{"id":703,"date":"2017-03-21T13:02:11","date_gmt":"2017-03-21T11:02:11","guid":{"rendered":"https:\/\/helia.ee\/koolitus\/?page_id=703"},"modified":"2017-03-21T13:02:11","modified_gmt":"2017-03-21T11:02:11","slug":"debian-8-how-to-fix-amvavis-reporting-permission-denied-for-clamav","status":"publish","type":"page","link":"https:\/\/helia.ee\/koolitus\/?page_id=703","title":{"rendered":"Debian 8 – How to fix amvavis reporting \u201cpermission denied\u201d for clamav"},"content":{"rendered":"
\n

How to fix amvavis reporting \u201cpermission denied\u201d for clamav<\/a><\/h1>\n<\/div>\n
\n
\n
<\/div>\n\n\n\n
\n
up vote<\/a>5<\/span>down vote<\/a>favorite<\/a><\/p>\n
1<\/b><\/div>\n<\/div>\n<\/td>\n
\n
\n
\n

I’ve recently noticed a frustrating niggle… When processing email, an Ubuntu Server (with all the updates applied) reports “Permission denied” when trying to virus scan attachments.<\/p>\n

Apr  2 14:05:20 svr amavis[6376]: (06376-01) (!)run_av (ClamAV-clamd) FAILED - unexpected , output=\"\/var\/lib\/amavis\/tmp\/amavis-20150402T140519-06376-PZcyHfOt\/parts: lstat() failed: Permission denied. ERROR\\n\"\r\nApr  2 14:05:20 svr amavis[6376]: (06376-01) (!)ClamAV-clamd av-scanner FAILED: CODE(0x30cf250) unexpected , output=\"\/var\/lib\/amavis\/tmp\/amavis-20150402T140519-06376-PZcyHfOt\/parts: lstat() failed: Permission denied. ERROR\\n\" at (eval 136) line 899.\r\nApr  2 14:05:20 svr amavis[6376]: (06376-01) (!)WARN: all primary virus scanners failed, considering backups\r\n<\/code><\/pre>\n
When I look at the directories in question, I see this:<\/p>\n
$ ls -ld \/var\/lib\/amavis\/tmp\r\ndrwxrwx--- 4 amavis amavis 4096 Apr  2 14:16 \/var\/lib\/amavis\/tmp\r\n$ ls -ld \/var\/lib\/amavis\/tmp\/amavis-20150402T140519-06376-PZcyHfOt\/\r\ndrwxr-x--- 3 amavis amavis 4096 Apr  2 14:05 \/var\/lib\/amavis\/tmp\/amavis-20150402T140519-06376-PZcyHfOt\/\r\n$ ls -ld \/var\/lib\/amavis\/tmp\/amavis-20150402T140519-06376-PZcyHfOt\/parts                                                                                                                                                                           \r\ndrwxr-x--- 2 amavis amavis 4096 Apr  2 14:16 \/var\/lib\/amavis\/tmp\/amavis-20150402T140519-06376-PZcyHfOt\/parts\r\n<\/code><\/pre>\n
I made sure the clamd user is a member of the amavisd group – but this didn’t fix anything. Can anyone tell me, specifically, which component wants what permissions – and… ideally… what to do to fix this?<\/p>\n
Clarification<\/strong>: I am not looking an explanations of the fundamentals of permissions. I am looking for a solution appropriate to this specific problem – which, at first glance, at least, looks as if a component of the amavis suite (perhaps clamd) is using the wrong umask value. Of course, this fault may have arisen as a result of a number of bugs or configuration glitches. I am looking, specifically, for the most appropriate resolution for this case… where a ‘vanilla’ amavis\/clamav install fails to access the contents of temporary folders it creates as\/when required to scan inbound email.<\/p>\n
I am aware of this<\/a> similar (non-Ubuntu) question. The Redhat\/Centos answer doesn’t solve the problem I experience with Ubuntu.<\/p>\n
This problem is encountered on “Ubuntu 14.04.2 LTS” – there are no pending updates.<\/p>\n<\/div>\n
permissions<\/a> antivirus<\/a> clamav<\/a> amavisd-new<\/a><\/div>\n\n\n\n\n
\n
share<\/a>improve this question<\/a><\/div>\n<\/td>\n
\n
\n
edited Apr 4 ’15 at 13:31<\/span><\/a><\/div>\n
<\/div>\n
<\/div>\n<\/div>\n<\/td>\n
\n
\n
asked Apr 2 ’15 at 13:26<\/span><\/div>\n
\n
\"\"<\/div>\n<\/div>\n
aSteve<\/a><\/p>\n
174<\/span>2<\/span><\/span>3<\/span><\/span>15<\/span><\/span><\/div>\n<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/td>\n<\/tr>\n
<\/td>\n\n
\n\n\n\n
\n\n\n\n\n
<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n\n
The group amavis<\/code> has no write permissions for \/var\/lib\/amavis\/tmp\/amavis-20150402T140519-06376-PZcyHfOt\/<\/code> and \/var\/lib\/amavis\/tmp\/amavis-20150402T140519-06376-PZcyHfOt\/pa\u200c\u200brts<\/code><\/span> \u2013\u00a0A.B.<\/a> Apr 2 ’15 at 14:31<\/span><\/a><\/span><\/div>\n<\/td>\n<\/tr>\n
\n\n\n\n\n
<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n\n
Try this chmod -R g+w \/var\/lib\/amavis\/tmp<\/code><\/span> \u2013\u00a0A.B.<\/a> Apr 2 ’15 at 14:35<\/span><\/a><\/span><\/div>\n<\/td>\n<\/tr>\n
\n\n\n\n\n
<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n\n
The problem isn’t that I can’t change the permissions to permit group write on the directories… The problem is that I don’t know how to ensure that directories created under \/var\/lib\/amavis\/tmp\/ – in future – get created with the correct permissions. This directory seems to be where amavis expands messages to inspect attachments. The defaults used to work… now, after some updates, it doesn’t.<\/span> \u2013\u00a0aSteve<\/a> Apr 2 ’15 at 20:57<\/span><\/a><\/span><\/div>\n<\/td>\n<\/tr>\n
\n\n\n\n
<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n\n
Then work on your question.<\/span> \u2013\u00a0A.B.<\/a> Apr 4 ’15 at 9:43<\/span><\/a><\/span><\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n