SElinux Enforced on CentOS7 is blocking again clamAV on scanning file operations.

Some months ago, I encountered the same issue which I posted here, which at the end I solved doing the following configurations:

# grep 'StreamMin\|StreamMax' /etc/clamd.d/scan.conf
StreamMaxLength 2000M
StreamMinPort 30000
StreamMaxPort 32000

# getsebool -a | grep antivirus
antivirus_can_scan_system --> on
antivirus_use_jit --> on

# semanage port -l | grep clamd
clamd_port_t                   tcp      30000-32000, 3310

Yesterday the system got its yum updates, and between them, I see that selinux-policy* packages was updated too:

Updated     selinux-policy-3.13.1-102.el7_3.16.noarch                @updates
Update                     3.13.1-166.el7_4.4.noarch                 @updates
Updated     selinux-policy-targeted-3.13.1-102.el7_3.16.noarch       @updates
Update                              3.13.1-166.el7_4.4.noarch        @updates

After the update the same issue is back as shown in /var/log/messages:

Sep 15 10:55:45 production clamd: LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Permission denied
Sep 15 10:55:45 production clamd: LibClamAV Warning: Bytecode: disabling JIT because SELinux is preventing 'execmem' access.
Sep 15 10:55:45 production clamd: Run  'setsebool -P clamd_use_jit on'.

The log seems pretty clear and offers a solution too, but anyway, this boolean was already set to true previously, so its not that helpful as it seems.

The following is the related audit.log entry:

type=AVC msg=audit(1505723879.248:302432): avc:  denied  { name_connect } for  pid=21691 comm="java" dest=3310 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:clamd_port_t:s0 tclass=tcp_socket

Again, the following bugs seems to be related to my issue:

But reading them I don't really understand how I could fix it.

I would like to stick with packages updates provided by official CentOS repositories, so I would avoid to roll back the just applied updates (pasted above). Additionally, I would like to keep SElinux in enforced mode.

Any eyedea how to proceed to debug and fix the issue?

  • Are you sure the port min and max are still the same? Are you sure the ports are still allowed by selinux? I expect the update wouldn't touch an /etc/ file, but the selinux ports might have been. It's unclear if those commands were run before or after you started having problems. – Centimane Sep 15 '17 at 18:13
  • Are you sure you provided the correct AVC message here? I'm not familiar with the policy specifics, but scontext=system_u:system_r:tomcat_t:s0 doesn't sound correct for ClamAV. – sebasth Sep 17 '17 at 20:50
  • Thank you guys for the comments, @Centimane: The commands to get configurations was performed after the problems came back -> after selinux update. – lese Sep 18 '17 at 8:52
  • @sebasth: Thank you for the feedback, I may have copied the wrong entry, I performed again a test, and I updated the related content of the post, You made me notice that effectively the audit.log entry is different than the previous issue I had, It look more as tomcat -> clamd communication issue. the port 3310 is used by clamd main service, and please note the tcontext=system_u:object_r:clamd_port_t:s0 tclass=tcp_socket – lese Sep 18 '17 at 8:53
  • @lese a process in tomcat_t context tries to connect to port with clamd_port_t context. You should verify that all processes run in correct contexts (using ps Z etc). Have you checked what audit2allow tells (specifically if there is a boolean you can enable)? – sebasth Sep 18 '17 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.