12

I've recently noticed a frustrating niggle... When processing email, an Ubuntu Server (with all the updates applied) reports "Permission denied" when trying to virus scan attachments.

Apr  2 14:05:20 svr amavis[6376]: (06376-01) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts: lstat() failed: Permission denied. ERROR\n"
Apr  2 14:05:20 svr amavis[6376]: (06376-01) (!)ClamAV-clamd av-scanner FAILED: CODE(0x30cf250) unexpected , output="/var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts: lstat() failed: Permission denied. ERROR\n" at (eval 136) line 899.
Apr  2 14:05:20 svr amavis[6376]: (06376-01) (!)WARN: all primary virus scanners failed, considering backups

When I look at the directories in question, I see this:

$ ls -ld /var/lib/amavis/tmp
drwxrwx--- 4 amavis amavis 4096 Apr  2 14:16 /var/lib/amavis/tmp
$ ls -ld /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/
drwxr-x--- 3 amavis amavis 4096 Apr  2 14:05 /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/
$ ls -ld /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts                                                                                                                                                                           
drwxr-x--- 2 amavis amavis 4096 Apr  2 14:16 /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts

I made sure the clamd user is a member of the amavisd group - but this didn't fix anything. Can anyone tell me, specifically, which component wants what permissions - and... ideally... what to do to fix this?

Clarification: I am not looking for explanations of the fundamentals of permissions. I am looking for a solution appropriate to this specific problem - which, at first glance, at least, looks as if a component of the amavis suite (perhaps clamd) is using the wrong umask value. Of course, this fault may have arisen as a result of a number of bugs or configuration glitches. I am looking, specifically, for the most appropriate resolution for this case... where a 'vanilla' amavis/clamav install fails to access the contents of temporary folders it creates as/when required to scan inbound email.

I am aware of this similar (non-Ubuntu) question. The Redhat/Centos answer doesn't solve the problem I experience with Ubuntu.

This problem is encountered on "Ubuntu 14.04.2 LTS" - there are no pending updates.

4
  • The group amavis has no write permissions for /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/ and /var/lib/amavis/tmp/amavis-20150402T140519-06376-PZcyHfOt/parts
    – A.B.
    Apr 2, 2015 at 14:31
  • Try this chmod -R g+w /var/lib/amavis/tmp
    – A.B.
    Apr 2, 2015 at 14:35
  • The problem isn't that I can't change the permissions to permit group write on the directories... The problem is that I don't know how to ensure that directories created under /var/lib/amavis/tmp/ - in future - get created with the correct permissions. This directory seems to be where amavis expands messages to inspect attachments. The defaults used to work... now, after some updates, it doesn't.
    – aSteve
    Apr 2, 2015 at 20:57
  • Then work on your question.
    – A.B.
    Apr 4, 2015 at 9:43

6 Answers 6

13

A working solution is to change

AllowSupplementaryGroups false -> true

in /etc/clamav/clamd.conf

restart clamav-daemon

6
  • 2
    This is what solved it for me (I'm on Debian Jessie). Adding clamav to the amavis group didn't solve it.
    – chmike
    Feb 6, 2016 at 16:27
  • 2
    The AllowSupplementaryGroups option has been dropped in recent versions of clamav (0.99.2+, Jun 2, 2016 in upstream). Aug 31, 2016 at 2:35
  • 1
    +1 This worked. The approved answer below DOES NOT. If you followed the Ubuntu AmavisNew wiki page (hopefully), you would have already added amavis/clamav as supplementary groups to one another. Approved answer does nothing but repeat this - and does not work. I am running default pkgs on 16.04.1 LTS. ref: help.ubuntu.com/community/PostfixAmavisNew
    – B. Shea
    Feb 16, 2017 at 17:46
  • Specifically: help.ubuntu.com/community/PostfixAmavisNew#Troubleshooting
    – B. Shea
    Feb 16, 2017 at 17:55
  • Confirmed: fixed problem for me, as well, Ubuntu LTS 16.04.1
    – user679742
    Apr 18, 2017 at 20:09
7

While the clamd user was a member of the amavis group, the clamd process was running as the clamav (not clamd) user.

Adding clamav to the amavis group solved the issue.

3

As AllowSupplementaryGroups does not exist anymore, I ended by adding each user to the other group, like this:

usermod -a -G clamav amavis
usermod -a -G amavis clamav

(and restart everything just to be sure)

/etc/init.d/clamav-daemon restart
/etc/init.d/amavis restart
/etc/init.d/postfix restart

With this, no need to change folder permission on /var/lib/amavis/tmp (and I'm not sure those permissions will be left as is on the next apt-get upgrade...)

4
  • The default pkg on 16.04.1 has the directive AllowSupplementaryGroups in main config. You are posting misleading information. If the directive does not exist in newer versions - then why does adding the supplementary groups to each account work for you? IT IS STILL IN THE CONFIG on 16.04.1 because it isn't used anymore? Hmm. Show me proof. BTW switching this 'TRUE' made everything work on 16.04.1. ref: help.ubuntu.com/community/PostfixAmavisNew#Troubleshooting
    – B. Shea
    Feb 16, 2017 at 17:52
  • This is not true that AllowSupplementaryGroups does not exist. And what's more you have to set it to true to actually make it work. Mar 22, 2017 at 21:48
  • Grep from source ver 0.99.2 clamd/clamd.c- if(optget(opts, "AllowSupplementaryGroups")->enabled) { clamd/clamd.c-#ifdef HAVE_INITGROUPS clamd/clamd.c: if(initgroups(opt->strarg, user->pw_gid)) { clamd/clamd.c: fprintf(stderr, "ERROR: initgroups() failed.\n"); clamd/clamd.c- optfree(opts); clamd/clamd.c- return 1; clamd/clamd.c- } clamd/clamd.c-#else Jul 13, 2017 at 5:12
  • clamd[24248]: WARNING: Ignoring deprecated option AllowSupplementaryGroups at /etc/clamav/clamd.conf:8 At least in September 2020, AllowSupplementaryGroups is no longer an option. Posting this because so many Google results are leading to this now way outdated thread.
    – jrn75
    Sep 16, 2020 at 19:02
0

I was looking around and did not find any information on what i did. First I unmounted the drive in question then remounted the drive.

ls -l /dev
sudo umount /dev/sdd4
sudo mkdir /mnt
sudo mount /dev/sdd4 /mnt
0

The lstat manual says:

No permissions are required on the file itself, but—in the case of stat() and
lstat() — execute (search) permission is required on all of the directories
in path that lead to the file.

So check if all libraries in the path have execute permission.

-5

Have you tried enter this in the terminal:

       sudo -i
       gksu thunar

and if thunar is not installed enter this in the terminal:

        sudo apt-get install thunar 

and make permission read and write for the directory:

       /var/lib/amavis

and this is whit thunar, and it might work fine this way.

4
  • 4
    Thunar to set permissions? OMG.
    – A.B.
    Apr 2, 2015 at 14:27
  • 2
    And then on a server?
    – A.B.
    Apr 2, 2015 at 14:36
  • Mishael, you can use this to change permission when you have GUI (gtk2+xfce ) already installed like Ubuntu desktop edition. The OP here mentioned the use of Ubuntu Server. That means No GUI installed and you have to use CLI/command line instead. eq: sudo chmod -R +rw /var/lib/amavis (-R for recursive)
    – user.dz
    Apr 11, 2015 at 8:55
  • Try this ulimet -i unlimted, and it might work fine this way.
    – Michael
    Jun 17, 2016 at 6:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .