Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: ClamAV: users

lstat() failed: Permission denied. ERROR

 

 

ClamAV users RSS feed   Index | Next | Previous | View Threaded


limaunion at gmail

Dec 21, 2009, 8:02 AM

Post #1 of 12 (11773 views)
Permalink
lstat() failed: Permission denied. ERROR

Hi all! I'm getting the following error message while try to run clamdscan:

$ clamdscan eicar.txt
eicar.txt: lstat() failed: Permission denied. ERROR

I've enable debug mode and got:

$fds_poll_recv: timeout after 600 seconds
$Received POLLIN|POLLHUP on fd 5
$Got new connection, FD 10
$Received POLLIN|POLLHUP on fd 6
$fds_poll_recv: timeout after 5 seconds
$Received POLLIN|POLLHUP on fd 10
$got command CONTSCAN /home/superuser/eicar.txt (35, 7), argument:
/home/superuser/eicar.txt
$mode -> MODE_WAITREPLY
$Breaking command loop, mode is no longer MODE_COMMAND
$Consumed entire command
$Number of file descriptors polled: 1 fds
$fds_poll_recv: timeout after 600 seconds
$THRMGR: queue crossed low threshold -> signaling
WARNING: lstat() failed on: /home/superuser/eicar.txt
$Finished scanthread
$Scanthread: connection shut down (FD 10)
$THRMGR: queue crossed low threshold -> signaling

This is a RHEL 5.4.

Any ideas what's going on here ?
Thanks!
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


dan.mcdonald at austinenergy

Dec 21, 2009, 8:12 AM

Post #2 of 12 (11624 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

On Mon, 2009-12-21 at 13:02 -0300, Lima Union wrote:
> Hi all! I'm getting the following error message while try to run clamdscan:
>
> $ clamdscan eicar.txt
> eicar.txt: lstat() failed: Permission denied. ERROR


clamdscan runs with the permissions of the daemon user. You probably
want to do something like:
$ cat eicar.txt | clamdscan



--
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


limaunion at gmail

Dec 21, 2009, 9:14 AM

Post #3 of 12 (11611 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

On Mon, Dec 21, 2009 at 1:12 PM, Daniel J McDonald
<dan.mcdonald [at] austinenergy> wrote:
> On Mon, 2009-12-21 at 13:02 -0300, Lima Union wrote:
>> Hi all! I'm getting the following error message while try to run clamdscan:
>>
>> $ clamdscan eicar.txt
>> eicar.txt: lstat() failed: Permission denied. ERROR
>
>
> clamdscan runs with the permissions of the daemon user.  You probably
> want to do something like:
> $ cat eicar.txt | clamdscan
>

ok, but I'm still having the same results:

$ cat eicar.txt | clamdscan
/home/superuser: lstat() failed: Permission denied. ERROR

What else can I check ?
TIA
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


chupacerveza at gmail

Dec 21, 2009, 9:16 AM

Post #4 of 12 (11617 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

Lima Union wrote:
> Hi all! I'm getting the following error message while try to run clamdscan:
>
> $ clamdscan eicar.txt
> eicar.txt: lstat() failed: Permission denied. ERROR
>
> I've enable debug mode and got:
>
> $fds_poll_recv: timeout after 600 seconds
> $Received POLLIN|POLLHUP on fd 5
> $Got new connection, FD 10
> $Received POLLIN|POLLHUP on fd 6
> $fds_poll_recv: timeout after 5 seconds
> $Received POLLIN|POLLHUP on fd 10
> $got command CONTSCAN /home/superuser/eicar.txt (35, 7), argument:
> /home/superuser/eicar.txt
> $mode -> MODE_WAITREPLY
> $Breaking command loop, mode is no longer MODE_COMMAND
> $Consumed entire command
> $Number of file descriptors polled: 1 fds
> $fds_poll_recv: timeout after 600 seconds
> $THRMGR: queue crossed low threshold -> signaling
> WARNING: lstat() failed on: /home/superuser/eicar.txt
> $Finished scanthread
> $Scanthread: connection shut down (FD 10)
> $THRMGR: queue crossed low threshold -> signaling
>
> This is a RHEL 5.4.
>
> Any ideas what's going on here ?
> Thanks!

Perhaps Daniel's information is correct, I would offer that you should
be running: sudo clamscan eicar.txt.

Hope this is helpful,
Robert
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


limaunion at gmail

Dec 21, 2009, 9:41 AM

Post #5 of 12 (11616 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

> On Mon, Dec 21, 2009 at 2:23 PM, Robert Wyatt <chupacerveza [at] gmail> wrote:
>> Lima Union wrote:
>>>
>>>>>
>>>>> Any ideas what's going on here ?
>>>>> Thanks!
>>>>
>>>> Perhaps Daniel's information is correct, I would offer that you should be
>>>> running: sudo clamscan eicar.txt.
>>>>
>>>> Hope this is helpful,
>>>> Robert
>>>>
>>>
>>> ok, I've just tried that without success:
>>>
>>> # id
>>> uid=0(root) gid=0(root)
>>> groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
>>> context=user_u:system_r:unconfined_t:s0
>>> [root [at] relay superuser]# cat eicar.txt | clamdscan
>>> /home/superuser: lstat() failed: Permission denied. ERROR
>>
>>
>> Okay, that seems odd to be logged in as the superuser and seeming not to
>> have superuser privileges. What about substituting clamscan for clamdscan?
>>
>

You mean substituting clamdscan for clamscan ?

This is the result:

clamscan eicar.txt
eicar.txt: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 678203
Engine version: 0.95.3
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 1.864 sec (0 m 1 s)

But clamdscan still doesn't work... :(
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


jason at electronet

Dec 21, 2009, 10:08 AM

Post #6 of 12 (11609 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

> -----Original Message-----
> From: clamav-users-bounces [at] lists [mailto:clamav-users-
> bounces [at] lists] On Behalf Of Lima Union
> Sent: Monday, December 21, 2009 12:41 PM
> To: ClamAV users ML
> Subject: Re: [Clamav-users] lstat() failed: Permission denied. ERROR
>
>
> You mean substituting clamdscan for clamscan ?
>
> This is the result:
>
> clamscan eicar.txt
> eicar.txt: Eicar-Test-Signature FOUND
>
> ----------- SCAN SUMMARY -----------
> Known viruses: 678203
> Engine version: 0.95.3
> Scanned directories: 0
> Scanned files: 1
> Infected files: 1
> Data scanned: 0.00 MB
> Data read: 0.00 MB (ratio 0.00:1)
> Time: 1.864 sec (0 m 1 s)
>
> But clamdscan still doesn't work... :(

It's likely that the user clamd runs as doesn't have correct permissions to
access the file you're scanning. An earlier suggestion was close but, I
think, missing something. Try adding a hyphen at the end:

cat eicar.txt | clamdscan -

_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


limaunion at gmail

Dec 21, 2009, 11:32 AM

Post #7 of 12 (11613 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

On Mon, Dec 21, 2009 at 3:08 PM, Jason Bertoch <jason [at] electronet> wrote:
>> -----Original Message-----
>> From: clamav-users-bounces [at] lists [mailto:clamav-users-
>> bounces [at] lists] On Behalf Of Lima Union
>> Sent: Monday, December 21, 2009 12:41 PM
>> To: ClamAV users ML
>> Subject: Re: [Clamav-users] lstat() failed: Permission denied. ERROR
>>
>>
>>  You mean substituting clamdscan for clamscan ?
>>
>>  This is the result:
>>
>>  clamscan eicar.txt
>>  eicar.txt: Eicar-Test-Signature FOUND
>>
>>  ----------- SCAN SUMMARY -----------
>>  Known viruses: 678203
>>  Engine version: 0.95.3
>>  Scanned directories: 0
>>  Scanned files: 1
>>  Infected files: 1
>>  Data scanned: 0.00 MB
>>  Data read: 0.00 MB (ratio 0.00:1)
>>  Time: 1.864 sec (0 m 1 s)
>>
>>  But clamdscan still doesn't work... :(
>
> It's likely that the user clamd runs as doesn't have correct permissions to
> access the file you're scanning.  An earlier suggestion was close but, I
> think, missing something.  Try adding a hyphen at the end:
>
> cat eicar.txt | clamdscan -
>

Your suggestion works! so this is a file permission problem ? where
should I look ?
Thanks!
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


chupacerveza at gmail

Dec 21, 2009, 12:51 PM

Post #8 of 12 (11617 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

Lima Union wrote:
> On Mon, Dec 21, 2009 at 3:08 PM, Jason Bertoch<jason [at] electronet> wrote:
>>> -----Original Message-----
>>> From: clamav-users-bounces [at] lists [mailto:clamav-users-
>>> bounces [at] lists] On Behalf Of Lima Union
>>> Sent: Monday, December 21, 2009 12:41 PM
>>> To: ClamAV users ML
>>> Subject: Re: [Clamav-users] lstat() failed: Permission denied. ERROR
>>>
>>>
>>> You mean substituting clamdscan for clamscan ?
>>>
>>> This is the result:
>>>
>>> clamscan eicar.txt
>>> eicar.txt: Eicar-Test-Signature FOUND
>>>
>>> ----------- SCAN SUMMARY -----------
>>> Known viruses: 678203
>>> Engine version: 0.95.3
>>> Scanned directories: 0
>>> Scanned files: 1
>>> Infected files: 1
>>> Data scanned: 0.00 MB
>>> Data read: 0.00 MB (ratio 0.00:1)
>>> Time: 1.864 sec (0 m 1 s)
>>>
>>> But clamdscan still doesn't work... :(
>>
>> It's likely that the user clamd runs as doesn't have correct permissions to
>> access the file you're scanning. An earlier suggestion was close but, I
>> think, missing something. Try adding a hyphen at the end:
>>
>> cat eicar.txt | clamdscan -
>>
>
> Your suggestion works! so this is a file permission problem ? where
> should I look ?
> Thanks!

Hi Lima,

I should let the experts answer, but I'll take a stab at it just to
find out for myself. One of the differences between clamscan and
clamdscan is that clamscan runs as the user requesting it whereas
clamdscan runs as a special user (usually clamd, I believe), which
would be in a special administrative category allowing it to read
across multiple user's files.

So you probably do not have a file permission problem per se and that
is why the hyphen option is included so that when you run clamdscan as
a normal user you can do what you were trying to do.

I would recommend consulting "man clamdscan" for the options and
descriptions. Let's see what others have to say.

--Robert
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


limaunion at gmail

Dec 22, 2009, 4:06 AM

Post #9 of 12 (11591 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

On Mon, Dec 21, 2009 at 5:51 PM, Robert Wyatt <chupacerveza [at] gmail> wrote:
> Lima Union wrote:
> Hi Lima,
>
> I should let the experts answer, but I'll take a stab at it just to find out
> for myself. One of the differences between clamscan and clamdscan is that
> clamscan runs as the user requesting it whereas clamdscan runs as a special
> user (usually clamd, I believe), which would be in a special administrative
> category allowing it to read across multiple user's files.
>
> So you probably do not have a file permission problem per se and that is why
> the hyphen option is included so that when you run clamdscan as a normal
> user you can do what you were trying to do.
>
> I would recommend consulting "man clamdscan" for the options and
> descriptions. Let's see what others have to say.
>
> --Robert
>

Ok, thanks. From the man page:

(4) To scan from standard input:

clamdscan - <file_to_scan cat file_to_scan | clamdscan -

Anyway it's strange because from a Debian distro I can issue
clamadscan without the hyphen.
Best regards.
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


limaunion at gmail

Dec 23, 2009, 9:38 AM

Post #10 of 12 (11566 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

On Tue, Dec 22, 2009 at 9:06 AM, Lima Union <limaunion [at] gmail> wrote:
> On Mon, Dec 21, 2009 at 5:51 PM, Robert Wyatt <chupacerveza [at] gmail> wrote:
>> Lima Union wrote:
>> Hi Lima,
>>
>> I should let the experts answer, but I'll take a stab at it just to find out
>> for myself. One of the differences between clamscan and clamdscan is that
>> clamscan runs as the user requesting it whereas clamdscan runs as a special
>> user (usually clamd, I believe), which would be in a special administrative
>> category allowing it to read across multiple user's files.
>>
>> So you probably do not have a file permission problem per se and that is why
>> the hyphen option is included so that when you run clamdscan as a normal
>> user you can do what you were trying to do.
>>
>> I would recommend consulting "man clamdscan" for the options and
>> descriptions. Let's see what others have to say.
>>
>> --Robert
>>
>
> Ok, thanks. From the man page:
>
> (4) To scan from standard input:
>
>              clamdscan - <file_to_scan cat file_to_scan | clamdscan -
>
> Anyway it's strange because from a Debian distro I can issue
> clamadscan without the hyphen.
> Best regards.
>

Hi! just for the record, I think that this problem is related to
SELinux, I'm running RH 5.4 and have disabled it and now clamdscan
works without requiring an hyphen.
Regards.
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


jimlinux at commspeed

Dec 23, 2009, 9:55 AM

Post #11 of 12 (11572 views)
Permalink
Re: lstat() failed: Permission denied. ERROR [In reply to]

On Dec 23, 2009, at 10:38 AM, Lima Union wrote:

>>
>> Ok, thanks. From the man page:
>>
>> (4) To scan from standard input:
>>
>> clamdscan - <file_to_scan cat file_to_scan | clamdscan -
>>
>> Anyway it's strange because from a Debian distro I can issue
>> clamadscan without the hyphen.
>> Best regards.
>>
>
> Hi! just for the record, I think that this problem is related to
> SELinux, I'm running RH 5.4 and have disabled it and now clamdscan
> works without requiring an hyphen.
> Regards.

Yes, disabling SELinux fixes a lot of things. One of the questions
though is the server sitting on the Internet? If it is behind a router
with its own firewall rules then the exposure is less. I would try
permissive first before disabling all together on a production system.
With tweaking you can get what you need working in the Enforcing mode
but takes a lot of effort sometimes.

Jim
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


dev.admin at ntlworld

Dec 24, 2009, 7:24 AM

Post #12 of 12 (11548 views)
Permalink
lstat() failed: Permission denied. ERROR [In reply to]

Hi as well Lima,

I'm not an expert either ;-)

clamdscan sends the object to be scanned to the
daemon (clamd) that is usually running at all times.
I've decided to call this 'server side'.

clamscan is more of a 'client side' application
that should ideally be used for one-off scans due
to the overhead of launching it.

When using any binary application, ideally you
should use the full path of the object you are
referring to e.g.

clamdscan /path/to/file.txt

or this may work if you've 'cd' to the directory

clamdscan ./file.txt

You have to be very specific about locations of files
on the command line. It could even be that with the
command you issued previously, clamdscan assumed you
were referring to the root directory.

Also if the daemon (clamd) is not running as 'root'
then I think it will also have limited access to what
it can scan.

To check the permissions of the file, 'cd' to the
directory and in the terminal window type:

ls -l

this should list all the visible files and their
permissions.

A.

_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml

ClamAV users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.