamlog).
> >>
> >> Are you on FC4 or FC5? Are your selinux policy packages up to date?
> >>
>
> > I have FC5 and yes, selinux packages are up to date.
>
>
> OK, you can fix this denial as follows:
>
> Set yourself up for making local policy modules:
>
> # yum install checkpolicy
> # cd /root
> # mkdir selinux.local
> # cd selinux.local
> # chcon -R -t usr_t .
> # ln -s /usr/share/selinux/devel/Makefile .
>
> Make a local policy module for this issue, in this directory:
>
> 1. Create a file myfreshclam.te with this content:
>
> policy_module(myfreshclam, 0.1.0)
>
> require {
> type freshclam_t;
> };
>
> # Allow freshclam to send syslog messages
> logging_send_syslog_msg(freshclam_t)
>
> 2. Build the policy module:
>
> # make
>
> 3. Finally, install your new policy module:
>
> # semodule -i myfreshclam.pp
>
> That should allow freshclam to send syslog messages, though I'm not
> convinced that that's the actual problem you're seeing.
>
When I do the "chcon"-step this is happening:
selinux.local]# chcon -R -t usr_t
chcon: too few arguments
Try `chcon --help' for more information.
What should I do now?
By the way thanks for helping me.
Peter.
More information about the fedora-list
mailing list