fedora-selinux August 2010 archive
Main Archive Page > Month Archives  > fedora-selinux archives
fedora-selinux: Re: Clamd - again...

Re: Clamd - again...

From: Dominick Grift <domg472_at_nospam>
Date: Wed Aug 25 2010 - 19:32:50 GMT
To: selinux@lists.fedoraproject.org

On 08/25/2010 08:33 PM, Arthur Dent wrote:
> On Tue, 2010-08-24 at 11:07 +0200, Dominick Grift wrote:
>> On 08/24/2010 11:05 AM, Arthur Dent wrote:
>>> On Tue, 2010-08-24 at 09:18 +0200, Dominick Grift wrote:
>>>
>>>>
>>>> Does:
>>>> /root/scripts/clamdwatch -q && ( /usr/bin/killall -9 clamd; rm -fr
>>>> /var/run/clamd.sock; rm -rf /tmp/clamav-*; chcon -t /tmp/clamdwatch*;
>>>> /etc/init.d/clamd start 2>&1 )
>>>>
>>>> make it work?
>>>
>>> Hmm... Why doesn't it like that?
>>>
>>> chcon: missing operand
>>> Try `chcon --help' for more information.
>>> Starting clamd: [ OK ]
>>>
>>
>> Whoops, its: chcon -t clamd_tmp_t /tmp/clamdwatch*;
>
> OK - I'm not sure this approach is going to work. If I run this cronjob
> script it returns the following:
> chcon: cannot access `/tmp/clamdwatch*': No such file or directory
> Starting clamd: [ OK ]

Why is that happening? It looks like clamd started "OK" ?
fact of the matter is that clamd_t cannot access user_tmp_t files/dir
so by labelling it clamd_tmp_t , clamd_t should be able to read it.

How to implement that best can be tested.

optionally one could (and probably should) confine clamdwatch but that
would take some work.

i am of the opinion that by just labelling the offending object manually
clamd_tmp_t it should work and be an easy fix.

> The reason is - I think - because the clamdwatch script does certain
> tests and puts the results in /tmp/clamdwatch. Only if the results of
> the test fail does it kill everything and clean up after itself and then
> restart clamd.
>
> If I try to run the clamdwatch script from the command line this is what
> I get:
>
> [root@troodos scripts]# ./clamdwatch
> Clamd is in an unknown state.
> It returned: /tmp/clamdwatch-ymyC2PA1n1gjmt9Z: Access denied. ERROR
>
> Thanks again..
>
> Mark
>
>
>
>
>
> --
> selinux mailing list
> selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux

-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux