Package: clamav-daemon Version: 0.103.3+dfsg-0+deb11u1 Severity: wishlist Dear Maintainer,
clamav-daemon is currently shipped with a systemd unit file that makes no use of systemd securty features. I found that a number of attack vectors can be closed without inferring problems with functionality. This is my version of /lib/systemd/system/clamav-daemon.service that seems to work OK: ---------------- [Unit] Description=Clam AntiVirus userspace daemon Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/ # Check for database existence ConditionPathExistsGlob=/var/lib/clamav/main.{c[vl]d,inc} ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc} [Service] ExecStart=/usr/sbin/clamd --foreground=true User=clamav # Reload the database ExecReload=/bin/kill -USR2 $MAINPID StandardOutput=syslog TimeoutStartSec=420 PrivateTmp=true CapabilityBoundingSet=~CAP_SETUID CAP_SETGID CAP_SETPCAP CapabilityBoundingSet=~CAP_SYS_ADMIN CapabilityBoundingSet=~CAP_SYS_PTRACE RestrictNamespaces=~CLONE_NEWUSER RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX CapabilityBoundingSet=~CAP_CHOWN CAP_FSETID CAP_SETFCAP CapabilityBoundingSet=~CAP_FOWNER CAP_IPC_OWNER CapabilityBoundingSet=~CAP_NET_ADMIN CapabilityBoundingSet=~CAP_SYS_MODULE CapabilityBoundingSet=~CAP_SYS_RAWIO CapabilityBoundingSet=~CAP_SYS_TIME [Install] WantedBy=multi-user.target ---------------- -- Package-specific info: --- configuration --- Checking configuration files in /etc/clamav Config file: clamd.conf ----------------------- AlertExceedsMax disabled PreludeEnable disabled PreludeAnalyzerName = "ClamAV" LogFile = "/var/log/clamav/clamav.log" LogFileUnlock disabled LogFileMaxSize = "4294967295" LogTime = "yes" LogClean disabled LogSyslog disabled LogFacility = "LOG_LOCAL6" LogVerbose disabled LogRotate = "yes" ExtendedDetectionInfo = "yes" PidFile disabled TemporaryDirectory disabled DatabaseDirectory = "/var/lib/clamav" OfficialDatabaseOnly disabled LocalSocket = "/var/run/clamav/clamd.ctl" LocalSocketGroup = "clamav" LocalSocketMode = "666" FixStaleSocket = "yes" TCPSocket disabled TCPAddr disabled MaxConnectionQueueLength = "15" StreamMaxLength = "26214400" StreamMinPort = "1024" StreamMaxPort = "2048" MaxThreads = "12" ReadTimeout = "180" CommandReadTimeout = "30" SendBufTimeout = "200" MaxQueue = "100" IdleTimeout = "30" ExcludePath disabled MaxDirectoryRecursion = "15" FollowDirectorySymlinks disabled FollowFileSymlinks disabled CrossFilesystems = "yes" SelfCheck = "3600" ConcurrentDatabaseReload = "yes" DisableCache disabled VirusEvent disabled ExitOnOOM disabled AllowAllMatchScan = "yes" Foreground disabled Debug disabled LeaveTemporaryFiles disabled User = "clamav" Bytecode = "yes" BytecodeSecurity = "TrustSigned" BytecodeTimeout = "60000" BytecodeUnsigned disabled BytecodeMode = "Auto" DetectPUA disabled ExcludePUA disabled IncludePUA disabled ScanPE = "yes" ScanELF = "yes" ScanMail = "yes" ScanPartialMessages disabled PhishingSignatures = "yes" PhishingScanURLs = "yes" HeuristicAlerts = "yes" HeuristicScanPrecedence disabled StructuredDataDetection disabled StructuredMinCreditCardCount = "3" StructuredMinSSNCount = "3" StructuredSSNFormatNormal = "yes" StructuredSSNFormatStripped disabled ScanHTML = "yes" ScanOLE2 = "yes" AlertBrokenExecutables disabled AlertBrokenMedia disabled AlertEncrypted disabled StructuredCCOnly disabled AlertEncryptedArchive disabled AlertEncryptedDoc disabled AlertOLE2Macros disabled AlertPhishingSSLMismatch disabled AlertPhishingCloak disabled AlertPartitionIntersection disabled ScanPDF = "yes" ScanSWF = "yes" ScanXMLDOCS = "yes" ScanHWP3 = "yes" ScanArchive = "yes" ForceToDisk disabled MaxScanTime = "120000" MaxScanSize = "104857600" MaxFileSize = "26214400" MaxRecursion = "16" MaxFiles = "10000" MaxEmbeddedPE = "10485760" MaxHTMLNormalize = "10485760" MaxHTMLNoTags = "2097152" MaxScriptNormalize = "5242880" MaxZipTypeRcg = "1048576" MaxPartitions = "50" MaxIconsPE = "100" MaxRecHWP3 = "16" PCREMatchLimit = "10000" PCRERecMatchLimit = "5000" PCREMaxFileSize = "26214400" OnAccessMountPath disabled OnAccessIncludePath disabled OnAccessExcludePath disabled OnAccessExcludeRootUID disabled OnAccessExcludeUID disabled OnAccessExcludeUname disabled OnAccessMaxFileSize = "5242880" OnAccessDisableDDD disabled OnAccessPrevention disabled OnAccessExtraScanning disabled OnAccessCurlTimeout = "5000" OnAccessMaxThreads = "5" OnAccessRetryAttempts disabled OnAccessDenyOnError disabled DevACOnly disabled DevACDepth disabled DevPerformance disabled DevLiblog disabled DisableCertCheck disabled AlgorithmicDetection = "yes" BlockMax disabled PhishingAlwaysBlockSSLMismatch disabled PhishingAlwaysBlockCloak disabled PartitionIntersection disabled OLE2BlockMacros disabled ArchiveBlockEncrypted disabled Config file: freshclam.conf --------------------------- LogFileMaxSize = "4294967295" LogTime = "yes" LogSyslog disabled LogFacility = "LOG_LOCAL6" LogVerbose disabled LogRotate = "yes" PidFile disabled DatabaseDirectory = "/var/lib/clamav" Foreground disabled Debug disabled UpdateLogFile = "/var/log/clamav/freshclam.log" DatabaseOwner = "clamav" Checks = "24" DNSDatabaseInfo = "current.cvd.clamav.net" DatabaseMirror = "db.local.clamav.net", "database.clamav.net" PrivateMirror disabled MaxAttempts = "5" ScriptedUpdates = "yes" TestDatabases = "yes" CompressLocalDatabase disabled ExtraDatabase disabled ExcludeDatabase disabled DatabaseCustomURL disabled HTTPProxyServer disabled HTTPProxyPort disabled HTTPProxyUsername disabled HTTPProxyPassword disabled HTTPUserAgent disabled NotifyClamd = "/etc/clamav/clamd.conf" OnUpdateExecute disabled OnErrorExecute disabled OnOutdatedExecute disabled LocalIPAddress disabled ConnectTimeout = "30" ReceiveTimeout disabled Bytecode = "yes" clamav-milter.conf not found Software settings ----------------- Version: 0.103.3 Optional features supported: MEMPOOL IPv6 FRESHCLAM_DNS_FIX AUTOIT_EA06 BZIP2 LIBXML2 PCRE2 ICONV JSON Database information -------------------- Database directory: /var/lib/clamav bytecode.cld: version 333, sigs: 92, built on Mon Mar 8 16:21:51 2021 main.cld: version 62, sigs: 6647427, built on Thu Sep 16 14:32:42 2021 daily.cld: version 26353, sigs: 1945034, built on Sun Nov 14 10:19:38 2021 Total number of signatures: 8592553 Platform information -------------------- uname: Linux 5.10.0-8-amd64 #1 SMP Debian 5.10.46-5 (2021-09-23) x86_64 OS: linux-gnu, ARCH: x86_64, CPU: x86_64 Full OS version: Debian GNU/Linux 11 (bullseye) zlib version: 1.2.11 (1.2.11), compile flags: a9 platform id: 0x0a217c7c08000000000a0201 Build information ----------------- GNU C: 10.2.1 20210110 (10.2.1) CPPFLAGS: -Wdate-time -D_FORTIFY_SOURCE=2 CFLAGS: -g -O2 -ffile-prefix-map=/build/clamav-TCDQmt/clamav-0.103.3+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 CXXFLAGS: -g -O2 -ffile-prefix-map=/build/clamav-TCDQmt/clamav-0.103.3+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -D_FILE_OFFSET_BITS=64 LDFLAGS: -Wl,-z,relro -Wl,-z,now -Wl,--as-needed Configure: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=/usr/include' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' '--disable-silent-rules' '--libdir=/usr/lib/x86_64-linux-gnu' '--runstatedir=/run' '--disable-maintainer-mode' '--disable-dependency-tracking' 'CFLAGS=-g -O2 -ffile-prefix-map=/build/clamav-TCDQmt/clamav-0.103.3+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -D_FILE_OFFSET_BITS=64' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -ffile-prefix-map=/build/clamav-TCDQmt/clamav-0.103.3+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -D_FILE_OFFSET_BITS=64' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now -Wl,--as-needed' '--with-dbdir=/var/lib/clamav' '--sysconfdir=/etc/clamav' '--disable-clamav' '--disable-unrar' '--enable-milter' '--enable-dns-fix' '--with-libjson' '--with-system-libmspack' '--with-libcurl=/usr' '--with-gnu-ld' '--with-systemdsystemunitdir=/lib/systemd/system' 'build_alias=x86_64-linux-gnu' 'OBJCFLAGS=-g -O2 -ffile-prefix-map=/build/clamav-TCDQmt/clamav-0.103.3+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security' sizeof(void*) = 8 Engine flevel: 124, dconf: 124 --- data dir --- total 628240 -rw-r--r-- 1 clamav clamav 1438720 Mar 8 2021 bytecode.cld -rw-r--r-- 1 clamav clamav 177796096 Nov 14 11:00 daily.cld -rw-r--r-- 1 clamav clamav 69 Oct 22 13:57 freshclam.dat -rw-r--r-- 1 clamav clamav 464053248 Sep 16 20:03 main.cld -rw-r--r-- 1 root root 69 Apr 22 2021 mirrors.dat drwxr-xr-x 2 clamav clamav 4096 Aug 29 19:04 tmp.c01a6bc443 -- System Information: Debian Release: 11.1 APT prefers stable-security APT policy: (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-8-amd64 (SMP w/4 CPU threads) Kernel taint flags: TAINT_FIRMWARE_WORKAROUND Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages clamav-daemon depends on: ii adduser 3.118 ii clamav-base 0.103.3+dfsg-0+deb11u1 ii clamav-freshclam [clamav-data] 0.103.3+dfsg-0+deb11u1 ii debconf [debconf-2.0] 1.5.77 ii dpkg 1.20.9 ii libc6 2.31-13+deb11u2 ii libclamav9 0.103.3+dfsg-0+deb11u1 ii libcurl4 7.74.0-1.3+b1 ii libncurses6 6.2+20201114-2 ii libsystemd0 247.3-6 ii libtinfo6 6.2+20201114-2 ii lsb-base 11.1.0 ii procps 2:3.3.17-5 ii ucf 3.0043 ii zlib1g 1:1.2.11.dfsg-2 Versions of packages clamav-daemon recommends: ii clamdscan 0.103.3+dfsg-0+deb11u1 Versions of packages clamav-daemon suggests: pn apparmor <none> pn clamav-docs <none> pn daemon <none> pn libclamunrar <none> -- debconf information: clamav-daemon/MaxHTMLNormalize: 10M clamav-daemon/ScanArchive: true clamav-daemon/LocalSocketMode: 666 clamav-daemon/SelfCheck: 3600 clamav-daemon/StreamMaxLength: 25 clamav-daemon/LogSyslog: false clamav-daemon/User: clamav clamav-daemon/MaxConnectionQueueLength: 15 clamav-daemon/ReadTimeout: 180 clamav-daemon/BytecodeTimeout: 60000 clamav-daemon/FollowFileSymlinks: false clamav-daemon/Bytecode: true clamav-daemon/MaxDirectoryRecursion: 15 clamav-daemon/FollowDirectorySymlinks: false clamav-daemon/BytecodeSecurity: TrustSigned clamav-daemon/LocalSocketGroup: clamav clamav-daemon/OnAccessMaxFileSize: 5M clamav-daemon/ScanMail: true clamav-daemon/FixStaleSocket: true clamav-daemon/AllowAllMatchScan: true clamav-daemon/AddGroups: Debian-exim clamav-daemon/MaxZipTypeRcg: 1M clamav-daemon/debconf: true clamav-daemon/MaxScriptNormalize: 5M clamav-daemon/LocalSocket: /var/run/clamav/clamd.ctl clamav-daemon/LogRotate: true clamav-daemon/TCPSocket: 3310 clamav-daemon/ForceToDisk: false clamav-daemon/TCPAddr: any clamav-daemon/MaxHTMLNoTags: 2M clamav-daemon/MaxEmbeddedPE: 10M clamav-daemon/DisableCertCheck: false clamav-daemon/ScanSWF: true clamav-daemon/LogFile: /var/log/clamav/clamav.log clamav-daemon/LogTime: true clamav-daemon/MaxThreads: 12 clamav-daemon/TcpOrLocal: UNIX