Selinux denial on clamd

[Watts M.R.]

I'm currently trying to integrate Squid, c-icap and clamd together to get A/V scanning of objects through squid on a CentOS 6.5 server.

I have things working but every time I try and download the eicar.com test virus, I see the following in the logs:

type=AVC msg=audit(1410534437.751:227204): avc:  denied  { write } for  pid=22480 comm="clamd" path="/var/tmp/CI_TMP_DaewkQ" dev=dm-1 ino=182 scontext=unconfined_u:system_r:antivirus_t:s0 tcontext=unconfined_u:object_r:initrc_tmp_t:s0 tclass=file

For the record, this server has been hardened according to the CIS CentOS 6.5 benchmark document.

/tmp and /var/tmp are mounted as so, if this matters:

/dev/mapper/VolGroup00-tmp on /tmp type ext4 (rw,noexec,nosuid,nodev)
/tmp on /var/tmp type none (rw,noexec,nosuid,nodev,bind)

If I set "semanage permissive -a clamd_t" then everything works.


Audit2allow suggests I need the following, but I'm not really understanding why:

allow antivirus_t initrc_tmp_t:file write;


Any guidance?

Mark.

--
Mark Watts
Infrastructure Engineer, iSolutions
University of Southampton
Tel: (02380) 595788 Int: 25788

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/selinux/attachments/20140912/19192fe2/attachment.html>