{"id":1375,"date":"2024-11-05T18:36:21","date_gmt":"2024-11-05T09:36:21","guid":{"rendered":"https:\/\/darkgray.homelinux.com\/blog\/?p=1375"},"modified":"2024-11-05T18:45:47","modified_gmt":"2024-11-05T09:45:47","slug":"freshclam%e3%81%8c%e5%8b%95%e3%81%8b%e3%81%aa%e3%81%84%e3%80%82%ef%bc%88selinux%e9%96%a2%e9%80%a3%ef%bc%89","status":"publish","type":"post","link":"https:\/\/darkgray.homelinux.com\/blog\/?p=1375","title":{"rendered":"freshclam\u304c\u52d5\u304b\u306a\u3044\u3002\uff08SELinux\u95a2\u9023\uff09"},"content":{"rendered":"\n

\u4e8b\u306e\u8d77\u3053\u308a\u306f\u3000\u30b5\u30fc\u30d0\u30fcOS\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u5f8c\u3000Logwatch\u306eclam-update Begin\u306e\u9805\u306b\u300c\u52d5\u3044\u3066\u306a\u3044\u3088\u300d\u3063\u3066\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8a18\u9332\u3055\u308c\u3066\u305f\u4e8b\u3002\u5185\u5bb9\u306f\u3053\u3093\u306a\u611f\u3058\u3002<\/p>\n\n\n\n

<\/path><\/path><\/svg><\/span>
No<\/span> <\/span>updates<\/span> <\/span>detected<\/span> <\/span>in<\/span> <\/span>the<\/span> <\/span>log<\/span> <\/span>for<\/span> <\/span>the<\/span> <\/span>freshclam<\/span> <\/span>daemon<\/span> (the<\/span><\/span>\n <\/span>ClamAV<\/span> <\/span>update<\/span> <\/span>process<\/span>).  If the freshclam daemon is not running,<\/span><\/span>\n <\/span>you<\/span> <\/span>may<\/span> <\/span>need<\/span> <\/span>to<\/span> <\/span>restart<\/span> <\/span>it.<\/span>  <\/span>Other<\/span> <\/span>options:<\/span><\/span>\n\u4ee5\u4e0b\u7701\u7565<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u30b5\u30fc\u30d0\u30fc\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\/var\/log\/freshclam.log\u3092\u8abf\u3079\u3066\u307f\u305f\u3002\u4ee5\u4e0b\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u3072\u305f\u3059\u3089\u7d9a\u304f\u3002freshclam\u306froot\u3067\u52d5\u304b\u3057\u3066\u308b\u3002\u8a2d\u5b9a\u3057\u305f\u306e\u306f\u305a\u3044\u3076\u3093\u524d\u306a\u306e\u3067\u3088\u304f\u899a\u3048\u3066\u3044\u306a\u3044\u3002\u3000\u305f\u3076\u3093ClamAV\u3092root\u3067\u30c1\u30a7\u30c3\u30af\u3057\u3066\u308b\u306e\u3067freshclam\u3082root\u3067\u52d5\u304b\u3057\u3066\u3044\u308b\u3093\u3060\u3068\u601d\u3046\u3002\u3000<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
WARNING: lchown to user 'root' failed on log file '\/var\/log\/freshclam.log'.  Error was 'Permission denied'<\/span><\/span>\nERROR: Failed to switch to root user.<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
freshclam\u306e\u30b9\u30c6\u30fc\u30bf\u30b9\u3092\u8abf\u3079\u3066\u307f\u305f\u3089\u3000\u52d5\u3044\u3066\u306a\u3044\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo systemctl status clamav-freshclam.service<\/span><\/span>\n\u00d7<\/span> <\/span>clamav-freshclam.service<\/span> <\/span>-<\/span> <\/span>ClamAV<\/span> <\/span>virus<\/span> <\/span>database<\/span> <\/span>updater<\/span><\/span>\n     <\/span>Loaded:<\/span> <\/span>loaded<\/span> (\/usr\/lib\/systemd\/system\/clamav-freshclam.service; <\/span>enabled<\/span>; <\/span>preset:<\/span> <\/span>disabled<\/span>)<\/span><\/span>\n     <\/span>Active:<\/span> <\/span>failed<\/span> (Result: <\/span>exit-code<\/span>) since Tue 2024-11-05 15:14:59 JST; <\/span>9min<\/span> <\/span>ago<\/span><\/span>\n\u4ee5\u4e0b\u7701\u7565\u30fb\u30fb<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u8272\u3005\u30b0\u30b0\u3063\u3066\u8abf\u3079\u3066\u307f\u305f\u3051\u3069\u3000\u3053\u308c\u3068\u8a00\u3046\u60c5\u5831\u306f\u51fa\u3066\u3053\u306a\u3044\u3002<\/p>\n\n\n\n
\u4e00\u6642\u7684\u306bSELinux\u3092\u505c\u6b62\u3057\u3066\u8a66\u3057\u3066\u307f\u308b\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ setenforce 0<\/span><\/span>\n[]$ sudo systemctl restart clamav-freshclam.service<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u7d50\u679c\u306f\u7701\u7565\u3059\u308b\u3051\u3069\u3000clamav-freshclam.service\u306f\u52d5\u3044\u305f\u3002
\u3064\u307e\u308a\u539f\u56e0\u306fSELinux\u7d61\u307f\u304b\u30fb\u30fb\u3000\u5df7\u306e\u30b5\u30a4\u30c8\u3067\u306f\u3000\u3053\u306e\u5f8c\u3000SELinux\u306f\u90aa\u9b54\u306a\u306e\u3067\u7121\u52b9\u5316\u3057\u3066\u3057\u307e\u3048\u3063\u3066\u306e\u304c\u591a\u3044\u3051\u3069\u3001\u79c1\u306e\u30b5\u30a4\u30c8\u306e\u4fe1\u6761\u306fSELinux\u306f\u7d76\u5bfe\u6709\u52b9\u3002
SELinux\u3092\u7a3c\u50cd\u72b6\u614b\u306b\u623b\u3059\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ setenforce 1<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u539f\u56e0\u3092\u63a2\u3057\u3066\u307f\u308b\u3002\u4e0b\u8a18\u306e\u30b3\u30de\u30f3\u30c9\u3067SELinux\u306e\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u3092\u8abf\u3079\u3066\u3000\u30a8\u30e9\u30fc\u306e\u5185\u5bb9\u3092\u5831\u544a\u3057\u3066\u304f\u308c\u308b\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo audit2allow -i \/var\/log\/audit\/audit.log<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u8272\u3005\u306a\u30a8\u30e9\u30fc\u304c\u51fa\u529b\u3055\u308c\u305f\u3051\u3069\u305d\u306e\u4e2d\u3067clamav-freshclam.service\u306b\u95a2\u4fc2\u3042\u308a\u305d\u3046\u306a\u306e\u306f\u3053\u308c\u304b\u306a\uff1f<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
#============= antivirus_t ==============<\/span><\/span>\n<\/span>\n#!!!! This avc can be allowed using the boolean 'domain_kernel_load_modules'<\/span><\/span>\nallow<\/span> <\/span>antivirus_t<\/span> <\/span>kernel_t:system<\/span> <\/span>module_request<\/span>;<\/span><\/span>\nallow<\/span> <\/span>antivirus_t<\/span> <\/span>var_log_t:file<\/span> <\/span>setattr<\/span>;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
“domain_kernel_load_modules”\u306e\u73fe\u5728\u306e\u8a2d\u5b9a\u3092\u8abf\u3079\u3066\u307f\u308b\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo getsebool -a <\/span>|<\/span> <\/span>grep<\/span> <\/span>domain<\/span><\/span>\ncron_userdomain_transition<\/span> <\/span>--<\/span>><\/span> <\/span>on<\/span><\/span>\ndomain_can_mmap_files<\/span> <\/span>--<\/span>><\/span> <\/span>off<\/span><\/span>\ndomain_can_write_kmsg<\/span> <\/span>--<\/span>><\/span> <\/span>off<\/span><\/span>\ndomain_fd_use<\/span> <\/span>--<\/span>><\/span> <\/span>on<\/span><\/span>\ndomain_kernel_load_modules<\/span> <\/span>--<\/span>><\/span> <\/span>off<\/span><\/span>\nsamba_domain_controller<\/span> <\/span>--<\/span>><\/span> <\/span>off<\/span><\/span>\nsge_domain_can_network_connect<\/span> <\/span>--<\/span>><\/span> <\/span>off<\/span><\/span>\nvirt_transition_userdomain<\/span> <\/span>--<\/span>><\/span> <\/span>off<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
off\u306b\u306a\u3063\u3066\u3044\u305f\u306e\u3067ON\u306b\u3059\u308b\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo setsebool -P domain_kernel_load_modules ON<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
freshclam\u3092\u8a66\u3057\u306b\u52d5\u304b\u3057\u3066\u307f\u308b<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo systemctl restart clamav-freshclam.service<\/span><\/span>\n[]$ sudo systemctl status clamav-freshclam.service<\/span><\/span>\n\u7d50\u679c\u7701\u7565<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u307e\u3060\u30a8\u30e9\u30fc\u306b\u306a\u308b\u3002
\u3082\u3046\u4e00\u5ea6\u30ed\u30b0\u304b\u3089freshclam\u306b\u95a2\u3059\u308b\u30a8\u30e9\u30fc\u306b\u3064\u3044\u3066\u51fa\u529b\u3059\u308b\u3002
\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u5909\u308f\u3063\u3066\u308b\u3002\u3000\u30dd\u30ea\u30b7\u30fc\u3092\u5909\u3048\u308b\u3057\u304b\u65b9\u6cd5\u304c\u7121\u3044\u3088\u3046\u3060\u3002
\u4eca\u56de\u306ffreshclam\u306b\u95a2\u3059\u308b\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u3060\u3051\u3092\u51fa\u529b\u3057\u3066\u307f\u305f\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo ausearch -m AVC -c freshclam <\/span>|<\/span> <\/span>sudo<\/span> <\/span>audit2allow<\/span> <\/span>-a<\/span><\/span>\n<\/span>\n<\/span>\n#============= antivirus_t ==============<\/span><\/span>\n<\/span>\n#!!!! This avc is allowed in the current policy<\/span><\/span>\nallow<\/span> <\/span>antivirus_t<\/span> <\/span>kernel_t:system<\/span> <\/span>module_request<\/span>;<\/span><\/span>\nallow<\/span> <\/span>antivirus_t<\/span> <\/span>var_log_t:file<\/span> <\/span>setattr<\/span>;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u304b\u3089\u65b0\u3057\u3044\u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb\u3092\u51fa\u529b\u3059\u308b\u3002
-M\u30aa\u30d7\u30b7\u30e7\u30f3\u306efreshclam\u306f\u51fa\u529b\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u540d\u3092\u6307\u5b9a\u3057\u3066\u308b\u3060\u3051\u306a\u306e\u3067\u4f55\u3067\u3082\u826f\u3044\u3002\u5206\u304b\u308a\u3084\u3059\u3044\u3088\u3046\u306b\u540c\u3058\u540d\u524d\u306b\u3057\u305f\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo ausearch -m AVC -c freshclam <\/span>|<\/span> <\/span>sudo<\/span> <\/span>audit2allow<\/span> <\/span>-a<\/span> <\/span>-M<\/span> <\/span>freshclam<\/span><\/span>\n********************<\/span> \u91cd\u8981 <\/span>***********************<\/span><\/span>\n\u3053\u306e\u30dd\u30ea\u30b7\u30fc\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u6709\u52b9\u306b\u3059\u308b\u306b\u306f\u3001\u4ee5\u4e0b\u3092\u5b9f\u884c\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/span><\/span>\n<\/span>\nsemodule<\/span> <\/span>-i<\/span> <\/span>freshclam.pp<\/span><\/span>\n<\/span><\/code><\/pre><\/div>\n\n\n\n
\u51fa\u529b\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u3053\u3093\u306a\u611f\u3058\u3002\u3061\u306a\u307f\u306bxxx.pp\u30d5\u30a1\u30a4\u30eb\u306f\u8a2d\u5b9a\u3055\u308c\u308b\u30dd\u30ea\u30b7\u30fc\u306e\u5185\u5bb9\u304c\u30c6\u30ad\u30b9\u30c8\u4ea4\u3058\u308a\u306e\u30d0\u30a4\u30ca\u30ea\u30c7\u30fc\u30bf\u3067\u5165\u3063\u3066\u308b\u3002xxx.te\u304c\u30c6\u30ad\u30b9\u30c8\u30d5\u30a1\u30a4\u30eb\u3067\u8a2d\u5b9a\u3055\u308c\u308b\u5185\u5bb9\u304c\u78ba\u8a8d\u3067\u304d\u308b\u3002\u898b\u3066\u3082\u3088\u304f\u89e3\u3089\u306a\u3044\u3051\u3069\u30fb\u30fb\u30fb\u3000\uff08\u5927\u6c57<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ ll<\/span><\/span>\n\u5408\u8a08<\/span> <\/span>20<\/span><\/span>\n-rw-r--r--.<\/span> <\/span>1<\/span> <\/span>root<\/span> <\/span>root<\/span> <\/span>1204<\/span> <\/span>11<\/span>\u6708<\/span>  <\/span>5<\/span> <\/span>16<\/span>:10<\/span> <\/span>freshclam.pp<\/span><\/span>\n-rw-r--r--.<\/span> <\/span>1<\/span> <\/span>root<\/span> <\/span>root<\/span>  <\/span>323<\/span> <\/span>11<\/span>\u6708<\/span>  <\/span>5<\/span> <\/span>16<\/span>:10<\/span> <\/span>freshclam.te<\/span><\/span>\n\u30fb\u30fb\u4ee5\u4e0b\u7701\u7565<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u6307\u793a\u3055\u308c\u305f\u901a\u308a\u306b\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u3057\u3066\u3000\u65b0\u3057\u3044\u30dd\u30ea\u30b7\u30fc\u3092\u8a2d\u5b9a\u3059\u308b\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo semodule -i freshclam.pp<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\u518d\u5ea6\u3000freshclam\u3092\u5b9f\u884c\u3057\u3066\u307f\u308b\u3002<\/p>\n\n\n\n
<\/path><\/path><\/svg><\/span>
[]$ sudo systemctl restart clamav-freshclam.service<\/span><\/span>\n[]$ sudo systemctl status clamav-freshclam.service<\/span><\/span>\n\u25cf<\/span> <\/span>clamav-freshclam.service<\/span> <\/span>-<\/span> <\/span>ClamAV<\/span> <\/span>virus<\/span> <\/span>database<\/span> <\/span>updater<\/span><\/span>\n     <\/span>Loaded:<\/span> <\/span>loaded<\/span> (\/usr\/lib\/systemd\/system\/clamav-freshclam.service; <\/span>enabled<\/span>; <\/span>preset:<\/span> <\/span>disabled<\/span>)<\/span><\/span>\n     <\/span>Active:<\/span> <\/span>active<\/span> (running) since Tue 2024-11-05 16:18:16 JST; <\/span>9s<\/span> <\/span>ago<\/span><\/span>\n\u4ee5\u4e0b\u7701\u7565<\/span><\/span>\n<\/span><\/code><\/pre><\/div>\n\n\n\n
\u4e0a\u624b\u304f\u52d5\u304d\u51fa\u3057\u305f\u3088\u3046\u3060\u3002<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e8b\u306e\u8d77\u3053\u308a\u306f\u3000\u30b5\u30fc\u30d0\u30fcOS\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u5f8c\u3000Logwatch\u306eclam-update Begin\u306e\u9805\u306b\u300c\u52d5\u3044\u3066\u306a\u3044\u3088\u300d\u3063\u3066\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8a18\u9332\u3055\u308c\u3066\u305f\u4e8b\u3002\u5185\u5bb9\u306f\u3053\u3093\u306a\u611f\u3058\u3002 \u30b5\u30fc\u30d0\u30fc\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\/var\/log\/fresh … <\/p>\n
“freshclam\u304c\u52d5\u304b\u306a\u3044\u3002\uff08SELinux\u95a2\u9023\uff09” \u306e<\/span>\u7d9a\u304d\u3092\u8aad\u3080<\/a><\/p>\n","protected":false},"author":1,"featured_media":1279,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"footnotes":""},"categories":[5,106,21],"tags":[107,56],"class_list":["post-1375","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-darkgray-server","category-rocky-linux-ver9","category-selinux","tag-freshclam","tag-selinux"],"_links":{"self":[{"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1375"}],"version-history":[{"count":4,"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1375\/revisions"}],"predecessor-version":[{"id":1382,"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1375\/revisions\/1382"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=\/wp\/v2\/media\/1279"}],"wp:attachment":[{"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/darkgray.homelinux.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}