[From nobody Sun Jun 28 16:54:08 2026 Received: (at submit) by bugs.debian.org; 23 Dec 2025 21:19:30 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-18.1 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD,HAS_PACKAGE,SPF_HELO_PASS, SPF_PASS,WORD_WITHOUT_VOWELS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 109; hammy, 150; neutral, 590; spammy, 0. spammytokens: hammytokens:0.000-+--trixie, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug, 0.000-+--H*Ad:N*Tracking, 0.000-+--stable-security Return-path: <Ralf+Debian@Bergs.biz> Received: from mail.vsvr.de ([2a01:4f8:160:636c::2]:47028 helo=vsvr.de) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <Ralf+Debian@Bergs.biz>) id 1vY9mz-004ky6-1y for submit@bugs.debian.org; Tue, 23 Dec 2025 21:19:30 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=bergs.biz; s=osvr; h=Date:Message-ID:Subject:To:From; bh=MzzMVqEgOMBD7OGJGuTirz/4xtz3cMlrHuM8WzZ4xfY=; b=moxYl111DeJp6pM7iYCMeUF3Lc 9TqcWtWoStl/+05RDVUX6qoqbfNVdCuzJ4SBi8u/IjEfEjM3OJMTMP5Lu7vJ/2r29/rg5aOOn9tfG PxsVGDw8Jb5PpgssgaE8M8WNJwG32gGoM99EmUdzrPNDBIEQlwQq0TGHajPnxGMSTJqfBzCUFaR1j uyDuggWpg44La3SBlrE9HfqlSGKIm2CHV/YXMijJFFM8GxWsqOir+xmX5+GodUTq/flIPVc3pZ0Z4 nsvOM5vBcvk/l12kDLSyN0dLAXtzCB5trLDXUluStNWJzlTJNdyILX7I9TEeHkDqykUTbwcKyyfFv oa3HK9BA==; Received: from rabe by vsvr.de with local (Exim 4.98.2) (envelope-from <Ralf+Debian@Bergs.biz>) id 1vY9Kt-00000003R9A-1KBl; Tue, 23 Dec 2025 20:50:27 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Ralf Bergs <Ralf+Debian@Bergs.biz> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: clamav-daemon: clamd tries to read /sys/fs/cgroup/system.slice/cpu.max and fails Message-ID: <176652302730.430721.11022158247058593573.reportbug@vsvr.de> X-Mailer: reportbug 13.2.0 Date: Tue, 23 Dec 2025 20:50:27 +0000 X-Greylist: delayed 1733 seconds by postgrey-1.37 at buxtehude; Tue, 23 Dec 2025 21:19:29 UTC Delivered-To: submit@bugs.debian.org Package: clamav-daemon Version: 1.4.3+dfsg-1 Severity: minor Dear Maintainer, I'm seeing occasional errors like the below in syslog: 2025-11-22T12:27:24.229084+00:00 myhost kernel: audit: type=1400 audit(1763814444.221:134): apparmor="DENIED" operation="open" class="file" profile="/usr/sbin/clamd" name="/sys/fs/cgroup/system.slice/cpu.max" pid=1282 comm="clamd" requested_mask="r" denied_mask="r" fsuid=112 ouid=0 It seems that the apparmor profile needs to be amended to allow clamd to read this file. It seems to be a minor issue, though, as clamd can continue operating. Many thanks in advance for looking into this. Kind regards, Ralf -- Package-specific info: --- configuration --- Checking configuration files in /etc/clamav Config file: clamd.conf ----------------------- AlertExceedsMax disabled CacheSize = "65536" PreludeEnable disabled PreludeAnalyzerName = "ClamAV" LogFile = "/var/log/clamav/clamav.log" LogFileUnlock disabled LogFileMaxSize = "9223372036854775807" LogTime = "yes" LogClean disabled LogSyslog disabled LogFacility = "LOG_LOCAL6" LogVerbose disabled LogRotate = "yes" ExtendedDetectionInfo = "yes" PidFile disabled TemporaryDirectory disabled DatabaseDirectory = "/var/lib/clamav" OfficialDatabaseOnly disabled FailIfCvdOlderThan disabled LocalSocket = "/var/run/clamav/clamd.ctl" LocalSocketGroup = "clamav" LocalSocketMode = "666" FixStaleSocket = "yes" TCPSocket disabled TCPAddr disabled MaxConnectionQueueLength = "15" StreamMaxLength = "26214400" StreamMinPort = "1024" StreamMaxPort = "2048" MaxThreads = "12" ReadTimeout = "180" CommandReadTimeout = "30" SendBufTimeout = "200" MaxQueue = "100" IdleTimeout = "30" ExcludePath disabled MaxDirectoryRecursion = "15" FollowDirectorySymlinks disabled FollowFileSymlinks disabled CrossFilesystems = "yes" SelfCheck = "3600" ConcurrentDatabaseReload = "yes" DisableCache disabled VirusEvent disabled ExitOnOOM disabled AllowAllMatchScan = "yes" Foreground disabled Debug disabled LeaveTemporaryFiles disabled GenerateMetadataJson disabled User = "clamav" Bytecode = "yes" BytecodeSecurity = "TrustSigned" BytecodeTimeout = "60000" BytecodeUnsigned disabled BytecodeMode = "Auto" DetectPUA disabled ExcludePUA disabled IncludePUA disabled ScanPE = "yes" ScanELF = "yes" ScanMail = "yes" ScanPartialMessages disabled PhishingSignatures = "yes" PhishingScanURLs = "yes" HeuristicAlerts = "yes" HeuristicScanPrecedence disabled StructuredDataDetection disabled StructuredMinCreditCardCount = "3" StructuredMinSSNCount = "3" StructuredSSNFormatNormal = "yes" StructuredSSNFormatStripped disabled ScanHTML = "yes" ScanOLE2 = "yes" AlertBrokenExecutables disabled AlertBrokenMedia disabled AlertEncrypted disabled StructuredCCOnly disabled AlertEncryptedArchive disabled AlertEncryptedDoc disabled AlertOLE2Macros disabled AlertPhishingSSLMismatch disabled AlertPhishingCloak disabled AlertPartitionIntersection disabled ScanPDF = "yes" ScanSWF = "yes" ScanXMLDOCS = "yes" ScanHWP3 = "yes" ScanOneNote = "yes" ScanArchive = "yes" ScanImage = "yes" ScanImageFuzzyHash = "yes" ForceToDisk disabled MaxScanTime = "120000" MaxScanSize = "104857600" MaxFileSize = "26214400" MaxRecursion = "16" MaxFiles = "10000" MaxEmbeddedPE = "10485760" MaxHTMLNormalize = "10485760" MaxHTMLNoTags = "2097152" MaxScriptNormalize = "5242880" MaxZipTypeRcg = "1048576" MaxPartitions = "50" MaxIconsPE = "100" MaxRecHWP3 = "16" PCREMatchLimit = "10000" PCRERecMatchLimit = "5000" PCREMaxFileSize = "26214400" OnAccessMountPath disabled OnAccessIncludePath disabled OnAccessExcludePath disabled OnAccessExcludeRootUID disabled OnAccessExcludeUID disabled OnAccessExcludeUname disabled OnAccessMaxFileSize = "5242880" OnAccessDisableDDD disabled OnAccessPrevention disabled OnAccessExtraScanning disabled OnAccessCurlTimeout = "5000" OnAccessMaxThreads = "5" OnAccessRetryAttempts disabled OnAccessDenyOnError disabled DevACOnly disabled DevACDepth disabled DevPerformance disabled DevLiblog disabled DisableCertCheck disabled AlgorithmicDetection = "yes" BlockMax disabled PhishingAlwaysBlockSSLMismatch disabled PhishingAlwaysBlockCloak disabled PartitionIntersection disabled OLE2BlockMacros disabled ArchiveBlockEncrypted disabled Config file: freshclam.conf --------------------------- LogFileMaxSize = "9223372036854775807" LogTime = "yes" LogSyslog disabled LogFacility = "LOG_LOCAL6" LogVerbose disabled LogRotate = "yes" PidFile disabled DatabaseDirectory = "/var/lib/clamav" Foreground disabled Debug disabled UpdateLogFile = "/var/log/clamav/freshclam.log" DatabaseOwner = "clamav" Checks = "24" DNSDatabaseInfo = "current.cvd.clamav.net" DatabaseMirror = "db.local.clamav.net", "database.clamav.net" PrivateMirror disabled MaxAttempts = "5" ScriptedUpdates = "yes" TestDatabases = "yes" CompressLocalDatabase disabled ExtraDatabase disabled ExcludeDatabase disabled DatabaseCustomURL disabled HTTPProxyServer disabled HTTPProxyPort disabled HTTPProxyUsername disabled HTTPProxyPassword disabled HTTPUserAgent disabled NotifyClamd = "/etc/clamav/clamd.conf" OnUpdateExecute disabled OnErrorExecute disabled OnOutdatedExecute disabled LocalIPAddress disabled ConnectTimeout = "30" ReceiveTimeout disabled Bytecode = "yes" clamav-milter.conf not found Software settings ----------------- Version: 1.4.3 Optional features supported: MEMPOOL AUTOIT_EA06 ICONV Database information -------------------- Database directory: /var/lib/clamav bytecode.cld: version 339, sigs: 80, built on Thu Sep 11 12:29:19 2025 main.cld: version 63, sigs: 3287027, built on Tue Dec 16 23:18:22 2025 daily.cld: version 27859, sigs: 354585, built on Tue Dec 23 07:25:59 2025 Total number of signatures: 3641692 Platform information -------------------- uname: Linux 6.12.57+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.57-1 (2025-11-05) x86_64 OS: Linux, ARCH: x86_64, CPU: x86_64 Full OS version: Debian GNU/Linux 13 (trixie) zlib version: 1.3.1 (1.3.1), compile flags: a9 platform id: 0x0a21d5d508000000000e0200 Build information ----------------- GNU C: 14.2.0 (14.2.0) sizeof(void*) = 8 Engine flevel: 213, dconf: 213 --- data dir --- total 315916 -rw-r--r-- 1 clamav clamav 1369088 Sep 11 13:05 bytecode.cld -rw-r--r-- 1 clamav clamav 85770752 Dec 23 08:19 daily.cld -rw-r--r-- 1 clamav clamav 69 Jun 15 2023 freshclam.dat -rw-r--r-- 1 clamav clamav 236346880 Dec 17 00:17 main.cld -- System Information: Debian Release: 13.2 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'proposed-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.57+deb13-amd64 (SMP w/12 CPU threads; PREEMPT) Locale: LANG=en_IE.UTF-8, LC_CTYPE=en_IE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages clamav-daemon depends on: ii adduser 3.152 ii clamav-base 1.4.3+dfsg-1 ii clamav-freshclam [clamav-data] 1.4.3+dfsg-1 ii debconf [debconf-2.0] 1.5.91 ii dpkg 1.22.21 ii init-system-helpers 1.69~deb13u1 ii libc6 2.41-12 ii libclamav12 1.4.3+dfsg-1 ii libcurl4t64 8.14.1-2+deb13u2 ii libncurses6 6.5+20250216-2 ii libsystemd0 257.9-1~deb13u1 ii libtinfo6 6.5+20250216-2 ii procps 2:4.0.4-9 ii ucf 3.0052 ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1 Versions of packages clamav-daemon recommends: pn clamdscan <none> Versions of packages clamav-daemon suggests: ii apparmor 4.1.0-1 ii clamav-doc 1.4.3+dfsg-1 pn daemon <none> pn libclamunrar <none> -- Configuration Files: /etc/apparmor.d/usr.sbin.clamd changed: /usr/sbin/clamd { #include <abstractions/base> #include <abstractions/nameservice> #include <abstractions/openssl> # LP: #433764: capability dac_override, # needed, when using systemd capability setgid, capability setuid, capability chown, @{PROC}/filesystems r, @{PROC}/[0-9]*/status r, @{PROC}/[0-9]*/cgroup r, @{PROC}/[0-9]*/mountinfo r, /sys/fs/cgroup/system.slice/clamav-daemon.service/cpu.max r, /etc/clamav/clamd.conf r, /usr/sbin/clamd mr, /tmp/ rw, /tmp/** krw, /var/lib/clamav/ r, /var/lib/clamav/** krw, /var/log/clamav/* krw, /{,var/}run/clamav/clamd.ctl w, /{,var/}run/clamav/clamd.pid w, /var/spool/clamsmtp/* r, /var/spool/qpsmtpd/* r, /var/spool/p3scan/children/** r, /var/spool/havp/** r, # For amavisd-new integration /var/lib/amavis/tmp/** r, # For mimedefang integration /var/spool/MIMEDefang/mdefang-*/Work/ r, /var/spool/MIMEDefang/mdefang-*/Work/** r, # For use with exim /var/spool/exim4/** r, # Allow home dir to be scanned @{HOME}/ r, @{HOME}/** r, # Site-specific additions and overrides. See local/README for details. #include <local/usr.sbin.clamd> } /etc/logcheck/ignore.d.paranoid/clamav-daemon [Errno 13] Permission denied: '/etc/logcheck/ignore.d.paranoid/clamav-daemon' /etc/logcheck/ignore.d.server/clamav-daemon [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/clamav-daemon' -- debconf information: clamav-daemon/DisableCertCheck: false clamav-daemon/LogSyslog: false clamav-daemon/AllowAllMatchScan: true clamav-daemon/LocalSocketMode: 666 clamav-daemon/MaxDirectoryRecursion: 15 clamav-daemon/Bytecode: true clamav-daemon/MaxEmbeddedPE: 10M clamav-daemon/ScanArchive: true clamav-daemon/TCPSocket: 3310 clamav-daemon/ScanMail: true clamav-daemon/LocalSocketGroup: clamav clamav-daemon/MaxThreads: 12 clamav-daemon/LogTime: true clamav-daemon/ForceToDisk: false clamav-daemon/BytecodeSecurity: TrustSigned clamav-daemon/FollowFileSymlinks: false clamav-daemon/FixStaleSocket: true clamav-daemon/BytecodeTimeout: 60000 clamav-daemon/ScanSWF: true clamav-daemon/LogFile: /var/log/clamav/clamav.log clamav-daemon/TcpOrLocal: UNIX clamav-daemon/ReadTimeout: 180 clamav-daemon/StreamMaxLength: 25 clamav-daemon/FollowDirectorySymlinks: false clamav-daemon/OnAccessMaxFileSize: 5M clamav-daemon/LocalSocket: /var/run/clamav/clamd.ctl clamav-daemon/MaxScriptNormalize: 5M clamav-daemon/MaxHTMLNoTags: 2M clamav-daemon/debconf: true clamav-daemon/MaxZipTypeRcg: 1M clamav-daemon/User: clamav clamav-daemon/SelfCheck: 3600 clamav-daemon/MaxHTMLNormalize: 10M clamav-daemon/LogRotate: true clamav-daemon/TCPAddr: any clamav-daemon/MaxConnectionQueueLength: 15 clamav-daemon/AddGroups: Debian-exim ]