On my nginx server, the uploaded files context are set as:

-rw-rw-r--. nginx nginx system_u:object_r:httpd_sys_rw_content_t:s0 eicar.sh.pdf

Right after upload, clamscan runs to verify the file using php exec() as an nginx user.

/usr/bin/clamscan --quiet --remove /opt/myserver/files/eicar.sh.pdf

And this throws a SeLinux write access denial, when clamscan tries to delete that file (its a EICAR test file).

The audit logs suggests to create a policy which i am not in favor of:

# ausearch -c 'clamscan' --raw | audit2allow -M my-clamscan
# semodule -i my-clamscan.pp

These are already set:

sudo setsebool -P antivirus_can_scan_system 1
sudo setsebool -P antivirus_use_jit 1

Q: Is there is a way to fix this via file context, but don't want to loose the current context httpd_sys_rw_content_t for the files.


Setting antivirus_t as permissive worked. This makes SeLinux to not to enforce its policies for all antivirus.

sudo semanage permissive -a antivirus_t
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.