Comment 10 for bug 450250

The only possible benefit I can see in using clamdscan over clamscan is the speed. When using clamdscan, that's actually using the running clamav-daemon, which has preloaded database, so startup is a bit faster. But beside that, clamdscan/clamd is usually used for stuff like integrating in MTA scanning and such, not for the user to scan stuff manually.

Of course it CAN be used that way, too. One can set clamd up to run in the background and use clamdscan to send it file/directory paths to scan. That's where apparmor (if it's runinng) comes in, and restricts access.