clamav-milter socket permissions wrong

[Stephen Warren]

Binary package hint: clamav

According to /etc/default/clamav-milter on Jaunty:

## SOCKET_RWGROUP
# by default, the socket created by the milter has permissions
# clamav:clamav:755. SOCKET_RWGROUP changes the group and changes the
# permissions to 775 to give read-write access to that group.

This doesn't make sense:

* A socket shouldn't ever have execute permissions.
* If the idea is that only a particular user/group should have access to the socket, no group/world permissions should be set at all.

So, I think the modes should be 600 or 660 respectively.

[Scott Kitterman (kitterman)]

This is the upstream default. I'd suggest file a bug with upstream and see how open they are to changing it:

https://wwws.clamav.net/bugzilla/

[Stephen Warren (srwarren)]

Is /etc/init.d/clamav-milter provided by upstream or Debian/Ubuntu? That contains an explicit SOCKET_RWGROUP setting for modifying the socket permissions. It seems that would be an appropriate place for a fix...

[Scott Kitterman (kitterman)]

It's provided by Debian, but uses the same permissions as upstream. When I
discussed it with the Debian maintainer, he suggest discussing it with
upstream.

[Stephen Warren (srwarren)]

Finally got around to filing an upstream bug: https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1726

I'm not sure how to get launchpad to monitor remote bugs, unless they're
for a distro rather than a project...

[Scott Kitterman (kitterman)]

No, you wanted the project option. Linked now.

[Stephen Warren (srwarren)]

FYI, the clamav folks said this is just what the sendmail-supplied libmilter(?) library does. Hence, they pointed me at sendmail support. sendmail doesn't seem to have publicly accountable support, just a black-hole email address. I did report the issue to them, but they didn't respond.

[Imre Gergely (cemc)]

I've checked in 0.97.2 in Oneiric, and the socket mode is now 0666, as specified in /etc/clamav/clamav-milter.conf. So the execute permission is gone. The world read/write mode is still present.

root@utest-oos32:~# cat /etc/clamav/clamav-milter.conf |grep Mode
MilterSocketMode 666

root@utest-oos32:~# cat /etc/clamav/clamav-milter.conf |grep MilterSocket
MilterSocket /var/run/clamav/clamav-milter.ctl

root@utest-oos32:~# stat /var/run/clamav/clamav-milter.ctl
  File: `/var/run/clamav/clamav-milter.ctl'
  Size: 0 Blocks: 0 IO Block: 4096 socket
Device: fh/15d Inode: 8078 Links: 1
Access: (0666/srw-rw-rw-) Uid: ( 104/ clamav) Gid: ( 112/ clamav)

The same is true in clamav 0.96.5 which is in Hardy, Lucid and Maverick.