log file apparmor read permission

Bug #1778812 reported by Seth Arnold
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
clamav (Debian)
Fix Released
Unknown
clamav (Ubuntu)
Fix Released
Medium
Andreas Hasenack

Bug Description

Hello, Chris reported to the AppArmor mail list an insufficient permission:

https://lists.ubuntu.com/archives/apparmor/2018-June/011711.html

apparmor="DENIED" operation="rename_src" profile="/usr/bin/freshclam" name="/var/log/clamav/freshclam.log" pid=2604 comm="freshclam" requested_mask="r" denied_mask="r" fsuid=121 ouid=121

The line:

  /var/log/clamav/* kw,

should probably read:

  /var/log/clamav/* krw,

There may need to be other changes.

Thanks

Related branches

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in clamav (Ubuntu):
status: New → Confirmed
Robie Basak (racb)
Changed in clamav (Ubuntu):
status: Confirmed → Triaged
tags: added: server-next
Changed in clamav (Ubuntu):
importance: Undecided → Medium
Changed in clamav (Debian):
status: Unknown → New
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Confirmed in cosmic:
[ 428.285820] audit: type=1400 audit(1531164002.800:26): apparmor="DENIED" operation="rename_src" profile="/usr/bin/freshclam" name="/var/log/clamav/freshclam.log" pid=2476 comm="freshclam" requested_mask="r" denied_mask="r" fsuid=111 ouid=111

0.99.4+addedllvm-0ubuntu2

Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Adding "r" as mentioned is enough to fix freshclam's own logrotation:
-rw-r----- 1 clamav clamav 1.5K Jul 9 19:21 freshclam.log
-rw-r----- 1 clamav adm 3.6K Jul 9 19:20 freshclam.log-20180709_192102
-rw-r----- 1 clamav adm 3.2K Jul 9 19:15 freshclam.log.1

The .1 one was via logrotate -f, whereas the -20180709 one was after I adjusted freshclam.conf to rotate aggressively on 3kbytes.

tags: added: bitesize
Changed in clamav (Ubuntu):
status: Triaged → In Progress
assignee: nobody → Andreas Hasenack (ahasenack)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package clamav - 0.99.4+addedllvm-0ubuntu3

---------------
clamav (0.99.4+addedllvm-0ubuntu3) cosmic; urgency=medium

  * d/usr.bin.freshclam: add read permission to the rule governing
    access to /var/log/clamav by freshclam so that it can rotate its
    own logfile. (LP: #1778812) (Closes: #902601)

 -- Andreas Hasenack <email address hidden> Mon, 09 Jul 2018 16:25:25 -0300

Changed in clamav (Ubuntu):
status: In Progress → Fix Released
Changed in clamav (Debian):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.