Clamd Permissions Fix for Debian AppArmor #74
Conversation
…ured correctly by default when the latest version is installed. Apparmor Version: 2.13.6 ClamAV Version: 0.103.10 Error: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!). https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1842695
krimsonkla
requested review from
dav3r,
felddy,
jasonodoom,
jsf9k and
mcdonnnj
as code owners
tasks/main.yml
Outdated
| - name: Configure AppArmor for Clamd | ||
| when: "ansible_apparmor.status == 'enabled' and apparmor_complain" |
There was a problem hiding this comment.
Should these changes only apply to Debian, or more specifically Debian 11? We should probably also check that the apparmor.service SystemD service is running before attempting to apply these changes, since that service is not enabled by default on Debian.
defaults/main.yml
Outdated
| apparmor_clamd_configuration_path: /etc/apparmor.d/usr.sbin.clamd | ||
| apparmor_freshclam_configuration_path: /etc/apparmor.d/usr.bin.freshclam | ||
| apparmor_complain: true |
There was a problem hiding this comment.
apparmor_complain, at least, needs to be specified as a role variable in README.md.
|
@krimsonkla - In order to test these changes you'll probably need to create a separate Molecule scenario where |
Co-authored-by: Shane Frasier <maverick@maverickdolphin.com>
Co-authored-by: Shane Frasier <maverick@maverickdolphin.com>
Co-authored-by: Shane Frasier <maverick@maverickdolphin.com>
Co-authored-by: Shane Frasier <maverick@maverickdolphin.com>
Co-authored-by: Shane Frasier <maverick@maverickdolphin.com>
|
@jsf9k I'll try to find some time to work out the molecule testing. Having never used molecule, I started down that path last evening but struggled to get molecule to work in my nix-shell. |
|
@krimsonkla - If you're not accepting someone's changes, please let the reporter resolve the comments. They are the person in the best position to determine whether their concerns have been addressed. |
🗣 Description
Resolve AppArmor configuration issue which prevents clamd and freshclam from running.
💭 Motivation and context
On Debian GNU/Linux 11 (bullseye), Clamd and Freshclam are not configured correctly by default with latest versions.
Apparmor Version: 2.13.6
ClamAV Version: 0.103.10
Error: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
Defect Notes: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1842695
🧪 Testing
Change was incorporated into internal Playbook
✅ Pre-approval checklist
to reflect the changes in this PR.