6

Whenever I try to execute a ClamAV scan on a file in many of my bin directories, it fails with a

Can't open file or directory ERROR

message. I know it's possible to get ClamdScan to scan the bin directory but I can't figure out how. Any suggestions?

$ clamdscan /bin/true
/bin/true: Can't open file or directory ERROR

----------- SCAN SUMMARY -----------
Infected files: 0
Total errors: 1
Time: 0.000 sec (0 m 0 s)

I can't find any differences between the AppArmor configuration files on the machine where it works and on the machine where it doesn't. I did get it to scan with a workaround by adding:

/bin/** r,

to:

/etc/apparmor.d/local/usr.sbin.clamd

But this line isn't present on the other machine's local clamd AppArmor permissions file so I'm still confused and such a shot-gun solution of just saying ClamAV can access everything in /bin and below mainly because if this is the solution then I have to add /sbin /usr/bin and /usr/sbin to AppArmor as well, and that just seems counter-intuitive.

2
  • Please provide the permission information on the folder.
    – Ramhound
    Nov 7, 2013 at 23:31
  • 1
    @Ramhound it's -rwxr-xr-x 1 root root 27184 Nov 8 07:49 /bin/true* for the given executable and drwxr-xr-x 2 root root 4096 Nov 7 15:11 bin/ for the directory. But I think it has to do with AppArmor.
    – TimeHorse
    Nov 8, 2013 at 14:47

2 Answers 2

8

It was AppArmor preventing me from accessing bin. I changed:

/etc/apparmor.d/local/usr.sbin.clamd

by adding:

/bin/** r,

To it and was able to scan the files in /bin. If I want to add other directories I need to just add lines to that file to include them. The AppArmor line above means /bin and all child folders, recursively, with read-only access, which is all the ClamAV needs. The file in question is AppArmor's directive for what special permissions /usr/sbin/clamd will receive which is the ClamAV service daemon. So this was all I needed to do to get it working. Thanks @Ramhound for the hint!

5
  • is there any reason you have 2 astericks in your example? I was able to get it working with only 1, ie: /bin/* r Mar 5, 2018 at 22:46
  • 2
    It's been a heck of a long time but if I recall correctly, one * is this directory, two, **, means recurse subdirectories too.
    – TimeHorse
    Mar 6, 2018 at 13:50
  • Thanks thanks, if that’s the case I’ll have to update mine too... let you know what I find. Cheers! Mar 6, 2018 at 15:01
  • Confirmed that 2 asterisks indeed means to allow all the sub-directories too. Thanks again! Mar 6, 2018 at 23:14
  • Glad I could help!
    – TimeHorse
    Mar 7, 2018 at 4:36
3

I had issues while scanning an imported NFS file system like /data/nfs/dir1/file.jpg

clamdscan /data/nfs/dir1/file.jpg: Can't open file or directory ERROR

Adding "/data/nfs/* r" in the /etc/apparmor.d/local/usr.sbin.clamd didn't do the trick for me. Running the apparmor_status shows that clamd process is in enforced mode:

2 processes are in enforce mode.
   /usr/bin/freshclam (18572) 
   /usr/sbin/clamd (18677) 

So, I've installed the apparmor-utils package and than set the clamd process as complain:

aa-complain /usr/sbin/clamd

Than, I was able to scan the file

clamdscan /data/nfs/dir1/file.jpg
/data/nfs/dir1/file.jpg: OK
1
  • Same issue, on a vagrant box where the scanned subject was in a synced folder.
    – Jonathan
    Feb 8, 2023 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .