#999662 clamav-daemon: Use systemd isolation features to reduce risk by compromised clamav-daemon

Package:
clamav-daemon
Source:
clamav
Description:
anti-virus utility for Unix - scanner daemon
Submitter:
Andreas Feldner
Date:
2024-06-04 14:45:03 UTC
Severity:
wishlist
#999662#5
Date:
2021-11-14 12:05:43 UTC
From:
To:
Dear Maintainer,

clamav-daemon is currently shipped with a systemd unit file that makes
no use of systemd securty features. I found that a number of attack vectors
can be closed without inferring problems with functionality.

This is my version of /lib/systemd/system/clamav-daemon.service that seems to
work OK:
----------------
[Unit]
Description=Clam AntiVirus userspace daemon
Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
# Check for database existence
ConditionPathExistsGlob=/var/lib/clamav/main.{c[vl]d,inc}
ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc}

[Service]
ExecStart=/usr/sbin/clamd --foreground=true
User=clamav
# Reload the database
ExecReload=/bin/kill -USR2 $MAINPID
StandardOutput=syslog
TimeoutStartSec=420
PrivateTmp=true
CapabilityBoundingSet=~CAP_SETUID CAP_SETGID CAP_SETPCAP
CapabilityBoundingSet=~CAP_SYS_ADMIN
CapabilityBoundingSet=~CAP_SYS_PTRACE
RestrictNamespaces=~CLONE_NEWUSER
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
CapabilityBoundingSet=~CAP_CHOWN CAP_FSETID CAP_SETFCAP
CapabilityBoundingSet=~CAP_FOWNER CAP_IPC_OWNER
CapabilityBoundingSet=~CAP_NET_ADMIN
CapabilityBoundingSet=~CAP_SYS_MODULE
CapabilityBoundingSet=~CAP_SYS_RAWIO
CapabilityBoundingSet=~CAP_SYS_TIME

[Install]
WantedBy=multi-user.target
----------------
--- data dir --- total 628240 -rw-r--r-- 1 clamav clamav 1438720 Mar 8 2021 bytecode.cld -rw-r--r-- 1 clamav clamav 177796096 Nov 14 11:00 daily.cld -rw-r--r-- 1 clamav clamav 69 Oct 22 13:57 freshclam.dat -rw-r--r-- 1 clamav clamav 464053248 Sep 16 20:03 main.cld -rw-r--r-- 1 root root 69 Apr 22 2021 mirrors.dat drwxr-xr-x 2 clamav clamav 4096 Aug 29 19:04 tmp.c01a6bc443
#999662#10
Date:
2024-06-04 14:38:57 UTC
From:
To:

FYI, an issue and a pull request have been opened upstream:

https://github.com/Cisco-Talos/clamav/issues/858
https://github.com/Cisco-Talos/clamav/pull/859