ClamAV-clamd av-scanner FAILED: CODE(0x36ab6c8) unexpected , output="/var/lib/amavis/tmp/amavis-20160923T095247-01779-3L04SPou/parts: lstat() failed: Permission denied.

[Trev Peterson]

After installing amavisd-new and clamav-daemon clamav fails with the error:
ClamAV-clamd av-scanner FAILED: CODE(0x36ab6c8) unexpected , output="/var/lib/amavis/tmp/amavis-20160923T095247-01779-3L04SPou/parts: lstat() failed: Permission denied. ERROR\n" at (eval 100) line 905.

clamav user is in the amavis group and the permission on that dir are:

drwxr-x--- 3 amavis amavis 4096 Sep 23 09:52 amavis-20160923T095247-01779-3L04SPou

For a workaround I used the suggestion here:
http://askubuntu.com/questions/604446/how-to-fix-amvavis-reporting-permission-denied-for-clamav

Edited /etc/clamav/clamd.conf and changed
AllowSupplementaryGroups false
to true

I believe this is one of the typical use case scenario for clamav-daemon so this option should be included by default. To me this also seems to be the expected behavior by default (if the user the daemon is run as is in groups allowing access I'd assume it has that access). I don't understand why this is an option and not default behavior.

I'm unsure of whether Debian plans to deprecate/remove the AllowSupplementaryGroups configuration option moving forward. If done, it will break clamav-daemon - avamisd-new integration as is done currently. I point this out to prevent future issues.

Thanks for the great work, I hope this helps.

[Trev Peterson (trev-advanced-reality)]

I see this behavior in package: clamav-daemon 0.99+dfsg-1ubuntu1.2 on ubuntu 16.04

[Christian Ehrhardt  (paelzer)]

You already outlined the Debian dependency to not deprecate the tunable in this case.
I think also changing the default of the config should not be a Ubuntu Delta.

Since the bug (suboptimal default) is present in Debian too it would be best fixed in Debian, and then Ubuntu will pick it up on the next merge.

Would you mind filing a bug with Debian please?

[Urs Mueller (info-urs-mueller)]

There is already a bug filed with debian.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822444

Seems that the problems is due to switching to systemd and false settings within the start of clamav.

From the bug report above:

/lib/systemd/system/clamav-daemon.service

Change ExecStart to:
ExecStart=/usr/sbin/clamd -c /etc/clamav/clamd.conf --foreground=true

Add:
User=clamav
Group=clamav

Bug on debian is closed an a fixed clamav-package should be available! But also to ubuntu?

[Christian Ehrhardt  (paelzer)]

Thanks for the info Urs!

That comes down to:
   * Drop AllowSupplementaryGroups option which is default now
     (Closes: #822444).

This is already released and available in Yakkety, but not yet in Xenial.
Since there is a confiuration workaround to it I'm not so sure on the priority of the Xenial SRU.

[Christian Ehrhardt  (paelzer)]

Hmm, I can't see why I can't add a Xenial bug task here ... FYI so you don#t think I consider all fix-released but only >=16.10

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.