Clamdscan error when launched by apache user “No file descriptor received. ERROR”

apache-2.4centos7clamav

We're trying to use clamav on a centos 7 server in order to scan directly files on our web apps (Moodle for example).
When trying to execute a clamdscan from apache, we got this error (the file belong to apache:apache and has correct rights 755)

<?php
exec('/usr/bin/clamdscan --stdout --fdpass /var/www/html/test/filetoscan', $output, $return);
print "<pre>";
print_r($output);
print_r($return);
?>

And the return is :

Array
(
[0] => Failed to parse reply: "No file descriptor received. ERROR"
[1] => 
[2] => ----------- SCAN SUMMARY -----------
[3] => Infected files: 0
[4] => Total errors: 1
[5] => Time: 0.000 sec (0 m 0 s)
)
2

Of course, if we try to do it directly through command lines, we have same error..

su -l apache -s /bin/bash
/usr/bin/clamdscan --stdout --fdpass /var/www/html/test/filetoscan

How can I allow apache to execute clamdscan (or resolve the file descriptor problem) ? of course if the command is launched by an other user everything works fine.

Thanks for your help 🙂

Regards.
Diego

Best Answer

Neither applying setsebool -P antivirus_can_scan_system 1 (from this setup procedure) or disabling completely SELinux in /etc/selinux/config have improved the situation.

As a result, a strace has been generated to understand what happens, running as apache:

$ strace /usr/bin/clamdscan --stdout --fdpass /var/www/html/cours/moodledata/temp/filetoscan
[...]
rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER, 0x7ff93f13c650}, NULL, 8) = 0
lstat("/var/www/html/cours/moodledata/temp/filetoscan", {st_mode=S_IFREG|0755, st_size=7256, ...}) = 0
socket(PF_LOCAL, SOCK_STREAM, 0)        = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/clamd.scan/clamd.sock"}, 110) = -1 EACCES (Permission denied)
close(3)                                = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(3310), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
open("/var/www/html/cours/moodledata/temp/filetoscan", O_RDONLY) = 4
sendto(3, "zFILDES\0", 8, 0, NULL, 0)   = 8
sendmsg(3, {msg_name(0)=NULL, msg_iov(1)=[{"\0", 1}], msg_controllen=20, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {4}}, msg_flags=0}, 0) = 1
close(4)                                = 0
recvfrom(3, "No file descriptor received. ERR"..., 5120, 0, NULL, NULL) = 35
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff93fd3b000
write(1, "Failed to parse reply: \"No file "..., 60Failed to parse reply: "No file descriptor received. ERROR"

First accessing the unix socket file /var/run/clamd.scan/clamd.sock failed, then the fallback to TCP communication 127.0.0.1/3301 failed for another reason.

Probably adding apache in the required group to access the unix socket will fix your issue.

Related Topic