freshclam apparmor error : type=1502 operation="inode_permission" requested_mask="r::" denied_mask="r::" name="/proc/28071/status" on hardy-backports

@jdstrand: would you please have a look at this? This is from hardy-backports.

Can you please attach /etc/apparmor.d/usr.bin.freshclam?

cut and paste of the above file

# vim:syntax=apparmor
# Author: Jamie Strandboge <email address hidden>
# Last Modified: Sun Aug 3 09:39:03 2008

#include <tunables/global>

/usr/bin/freshclam {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>

  capability setgid,
  capability setuid,

  @{PROC}/filesystems r,
  owner @{PROC}/[0-9]*/status r,

  /etc/clamav/clamd.conf r,
  /etc/clamav/freshclam.conf r,
  /etc/clamav/onerrorexecute.d/* mr,
  /etc/clamav/onupdateexecute.d/* mr,
  /etc/clamav/virusevent.d/* mr,

  owner @{HOME}/.clamtk/db/ rw,
  owner @{HOME}/.clamtk/db/** rwk,

  owner @{HOME}/.klamav/database/ rw,
  owner @{HOME}/.klamav/database/** rwk,

  /usr/bin/freshclam mr,

  /var/lib/clamav/ r,
  /var/lib/clamav/** krw,

  /var/log/clamav/* kw,
  /var/run/clamav/freshclam.pid w,
  /var/run/clamav/clamd.ctl w,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.freshclam>
}

"owner @{PROC}/[0-9]*/status r," is present so this suggests the profile did not get reloaded on upgrade. What is the output of the following:
$ sudo apparmor_parser -r -T -W /etc/apparmor.d/usr.bin.freshclam

Did you see the error in the apt log for the clamav update on the -W flag, similar with the above command ...

apparmor_parser -r -T -W /etc/apparmor.d/usr.bin.freshclam
apparmor_parser: invalid option -- T
Novell/SUSE AppArmor parser version 2.1
Copyright (C) 1999, 2000, 2003, 2004, 2005, 2006 Novell Inc.

Usage: apparmor_parser [options] [profile]

Options:
--------
-a, --add Add apparmor definitions [default]
-d, --debug Debug apparmor definitions
-h, --help Display this text and exit
-r, --replace Replace apparmor definitions
-R, --remove Remove apparmor definitions
-v, --version Display version info and exit
-p, --preprocess Preprocess only
-C, --Complain Force the profile into complain mode
-I n, --Include n Add n to the search path
-b n, --base n Set base dir and cwd
-f n, --subdomainfs n Set location of apparmor filesystem
-S, --stdout Write output to stdout
-m n, --match-string n Use only match features n
-n n, --namespace n Set Namespace for the profile
-q, --quiet Don't emit warnings

This worked ( minus -T -W )

apparmor_parser -r /etc/apparmor.d/usr.bin.freshclam
Replacement succeeded for "/usr/bin/freshclam".

dpkg -l apparmor
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-f/Unpacked/Failed-cfg/Half-inst/t-aWait/T-pend
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name Version Description
+++-=================-=================-==================================================
ii apparmor 2.1+1075-0ubuntu9 User-space parser utility for AppArmor

I'm sorry, I forgot that Hardy does not support the -T and -W flags. After performing this:

$ sudo apparmor_parser -r /etc/apparmor.d/usr.bin.freshclam

do you still see the errors in kern.log? Note you may have to do:
$ sudo sysctl -w kernel.printk_ratelimit=0

to turn off kernel rate limiting.

I caught the lack of -T on Hardy and dropped it. I didn't catch the lack of -W. Is that in the current package?

Havent seen any errors since the apparmor_parser -r /etc/apparmor.d/usr.bin.freshclam

-W is not in the help displayed above.

Thanks

Hmm, one more this morning but its on the clamd executable

Oct 6 08:10:51 lenovo2 kernel: [160702.723615] audit(1286349051.332:38): type=1502 operation="inode_permission" requested_mask="r::" denied_mask="r::" name="/proc/28617/status" pid=28617 profile="/usr/sbin/clamd" namespace="default"

but its probably the same problem, just havent done the apparmor_parser -r on clamd config.

just done
apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
Replacement succeeded for "/usr/sbin/clamd".

Thanks for the super fast response btw.

The maverick package has:
./clamav-daemon.postinst.in: apparmor_parser -r -T -W "$APP_PROFILE" || true
./clamav-freshclam.postinst.in: apparmor_parser -r -T -W "$APP_PROFILE" || true

Both -T and -W will need to be stripped for hardy and jaunty when doing the backport. Karmic and later support -W and -T.

@jdstrand: I'm mostly offline the next few days, so please take this as whatever blessing you need from ubuntu-backporters to upload a fix for this to hardy and jaunty backports.

clamav (0.96.3+dfsg-2ubuntu0.10.04.1~jaunty2) jaunty-backports; urgency=low

  * Drop -T -W from apparmor_parser calls in clamav-daemon and freshclam
    postinsts since it is not supported in Jaunty's apparmor (LP: #655058)
 -- Scott Kitterman <email address hidden> Fri, 08 Oct 2010 09:47:56 -0400

clamav (0.96.3+dfsg-2ubuntu0.10.04.1~hardy2) hardy-backports; urgency=low

  * Also drop -W from apparmor_parser calls in clamav-daemon and freshclam
    postinsts since it is not supported in Hardy's apparmor (LP: #655058)
 -- Scott Kitterman <email address hidden> Fri, 08 Oct 2010 09:42:24 -0400

Packages are building for both hardy and jaunty backports to resolve this issue and should be available within the next few hours.

Package just came in and installed OK, Thanks