0

I'm migrating everything I have from Ubuntu 20.04 to 23.04. The one and only thing, in a long list, I'm struggling with is a web form that uses ClamAV to scan uploaded files. On the old server it works fine. On the new server I persistenly get: fd[10]: Not a regular file. ERROR (that's from /var/log/clamav/clamav.log) and it returns code 2 to the exec command and the following output from $out

(
    [0] => /tmp/php0HjwDM: Not a regular file ERROR
    [1] => 
    [2] => ----------- SCAN SUMMARY -----------
    [3] => Infected files: 0
    [4] => Total errors: 1
    [5] => Time: 0.000 sec (0 m 0 s)
    [6] => Start Date: 2023:06:28 17:08:03
    [7] => End Date:   2023:06:28 17:08:03
)

And after moving the file I then scan it again (for testing)

Array
(
    [0] => /import/myfile.csv: Not a regular file ERROR
    [1] => 
    [2] => ----------- SCAN SUMMARY -----------
    [3] => Infected files: 0
    [4] => Total errors: 1
    [5] => Time: 0.000 sec (0 m 0 s)
    [6] => Start Date: 2023:06:28 17:08:03
    [7] => End Date:   2023:06:28 17:08:03
)

Here's the test code:

if ($_POST) {
$uploadfile = '/import/' . basename($_FILES['userfile']['name']);
$scanpath=escapeshellarg($_FILES['userfile']['tmp_name']);
$cmd='clamdscan --fdpass '.$scanpath;
$retcode=-1;
$out='';
exec($cmd,$out,$retcode);
echo $retcode.'<br /><pre>';
print_r ($out);
echo '</pre>';
echo '<br />Now moving <br />';
move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile);
$cmd='clamdscan --fdpass '.$uploadfile;
$retcode=-1;
$out='';
exec($cmd,$out,$retcode);
echo $retcode.'<br /><pre>';
print_r ($out);
echo '</pre>';
}
?>

<form enctype="multipart/form-data" action="testpost.php" method="POST">
    Send this file: <input name="userfile" type="file" />
    <input type="submit" value="Send File" />
</form>

Tried with various file types, tried configure clamav to run as www-data (after sorting socket folder permissions). Tried with different files. The "move" and second scan, in the above, was to prove there weren't issues with the temporary /tmp/ version of the uploaded file. /import/ has 777 permissions just for testing Running clamdscan --fdpass myfile.csv from a shell from within the /import folder works just fine, as well as doing it with sudo -u www-data or sudo -u clamav. It just won't run as expected from PHP's exec. It certainly tries. Searched in vain for solutions. While other people seem to have had similar issues, they're not the same as far as I can tell. Any advice would be greatly appreciated.
Edit 29/06/2023
Using clamscan instead of clamdscan works, except it's very (unworkably) slow:

Array
(
    [0] => /tmp/phpFahZwQ: OK
    [1] => 
    [2] => ----------- SCAN SUMMARY -----------
    [3] => Known viruses: 8669716
    [4] => Engine version: 0.103.8
    [5] => Scanned directories: 0
    [6] => Scanned files: 1
    [7] => Infected files: 0
    [8] => Data scanned: 0.00 MB
    [9] => Data read: 0.00 MB (ratio 0.00:1)
    [10] => Time: 13.043 sec (0 m 13 s)
    [11] => Start Date: 2023:06:29 11:39:06
    [12] => End Date:   2023:06:29 11:39:19
)
R Taylor
  • 29
  • 3
  • Reg. 777: when you use --fdpass search(execute) permissions on the file are not required. Reg. tmp or not: if php's is_file() returns true on the temporary file pathname already, you don't need to move it first (this is normally the case IIRC). – hakre Jul 01 '23 at 14:34

2 Answers2

1

I persistenly get: fd[10]: Not a regular file. ERROR

The clamdscan --fdpass argument passes the file descriptor permissions to clamd. As I understand it, the reason why you use it is as the clamav user is different. Which is the use-case for that flag.

Still, when clamd tries to scan based on the passed file descriptor, it either fails to fstat the file descriptor (fd) or it is not a regular file. (ref.)

Also there is no information provided about the last error if FSTAT would have failed in the first place. (ref.).

The error message does not allow to differentiate between both cases, so one would need to speculate which case it is, which we don't do.

As you only have the problem from within PHP environment - about which you don't have shared any details - it is an issue with that, preventing clamdscan to pass the file descriptor to clamd. E.g. a different namespace for file descriptors.

Ensure both PHP, clamdscan and clamd have the same view on the system and are not using any isolation feature of the kernel unless they share the same.

Additionally double-check clamd/clamdscan have been compiled for the right architecture and are using correct libraries.

hakre
  • 193,403
  • 52
  • 435
  • 836
  • Thanks, that is useful information. All the components have been installed from Ubuntu 23.04 using apt-get so would hope they play together. The older version appeared to. I have got there in the end and will post what I did below – R Taylor Jun 29 '23 at 13:46
  • @RTaylor: Thanks for the update and reading your comment and the answer, if its all vanilla this was perhaps a hickup in your initial configuration. I've not thought about _dpkg-reconfigure_ honestly, while this is normally to consider when messing around. Then in the end this perhaps was an issue with file-rights not properly reset. Perhaps for the socket (while the socket was accessible from the clamd-scan client, it would otherwise tell you that with a clear error message). But this is a guess only, you've written you tried multiple things with that socket, but no clear picture on it. – hakre Jul 01 '23 at 14:33
1

I appear to have got it working. I tried all sorts of things, even changing clamd to use other users (very problematic as couldn't access it's socket file, no matter the permissions/ownership). In the end I ran

dpkg-reconfigure clamav-daemon
service clamav-daemon restart

I responded "No" to a prompt for automatic reconfiguration. This was in the hopes I'd get prompts, but I didn't get any. Directly after this, it appeared to work though, which I'm happy about:

Response Code: 0

Array
(
    [0] => /tmp/phpnE5tY2: OK
    [1] => 
    [2] => ----------- SCAN SUMMARY -----------
    [3] => Infected files: 0
    [4] => Time: 0.005 sec (0 m 0 s)
    [5] => Start Date: 2023:06:29 14:50:05
    [6] => End Date:   2023:06:29 14:50:05
)
R Taylor
  • 29
  • 3