clamav-scan fails because of missing temp-file

[Frank Grötzner]

Hi,

I'm trying to setup amavis in a docker container connecting to clamav
over tcp in another docker container. This works so far, but I have some
strange problems with amavis and the files in its tmp-directory.

Amavis-Version:
***@amavis-34crr:~# dpkg -l | grep amavis
ii amavisd-new 1:2.10.1-1

on a Debian 8

As you can see in the log here: http://nopaste.linux-dev.org/?936356
amavis creates the temp-dir in line 215, issues a new files named p001
in line 271 and does some work on it in the following lines. As I traced
with a
"cd /var/lib/amavis/tmp; while true; do find; done" that file actually
exists for some time:
.
.
.
./amavis-20160130T182734-00010-n2T4BbZG
./amavis-20160130T182734-00010-n2T4BbZG/parts
./amavis-20160130T182734-00010-n2T4BbZG/email.txt
(...)
.
./amavis-20160130T182734-00010-n2T4BbZG
./amavis-20160130T182734-00010-n2T4BbZG/parts
./amavis-20160130T182734-00010-n2T4BbZG/parts/p001
./amavis-20160130T182734-00010-n2T4BbZG/email.txt
(...)
.
./amavis-20160130T182734-00010-n2T4BbZG
./amavis-20160130T182734-00010-n2T4BbZG/parts
./amavis-20160130T182734-00010-n2T4BbZG/email.txt




... but then disappears. In line 336 amavis fails to send the files to
clamav, because they are no longer there. :-/

Last strange thing: In line 435 the directory gets stripped - but in
fact it stays in the file system:

***@amavis-34crr:~# ls -l /var/lib/amavis/tmp/
total 4
drwxr-x--- 3 amavis amavis 4096 Jan 30 18:27
amavis-20160130T182734-00010-n2T4BbZG
***@amavis-34crr:~#


Any ideas on this?!

Best regards,
Frank

[A. Schulze]

Post by Frank Grötzner
I'm trying to setup amavis in a docker container connecting to
clamav over tcp in another docker container. This works so far, but
I have some strange problems with amavis and the files in its
tmp-directory.

amavis instruct clamd via the socket only "helo, please scan the files
you find in /path"
so both have processes have to see the SAME directory under the SAME /path

Andreas

[Frank Grötzner]

Hi Andreas!

Post by A. Schulze
amavis instruct clamd via the socket only "helo, please scan the files
you find in /path"
so both have processes have to see the SAME directory under the SAME /path

So you mean even if I configure ClamAV-clamd in
/etc/amavis/conf.d/15-av_scanners to talk to clamd via tcp, they both
have to remain on the same host or at least can access to same files at
the same path via a shared volume (e.g. nfs)?

I thought the client portion of clamav would send the files via tcp to
clamd...

Best regards,
Frank

[Benny Pedersen]

Post by Frank Grötzner
I thought the client portion of clamav would send the files via tcp to
clamd...

fuglu works nicely with clamd in tcp socket mode

so both unix and inet socket is supported in clamd at the same time

nfs is irrelevant for clamd

[A. Schulze]

Post by Frank Grötzner
So you mean even if I configure ClamAV-clamd in
/etc/amavis/conf.d/15-av_scanners to talk to clamd via tcp, they
both have to remain on the same host or at least can access to same
files at the same path via a shared volume (e.g. nfs)?

that's what I expect...

Post by Frank Grötzner
I thought the client portion of clamav would send the files via tcp
to clamd...

It make no sense to transfer all data if the two processes could share
them via filesystem.
Consider using multiple av scanners, that would not scale very well.

I think such mode is /possible/ but that's not default mode for clamd
neither for amavis

Andreas