12

I've recently noticed a frustrating niggle... When processing email, an Ubuntu Server (with all the updates applied) reports "Permission denied" when trying to virus scan attachments.

Apr  2 14:05:20 svr amavis[6376]: (06376-01) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts: lstat() failed: Permission denied. ERROR\n"
Apr  2 14:05:20 svr amavis[6376]: (06376-01) (!)ClamAV-clamd av-scanner FAILED: CODE(0x30cf250) unexpected , output="/var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts: lstat() failed: Permission denied. ERROR\n" at (eval 136) line 899.
Apr  2 14:05:20 svr amavis[6376]: (06376-01) (!)WARN: all primary virus scanners failed, considering backups

When I look at the directories in question, I see this:

$ ls -ld /var/lib/amavis/tmp
drwxrwx--- 4 amavis amavis 4096 Apr  2 14:16 /var/lib/amavis/tmp
$ ls -ld /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/
drwxr-x--- 3 amavis amavis 4096 Apr  2 14:05 /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/
$ ls -ld /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts                                                                                                                                                                           
drwxr-x--- 2 amavis amavis 4096 Apr  2 14:16 /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts

I made sure the clamd user is a member of the amavisd group - but this didn't fix anything. Can anyone tell me, specifically, which component wants what permissions - and... ideally... what to do to fix this?

Clarification: I am not looking an explanations of the fundamentals of permissions. I am looking for a solution appropriate to this specific problem - which, at first glance, at least, looks as if a component of the amavis suite (perhaps clamd) is using the wrong umask value. Of course, this fault may have arisen as a result of a number of bugs or configuration glitches. I am looking, specifically, for the most appropriate resolution for this case... where a 'vanilla' amavis/clamav install fails to access the contents of temporary folders it creates as/when required to scan inbound email.

I am aware of this similar (non-Ubuntu) question. The Redhat/Centos answer doesn't solve the problem I experience with Ubuntu.

This problem is encountered on "Ubuntu 14.04.2 LTS" - there are no pending updates.

  • The group amavis has no write permissions for /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/ and /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts – A.B. Apr 2 '15 at 14:31
  • Try this chmod -R g+w /var/lib/amavis/tmp – A.B. Apr 2 '15 at 14:35
  • The problem isn't that I can't change the permissions to permit group write on the directories... The problem is that I don't know how to ensure that directories created under /var/lib/amavis/tmp/ - in future - get created with the correct permissions. This directory seems to be where amavis expands messages to inspect attachments. The defaults used to work... now, after some updates, it doesn't. – aSteve Apr 2 '15 at 20:57
  • Then work on your question. – A.B. Apr 4 '15 at 9:43
13

A working solution is to change

AllowSupplementaryGroups false -> true

in /etc/clamav/clamd.conf

restart clamav-daemon

|improve this answer|||||
  • 2
    This is what solved it for me (I'm on Debian Jessie). Adding clamav to the amavis group didn't solve it. – chmike Feb 6 '16 at 16:27
  • 2
    The AllowSupplementaryGroups option has been dropped in recent versions of clamav (0.99.2+, Jun 2, 2016 in upstream). – Daniel Vérité Aug 31 '16 at 2:35
  • 1
    +1 This worked. The approved answer below DOES NOT. If you followed the Ubuntu AmavisNew wiki page (hopefully), you would have already added amavis/clamav as supplementary groups to one another. Approved answer does nothing but repeat this - and does not work. I am running default pkgs on 16.04.1 LTS. ref: help.ubuntu.com/community/PostfixAmavisNew – bshea Feb 16 '17 at 17:46
  • Specifically: help.ubuntu.com/community/PostfixAmavisNew#Troubleshooting – bshea Feb 16 '17 at 17:55
  • Confirmed: fixed problem for me, as well, Ubuntu LTS 16.04.1 – user679742 Apr 18 '17 at 20:09
6

While the clamd user was a member of the amavis group, the clamd process was running as the clamav (not clamd) user.

Adding clamav to the amavis group solved the issue.

|improve this answer|||||
2

As AllowSupplementaryGroups does not exist anymore, I ended by adding each user to the other group, like this:

usermod -a -G clamav amavis
usermod -a -G amavis clamav

(and restart everything just to be sure)

/etc/init.d/clamav-daemon restart
/etc/init.d/amavis restart
/etc/init.d/postfix restart

With this, no need to change folder permission on /var/lib/amavis/tmp (and I'm not sure those permissions will be left as is on the next apt-get upgrade...)

|improve this answer|||||
  • The default pkg on 16.04.1 has the directive AllowSupplementaryGroups in main config. You are posting misleading information. If the directive does not exist in newer versions - then why does adding the supplementary groups to each account work for you? IT IS STILL IN THE CONFIG on 16.04.1 because it isn't used anymore? Hmm. Show me proof. BTW switching this 'TRUE' made everything work on 16.04.1. ref: help.ubuntu.com/community/PostfixAmavisNew#Troubleshooting – bshea Feb 16 '17 at 17:52
  • This is not true that AllowSupplementaryGroups does not exist. And what's more you have to set it to true to actually make it work. – user3021729 Mar 22 '17 at 21:48
  • Grep from source ver 0.99.2 clamd/clamd.c- if(optget(opts, "AllowSupplementaryGroups")->enabled) { clamd/clamd.c-#ifdef HAVE_INITGROUPS clamd/clamd.c: if(initgroups(opt->strarg, user->pw_gid)) { clamd/clamd.c: fprintf(stderr, "ERROR: initgroups() failed.\n"); clamd/clamd.c- optfree(opts); clamd/clamd.c- return 1; clamd/clamd.c- } clamd/clamd.c-#else – Ding-Yi Chen Jul 13 '17 at 5:12
0

I was looking around and did not find any information on what i did. First I unmounted the drive in question then remounted the drive.

ls -l /dev
sudo umount /dev/sdd4
sudo mkdir /mnt
sudo mount /dev/sdd4 /mnt
|improve this answer|||||
-5

Have you tried enter this in the terminal:

       sudo -i
       gksu thunar

and if thunar is not installed enter this in the terminal:

        sudo apt-get install thunar 

and make permission read and write for the directory:

       /var/lib/amavis

and this is whit thunar, and it might work fine this way.

|improve this answer|||||
  • 4
    Thunar to set permissions? OMG. – A.B. Apr 2 '15 at 14:27
  • 2
    And then on a server? – A.B. Apr 2 '15 at 14:36
  • Mishael, you can use this to change permission when you have GUI (gtk2+xfce ) already installed like Ubuntu desktop edition. The OP here mentioned the use of Ubuntu Server. That means No GUI installed and you have to use CLI/command line instead. eq: sudo chmod -R +rw /var/lib/amavis (-R for recursive) – user.dz Apr 11 '15 at 8:55
  • Try this ulimet -i unlimted, and it might work fine this way. – Michael Jun 17 '16 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.