Hourly Clamscan cron script failes at reading file list

Question

I've this piece of code located in /etc/cron.hourly/hourlyclamscan.

#!/usr/bin/bash
# Create Hourly Cron Job With Clamscan

# Directories to scan
SCAN_DIR=/home/transmission/Downloads

# Temporary file
LIST_FILE=`mktemp /tmp/clamscan.XXXXXX`

# Location of log file
LOG_FILE=/var/log/clamav/hourly_clamscan.log

# Make list of new files
/usr/bin/find "$SCAN_DIR" -type f -mmin -60 -fprint ${LIST_FILE}
# Scan files and remove infected
/usr/bin/clamscan -i -f ${LIST_FILE} --remove > $LOG_FILE

# If there were infected files detected, send email alert
if [ `cat ${LOG_FILE}  | grep Infected | grep -v 0 | wc -l` != 0 ]
then
echo "$(egrep "FOUND" $LOG_FILE)" | /bin/mail -s "VIRUS PROBLEM" -r clam@nas.local #####@#####.##
fi
exit

When I run it from the terminal, it give no error.

However, when cron runs the script, it sends an error to the root mailbox: ERROR: --file-list: Can't open file /tmp/clamscan.MLXep5

The file is created by find and owned by root (permission 600). The cron job is also run as root, so I assume permissions should not be an issue (or is it?).

Add output of `ls -l /tmp/clamscan.MLXep5`, `ls -ld /tmp` and `df /tmp`. — Cyrus, Oct 14 '14 at 10:00

score 1 · Answer 1 · answered Oct 14 '14 at 17:32

It turned out the be SElinux problem.

audit2allow -a

returns:

#============= antivirus_t ==============

#!!!! This avc can be allowed using the boolean 'antivirus_can_scan_system'
allow antivirus_t home_root_t:dir read;

And solved by entering:

setsebool -P antivirus_can_scan_system 1

score 0 · Answer 2 · answered Oct 14 '14 at 07:36

Apart from your script being pretty much broken, I suggest you write something as the following.

Don't use capitalized variable names. Only environment variables are capitalized by convention.

Don't use absolute paths for binaries like find, mail etc.

#!/usr/bin/bash
# Create Hourly Cron Job With Clamscan

# Directories to scan
scan_dir="/home/transmission/Downloads"

# Temporary file
list_file=$(mktemp /tmp/clamscan.XXXXXX)

# Location of log file
log_file="/var/log/clamav/hourly_clamscan.log"

# Make list of new files
find "$scan_dir" -type f -mmin -60 -fprint "$list_file"
# Scan files and remove infected
clamscan -i -f "$list_file" --remove > "$log_file"

# If there were infected files detected, send email alert
grep -q "Infected" "$log_file" && mail -s "VIRUS PROBLEM" -r clam@nas.local
exit

I used your more legible code. – Royco Oct 14 '14 at 19:21 — Royco, Oct 14 '14 at 19:21

Hourly Clamscan cron script failes at reading file list

2 Answers2