Exim + ClamAV file access error

Question

I have a working Exim setup and wanted to add AV scanning to that. I followd the instructions for setting up ClamAV at this site. So now my permissions for the /var/spool/exim directory are as follows:

root@luxembourg:/var/spool/exim# ls -la
total 28
drwxrws---  6 exim exim 4096 2011-10-04 15:54 .
drwxr-xr-x  5 root root 4096 2011-09-30 13:45 ..
drwxrws---  2 exim exim 4096 2011-10-04 14:26 db
-rw-r--r--  1 root exim    6 2011-10-07 14:41 exim-daemon.pid
drwxrws--- 29 exim exim 4096 2011-10-07 14:33 input
drwxrws--- 24 exim exim 4096 2011-10-07 11:24 msglog
drwxrws---  2 exim exim 4096 2011-10-07 14:48 scan

Also, the clamav user is part of the exim group:

root@luxembourg:/var/spool/exim# grep clamav /etc/group
exim:x:1001:clamav
clamav:x:111:

Also, I have the following line in the clamd.conf file:

AllowSupplementaryGroups true

However, I get these errors:

2011-10-07 14:41:55 1RC9kR-0006mz-KD malware acl condition: clamd: ClamAV returned: /var/spool/exim/scan/1RC9kR-0006mz-KD/1RC9kR-0006mz-KD.eml: Can't open file or directory ERROR
2011-10-07 14:41:55 1RC9kR-0006mz-KD H=mail-vw0-f51.google.com [209.85.212.51] F=<someone@example.net> temporarily rejected after DATA
2011-10-07 14:42:45 1RC9lF-0006no-0Q malware acl condition: clamd: ClamAV returned: /var/spool/exim/scan/1RC9lF-0006no-0Q/1RC9lF-0006no-0Q.eml: Can't open file or directory ERROR
2011-10-07 14:42:45 1RC9lF-0006no-0Q H=mail-vw0-f51.google.com [209.85.212.51] F=<someone@example.net> temporarily rejected after DATA
2011-10-07 14:46:43 1RC9p5-0006nq-DV malware acl condition: clamd: ClamAV returned: /var/spool/exim/scan/1RC9p5-0006nq-DV/1RC9p5-0006nq-DV.eml: Can't open file or directory ERROR
2011-10-07 14:46:43 1RC9p5-0006nq-DV H=mail-vw0-f51.google.com [209.85.212.51] F=<someone@example.net> temporarily rejected after DATA
2011-10-07 14:48:20 1RC9qe-0006nt-0v malware acl condition: clamd: ClamAV returned: /var/spool/exim/scan/1RC9qe-0006nt-0v/1RC9qe-0006nt-0v.eml: Can't open file or directory ERROR
2011-10-07 14:48:20 1RC9qe-0006nt-0v H=mail-vw0-f51.google.com [209.85.212.51] F=<someone@example.net> temporarily rejected after DATA
2011-10-07 14:49:44 1RC9rz-0006o3-SP malware acl condition: clamd: ClamAV returned: /var/spool/exim/scan/1RC9rz-0006o3-SP/1RC9rz-0006o3-SP.eml: Can't open file or directory ERROR
2011-10-07 14:49:44 1RC9rz-0006o3-SP H=mail-vx0-f179.google.com [209.85.220.179] F=<someone@example.net> temporarily rejected after DATA
2011-10-07 14:51:04 1RC9tB-0006oF-Uf malware acl condition: clamd: ClamAV returned: /var/spool/exim/scan/1RC9tB-0006oF-Uf/1RC9tB-0006oF-Uf.eml: Can't open file or directory ERROR
2011-10-07 14:51:04 1RC9tB-0006oF-Uf H=localhost (mailserver.com) [127.0.0.1] F=<loclaluser@mailserver.com> temporarily rejected after DATA

I get these for ALL MAIL sent to my server and consequently, all mail is being "temporarily" rejected. This makes no sense to me, as the directory permissions are correct and clamav runs as the correct user.

I even tried running clamav with the exim user, but nothing changed (which is even more puzzling...).

Any ideas?

Answer 1

I ran into the same problem as you, it took me a while to figure out the root of the problem but eventually I have it up and running.

First; you have to edit the clamd apparmor profile in:

/etc/apparmor.d/usr.sbin.clamd

Since you installed from source, edit the following line:

# For use with exim /var/spool/exim4/** r,

to

# For use with exim /var/spool/exim/** r,

and then add this line:

/var/spool/exim/scan/** rw,

sudo /etc/init.d/apparmor restart to reload the profiles.

I still got permission errors after doing this though and I read that exim and clamav user permissions don't always play nicely together. So I setup clamd.conf to be run as the same user and group as exim.

In my case,

LocalSocketGroup yscheelen

User yscheelen

After restarting clamav-daemon I managed to send the virus string through Telnet.

Clamav.log output:

Sun Oct 9 22:27:16 2011 -> /var/spool/exim/scan/1RCzxo-0007tg-DW/1RCzxo-0007tg-DW.eml: Eicar-Test-Signature(75b94725bb947ffef38ede71495c5106:605) FOUND

Exim.log output:

2011-10-09 22:26:06 1RCzwh-0007tC-OE Completed 2011-10-09 22:27:16 1RCzxo-0007tg-DW H=localhost [127.0.0.1] F= rejected after DATA: This message contains a virus (Eicar-Test-Signature).

Good luck bro