clamdscan permission issues

Bug #1168422 reported by Ruslan Kabalin
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mahara
Fix Released
Low
Ruslan Kabalin

Bug Description

Sometimes clamdscan is used as virus check application, which is faster than clamscan as the file is being passed over for scanning to clam daemon. However it requires specific permission settings, namely clamd user that runs daemon should be able to access the file. Changing the file mode to make it readable to others, which is currently in use, is not sufficient in some cases, e.g. when data directory is accessible solely to www-data user. Clamd user will only be able to access the file, if each directory it traverses has exec permission for the matching group (likely 'others' in this case) and able to read the destination file.

To make clamdscan work, I suggest to use --fdpass parameter that passes the file descriptor permissions to clamd, which allows to scan given file irrespective of directory and file permissions (assuming the www-data user who initiates the scan has access to it, which is always the case).

Changed in mahara:
status: New → In Progress
assignee: nobody → Ruslan Kabalin (rkabalin)
Revision history for this message
Ruslan Kabalin (rkabalin) wrote :
Revision history for this message
Ruslan Kabalin (rkabalin) wrote :

Has been merged. Wondering why gerrit has not published here anything.

Changed in mahara:
status: In Progress → Fix Committed
importance: Undecided → Low
Revision history for this message
Kristina Hoeppner (kris-hoeppner) wrote :

Ruslan, there was an issue with keys when emailing changes from Gerrit to Launchpad. If I remember correctly, Aaron solved that a few weeks ago or so. But maybe Launchpad made some more changes.

Changed in mahara:
milestone: none → 1.8.0rc1
Revision history for this message
Aaron Wells (u-aaronw) wrote :

Hi guys,

Would the original chmod(0644) still be needed if you're using "clamscan" rather than "clamdscan"?

Cheers,
Aaron

Changed in mahara:
status: Fix Committed → In Progress
Revision history for this message
Ruslan Kabalin (rkabalin) wrote :

Hi Aaron, no chmod is no longer needed. It was there for clamdscan in fact.

Changed in mahara:
status: In Progress → Fix Committed
Aaron Wells (u-aaronw)
Changed in mahara:
milestone: 1.8rc1 → 1.8.0
Aaron Wells (u-aaronw)
Changed in mahara:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.