SOLVED: error ClamAV daemon

[Peter Lesterhuis]

>
> ith SELinux in permissive mode clamd started without problem.  
>   
>>>>> >>> > > > In the graphical configuration tool of SELinux I found SELinux 
>>>>>           
>> >>> Service Protection; there I only had to check clamd.
>>     
>>>>> >>> > > > Clamd is now also running in enforced mode (SELinux).
>>>>>           
>> >>>     
>>     
>>> >> > >   > >
>>> >> > > Can you post the output of:
>>> >> > >
>>> >> > > # getsebool -a | grep clam
>>> >> > >
>>> >> > > I suspect all you've done is turn off SELinux protection of clamd (by
>>> >> > > setting the clamd_disable_trans boolean). If that's the case, 
>>>       
> >> there is a
>   
>>> >> > > better way but it'll need more work.
>>>       
> >>   > # getsebool -a | grep clam
>   
>> >> > clamd_disable_trans --> on
>> >> > clamscan_disable_trans --> off
>> >> > freshclam_disable_trans --> off
>>     
>>> >> > > As you can see I am afraid that is the case.
>>>       
> >>  
> >> To fix it "properly" you'd need to put SELinux in permissive mode, turn
> >> off the clamd_disable_trans boolean and then find the "avc:  denied"
> >> messages mentioning clamd in your log files when you start and use the
> >> service. By looking at those messages, we can figure out what's wrong
> >> and hopefully fix it.
> >>   
>   
> > I started clamd with SELinux in permissive mode and with 
> > clamd_disable_trans boolean turned off. In /var/log/messages there is 
> > this error:
> > ...
> > Jun 12 23:45:21 cello clamd[3053]: Daemon started.
> > Jun 12 23:45:21 cello clamd[3053]: clamd daemon 0.88.2 (OS: linux-gnu, 
> > ARCH: i386, CPU: i386)
> > Jun 12 23:45:21 cello clamd[3053]: Log file size limit disabled.
> > Jun 12 23:45:21 cello clamd[3053]: Reading databases from /var/lib/clamav
> > Jun 12 23:45:22 cello clamd[3053]: Protecting against 59059 viruses.
> > Jun 12 23:45:22 cello clamd[3054]: bind() error: Address already in use
>   
>
> This one might be normal; sshd generates a similar error message.
>
>   
>> > In /var/log/audit/audit.log there are several "avc: denied" messages:
>> > 
>> > ...

>> Most of these should be fixed in the latest selinux-policy update:
>>
>> # yum update selinux\* policycoreutils libsepol
>>
>> This policy module should fix the others. Create files myclamd.fc and 
>> myclamd.te in the /root/selinux.local you made last time, and run "make" 
>> in that directory.
>>
>> ####### myclamd.fc (one long line) #######
>> /var/log/clamav/clamd.*         -- 
>> gen_context(system_u:object_r:clamd_var_log_t,s0)
>>
>> ####### myclamd.te #######
>> policy_module(myclamd, 0.1.0)
>>
>> require {
>>          type clamd_t;
>> };
>>
>> # Allow clamd to send syslog messages
>> # This is clamav 1.0.1
>> #logging_send_syslog_msg(clamd_t)
>>
>> # term_dontaudit_use_generic_ptys(clamd_t) is in clamav 1.0.1
>> #term_dontaudit_use_generic_ptys(clamd_t)
>>
>> kernel_read_kernel_sysctls(clamd_t)
>>
>>
>>
>>
>> Then load the new module:
>> # semodule -i myclamd
>>
>> Check you have the required module versions
>>
>> # semodule -l
>> amavis  1.0.4
>> clamav  1.0.1
>> myclamd 0.1.0
>> myfreshclam, 0.1.0
>>
>> Fix /var/log/clamav file contexts:
>> # restorecon -rv /var/log/clamav
>> restorecon reset /var/log/clamav/clamd.log context 
>> user_u:object_r:var_log_t->system_u:object_r:clamd_var_log_t
>>
>> Then try restarting clamav and see if any more AVCs appear. If not, try 
>> again in enforcing mode.
>>
>>     
I updated selinux\* policycoreutils and libsepol. I created the files 
myclamd.fc and myclamd.te and issued the "make"-command.
Loading the new module gives me this output:
selinux.local]# semodule -i myclamd
semodule:  Could not read file 'myclamd':

I wish I could be more helpfull, but this is way beyond my understanding 
of SELinux (and clamav). So I simply follow your suggestions and report 
what is happening.
Peter