© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
0e1f616
(Get the code!)
The security benefit is not questionable-- clamav has historically had *many* CVEs, some of which result in arbitrary code execution. AppArmor mitigates this risk of running clamav and protects the user from known and as-yet-unknown vulnerabilities in clamav.
The AppArmor profile is intended to work in common usage scenarios, and if this is a common usage scenario, then perhaps adding:
/** r,
would be ok. I'll let the clamav maintainers decide if this is worth it. Keep in mind, only DAC will protect against arbitrary reads, and since clamav does run as its own user, this should be enough for the sensitive files I mentioned, /etc/shadow, etc. This still protects against arbitrary could execution, but does weaken the profile somewhat.
Chris mentioned that people are having quite a few problems with this. This is the first bug I've seen against clamdscan. If people want these things fixed, they must let developers know by filing bugs.