Dear Maintainer,
clamav-daemon is currently shipped with a systemd unit file that makes
no use of systemd securty features. I found that a number of attack vectors
can be closed without inferring problems with functionality.
This is my version of /lib/systemd/system/clamav-daemon.service that seems to
work OK:
----------------
[Unit]
Description=Clam AntiVirus userspace daemon
Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
# Check for database existence
ConditionPathExistsGlob=/var/lib/clamav/main.{c[vl]d,inc}
ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc}
[Service]
ExecStart=/usr/sbin/clamd --foreground=true
User=clamav
# Reload the database
ExecReload=/bin/kill -USR2 $MAINPID
StandardOutput=syslog
TimeoutStartSec=420
PrivateTmp=true
CapabilityBoundingSet=~CAP_SETUID CAP_SETGID CAP_SETPCAP
CapabilityBoundingSet=~CAP_SYS_ADMIN
CapabilityBoundingSet=~CAP_SYS_PTRACE
RestrictNamespaces=~CLONE_NEWUSER
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
CapabilityBoundingSet=~CAP_CHOWN CAP_FSETID CAP_SETFCAP
CapabilityBoundingSet=~CAP_FOWNER CAP_IPC_OWNER
CapabilityBoundingSet=~CAP_NET_ADMIN
CapabilityBoundingSet=~CAP_SYS_MODULE
CapabilityBoundingSet=~CAP_SYS_RAWIO
CapabilityBoundingSet=~CAP_SYS_TIME
[Install]
WantedBy=multi-user.target
----------------
--- data dir ---
total 628240
-rw-r--r-- 1 clamav clamav 1438720 Mar 8 2021 bytecode.cld
-rw-r--r-- 1 clamav clamav 177796096 Nov 14 11:00 daily.cld
-rw-r--r-- 1 clamav clamav 69 Oct 22 13:57 freshclam.dat
-rw-r--r-- 1 clamav clamav 464053248 Sep 16 20:03 main.cld
-rw-r--r-- 1 root root 69 Apr 22 2021 mirrors.dat
drwxr-xr-x 2 clamav clamav 4096 Aug 29 19:04 tmp.c01a6bc443