0

Trying to keep SElinux Enforced on CentOS and allowing clamAV to scan files. But it seems that SElinux does not like the following behavior of clamd:

Clamd is listening on a predefined TCP port then use random TCP ports to exchange the files to check with the client

in short... Each file getting scanned open a new port.

Disabling SElinux everything works fine, so definitely is a SElinux policy related issue.

With SElinux enabled and enforced clamd encounter the following issue:

● clamd.service - clamd scanner () daemon
   Loaded: loaded (/usr/lib/systemd/system/clamd.service; static; vendor preset: disabled)
   Active: active (running) since Thu 2017-06-22 15:56:57 CEST; 27min ago
 Main PID: 3671 (clamd)
   CGroup: /system.slice/clamd.service
           └─3671 /usr/sbin/clamd -c /etc/clamd.d/scan.conf --foreground=yes
Jun 22 15:57:06 prd-app-srv clamd[3671]: HWP3 support enabled.
Jun 22 15:57:06 prd-app-srv clamd[3671]: Self checking every 600 seconds.
Jun 22 15:58:05 prd-app-srv clamd[3671]: ScanStream: Can't find any free port.
Jun 22 15:58:05 prd-app-srv clamd[3671]: ERROR: ScanStream: Can't find any free port.
Jun 22 16:08:05 prd-app-srv clamd[3671]: SelfCheck: Database status OK.
Jun 22 16:08:05 prd-app-srv clamd[3671]: SelfCheck: Database status OK.
Jun 22 16:08:24 prd-app-srv clamd[3671]: ERROR: ScanStream: Can't find any free port.
Jun 22 16:08:24 prd-app-srv clamd[3671]: ScanStream: Can't find any free port.
Jun 22 16:18:24 prd-app-srv clamd[3671]: SelfCheck: Database status OK.
Jun 22 16:18:24 prd-app-srv clamd[3671]: SelfCheck: Database status OK.

In /var/log/audit/audit.log I find following logs entries:

type=AVC msg=audit(1498156946.689:4165): avc:  denied  { name_bind } for  pid=4086 comm="clamd" src=30860 scontext=system_u:system_r:antivirus_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1498156946.689:4165): arch=c000003e syscall=49 success=no exit=-13 a0=b a1=7fdc8fc31a90 a2=10 a3=1f items=0 ppid=1 pid=4086 auid=4294967295 uid=995 gid=994 euid=995 suid=995 fsuid=995 egid=994 sgid=994 fsgid=994 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:antivirus_t:s0 key=(null)

this seems to be closely related: https://bugzilla.redhat.com/show_bug.cgi?id=1248785

Anyone knows a selinux policy which will block a service to opens all the ports it wants?

I would like to leave SElinux enabled and enforced, and solve the issue in the less invasive manner

0

Solved by defining the ports range that clamd use, into /etc/clamd.d/scan.conf

StreamingMinPort 30000
StreamingMaxPort 32000

and by reflecting the same ports range in selinux policy

semanage port -a -t clamd_port_t -p tcp 30000-32000

Anyone knows a cleaner, or less invasive way to manage the issue?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.