After a user asked something about clamav on IRC, I noticed that
clamav-daemon's postinst creates a file
/etc/systemd/system/clamav-daemon.service.d/extend.conf with static
content:

+---
|     echo "#Automatically Generated by clamav-daemon postinst" > $DEBCONFFILE
|     echo "#To reconfigure clamd run #dpkg-reconfigure clamav-daemon" >> $DEBCONFFILE
|     echo "#Please read /usr/share/doc/clamav-daemon/README.Debian.gz for details" >> $DEBCONFFILE
|     echo "[Service]" > "$DEBSYSTEMDCLAMDCONF"
|     echo "ExecStartPre=-/bin/mkdir /run/clamav" >> "$DEBSYSTEMDCLAMDCONF"
|     echo "ExecStartPre=/bin/chown $User /run/clamav" >> "$DEBSYSTEMDCLAMDCONF"
+---

This really looks like something that doesn't belong in /etc, but
either should be part of clamav-daemon.service directly or shipped as
/lib/systemd/system/clamav-daemon.service.d/extend.conf (i.e. /lib
instead of /etc).

(There is also RuntimeDirectory=, but I'm not sure if stretch's
systemd already supports that.)

For some reason the user had a call to "/bin/mkdir" instead of
"-/bin/mkdir" which failed when the directory already existed (e.g. on
restart).

Ansgar

I'm sorry but have to admit that this somehow fell through the cracks.

I will have to look that up. The user may change from the default so it
is autogenerated. If you say that this should be in /lib then I will try
to make that happen.

In the meantime we have "mkdir -p" in unstable which should address
this. I will try to to bring this change to stable.

Sebastian

Hey,

recently did "systemctl revert" to reset some overrides I put in through "systemctl edit". The effect obviously was
that the extend.conf which is not supposed to be there got deleted and clamd did not start upon reboot.

Systemd overrides (ie. <foo-bar>.service.d/something.conf) are there for local/user dop-in overrides and can be "restored to factory settings" through documented means - use of "systemctl revert".
As Sebastian mentionted, it should be in /lib/systemd, preferably as a part of '.service' file. Just menitoning this as this can makes you AV not work without you even realizing it,
which is a problem if you have site allowing users  to upload files and rely on some AV verification.

Regards,
Marek