Clamdscan error when launched by apache user "No file descriptor received. ERROR"

Question

We're trying to use clamav on a centos 7 server in order to scan directly files on our web apps (Moodle for example). When trying to execute a clamdscan from apache, we got this error (the file belong to apache:apache and has correct rights 755)

<?php
exec('/usr/bin/clamdscan --stdout --fdpass /var/www/html/test/filetoscan', $output, $return);
print "<pre>";
print_r($output);
print_r($return);
?>

And the return is :

Array
(
[0] => Failed to parse reply: "No file descriptor received. ERROR"
[1] => 
[2] => ----------- SCAN SUMMARY -----------
[3] => Infected files: 0
[4] => Total errors: 1
[5] => Time: 0.000 sec (0 m 0 s)
)
2

Of course, if we try to do it directly through command lines, we have same error..

su -l apache -s /bin/bash
/usr/bin/clamdscan --stdout --fdpass /var/www/html/test/filetoscan

How can I allow apache to execute clamdscan (or resolve the file descriptor problem) ? of course if the command is launched by an other user everything works fine.

Thanks for your help :-)

Regards. Diego

score 2 · Answer 1 · answered Oct 13 '17 at 04:53

2

edit /etc/clamd.conf to configure Unix user clamav should run under: User apache

Fix file/directory permissions: chown -R apache:apache /var/run/clamd.scan; chown apache:apache /var/run/clamd.scan/clamd.sock

Otherwise clamav will by default run as user clamscan, which doesn't have permissions to access this file, even though you added --fdpass as an argument to the scan.

answered Oct 13 '17 at 04:53

Matthias

21
2

Thank you so much. This socket permission problem has been driving me crazy for hours. I am calling clamdscan from Tomcat and simply setting the socket parent directory to tomcat:tomcat suddenly made everything work! – Chris Carruthers Aug 13 '21 at 04:56

score 0 · Accepted Answer · answered Jul 24 '15 at 06:08

Neither applying setsebool -P antivirus_can_scan_system 1 (from this setup procedure) or disabling completely SELinux in /etc/selinux/config have improved the situation.

As a result, a strace has been generated to understand what happens, running as apache:

$ strace /usr/bin/clamdscan --stdout --fdpass /var/www/html/cours/moodledata/temp/filetoscan
[...]
rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER, 0x7ff93f13c650}, NULL, 8) = 0
lstat("/var/www/html/cours/moodledata/temp/filetoscan", {st_mode=S_IFREG|0755, st_size=7256, ...}) = 0
socket(PF_LOCAL, SOCK_STREAM, 0)        = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/clamd.scan/clamd.sock"}, 110) = -1 EACCES (Permission denied)
close(3)                                = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(3310), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
open("/var/www/html/cours/moodledata/temp/filetoscan", O_RDONLY) = 4
sendto(3, "zFILDES\0", 8, 0, NULL, 0)   = 8
sendmsg(3, {msg_name(0)=NULL, msg_iov(1)=[{"\0", 1}], msg_controllen=20, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {4}}, msg_flags=0}, 0) = 1
close(4)                                = 0
recvfrom(3, "No file descriptor received. ERR"..., 5120, 0, NULL, NULL) = 35
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff93fd3b000
write(1, "Failed to parse reply: \"No file "..., 60Failed to parse reply: "No file descriptor received. ERROR"

First accessing the unix socket file /var/run/clamd.scan/clamd.sock failed, then the fallback to TCP communication 127.0.0.1/3301 failed for another reason.

Probably adding apache in the required group to access the unix socket will fix your issue.

Clamdscan error when launched by apache user "No file descriptor received. ERROR"

2 Answers2