1

Topic: Kernel Audit

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.6.2 MARIADB edition
- Deployed with iRedMail Easy or the downloadable installer?
- Linux/BSD distribution name and version: Debian GNU/Linux 11 (bullseye)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Please tell me what happened in the system?
Denials. What is it?

 --------------------- Kernel Audit Begin ------------------------ 
 *** Denials ***
    open /usr/local/lib/libclamunrar_iface.so.12.0.2 (/usr/bin/freshclam via freshclam): 6 times
    open /usr/local/lib/libclamunrar_iface.so.12.0.2 (/usr/sbin/clamd via clamd): 3 times
 
 ---------------------- Kernel Audit End ------------------------- 

This happened after the clamav update.

 --------------------- dpkg status changes Begin ------------------------ 

 
 Upgraded:
    clamav-base:all 0.103.8+dfsg-0+deb11u1 => 0.103.10+dfsg-0+deb11u1
    clamav-daemon:amd64 0.103.8+dfsg-0+deb11u1 => 0.103.10+dfsg-0+deb11u1
    clamav-freshclam:amd64 0.103.8+dfsg-0+deb11u1 => 0.103.10+dfsg-0+deb11u1
    clamav:amd64 0.103.10+dfsg-0+deb11u1 => 1.3.0-1
    clamdscan:amd64 0.103.8+dfsg-0+deb11u1 => 0.103.10+dfsg-0+deb11u1
 
 ---------------------- dpkg status changes End ------------------------- 

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 (edited by alekperov11 2024-02-27 22:23:25)

Re: Kernel Audit

Is this can fix my problem?

edit /etc/apparmor.d/local/usr.bin.freshclam
and
edit /etc/apparmor.d/local/usr.sbin.clamd

/usr/local/lib/* r,

Then

apparmor_parser --replace /etc/apparmor.d/usr.bin.freshclam
apparmor_parser --replace /etc/apparmor.d/usr.sbin.clamd

From here

3

Re: Kernel Audit

This fix should work.

4

Re: Kernel Audit

ZhangHuangbin wrote:

This fix should work.

Ok Thanks