numerous "file path check failure" warnings

[promeneur]

Describe the bug

OpenSUSE Tumbleweed
Clamav 1.2.1 from https://build.opensuse.org/package/show/home%3Abruno_friedmann/clamav

clamd.service

clamd.service.txt

clamd log

clamd.log

In clamd journal I get numerous "file path check failure" about .pki, Google Chrome files, Mozilla files, etc. Is it normal ?

How to reproduce the problem

Replace this text with the output from the ClamAV command:
clamconf -n

:~> clamconf -n
Checking configuration files in /etc

Config file: clamd.conf

LogSyslog = "yes"
LogFacility = "LOG_MAIL"
PidFile = "/run/clamav/clamd.pid"
LocalSocket = "/run/clamav/clamd.sock"
User = "vscan"
OnAccessIncludePath = "/home"
OnAccessExcludeUname = "vscan"

Config file: freshclam.conf

PidFile = "/run/clamav/freshclam.pid"
DatabaseMirror = "database.clamav.net"

clamav-milter.conf not found

Software settings

Version: 1.2.1
Optional features supported: MEMPOOL AUTOIT_EA06 BZIP2 LIBXML2 PCRE2 ICONV JSON RAR

Database information

Database directory: /var/lib/clamav
daily.cld: version 27130, sigs: 2049190, built on Thu Dec 21 10:38:20 2023
main.cvd: version 62, sigs: 6647427, built on Thu Sep 16 14:32:42 2021
bytecode.cvd: version 334, sigs: 91, built on Wed Feb 22 22:33:21 2023
Total number of signatures: 8696708

Platform information

uname: Linux 6.6.7-1-default #1 SMP PREEMPT_DYNAMIC Thu Dec 14 17:36:48 UTC 2023 (6869d09) x86_64
OS: Linux, ARCH: x86_64, CPU: x86_64
Full OS version: "openSUSE Tumbleweed"
zlib version: 1.3 (1.3), compile flags: a9
platform id: 0x0a21bfbf08000000000d0201

Build information

GNU C: 13.2.1 20231130 [revision 741743c028dc00f27b9c8b1d5211c1f602f2fddd] (13.2.1)
sizeof(void*) = 8
Engine flevel: 191, dconf: 191
:~>

---

Attachments

If applicable, add screenshots to help explain your problem.

If the issue is reproducible only when scanning a specific file, attach it to the ticket.

[val-ms]

Could you check if those files still exist on your machine? I wonder if the files temporarily existed and disappeared before the scan performed that file path check.

[promeneur]

janv. 07 11:36:45 grincheux clamd[1743]: File path check failure on: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/icon128.png
janv. 07 11:36:45 grincheux clamd[1743]: File path check failure for: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/icon128.png
janv. 07 11:36:45 grincheux clamd[1743]: File path check failure on: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/icon128.png
janv. 07 11:36:45 grincheux clamd[1743]: File path check failure for: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/icon128.png
janv. 07 11:36:45 grincheux clamd[1743]: File path check failure on: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/icon128.png
janv. 07 11:36:45 grincheux clamd[1743]: File path check failure for: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/sprites32.png
janv. 07 11:36:45 grincheux clamd[1743]: File path check failure on: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/sprites32.png
janv. 07 11:36:45 grincheux clamd[1743]: File path check failure for: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/sprites32.png
janv. 07 11:36:45 grincheux clamd[1743]: File path check failure on: /home/roubach/.config/google-chrome/Default/Extensions/ecanpcehffngcegjmadlcijfolapggal/2.18_0/sprites32.png

All files exist. These files do not exist temporarily.

[promeneur]

File path check failure for: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 09 05:18:12 grincheux clamd[1716]: File path check failure on: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 09 05:18:12 grincheux clamd[1716]: File path check failure for: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 09 05:18:12 grincheux clamd[1716]: File path check failure on: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 09 05:18:12 grincheux clamd[1716]: File path check failure for: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 09 05:18:12 grincheux clamd[1716]: File path check failure on: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 09 05:18:12 grincheux clamd[1716]: File path check failure for: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 09 05:18:12 grincheux clamd[1716]: File path check failure on: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 09 05:18:13 grincheux clamd[1716]: File path check failure for: /home/roubach/.config/google-chrome/Default/.com.google.Chrome.K8ZhBo
janv. 09 05:18:13 grincheux clamd[1716]: File path check failure on: /home/roubach/.config/google-chrome/Default/.com.google.Chrome.K8ZhBo

database-wal exist.

.com.google.Chrome.K8ZhBo does not exist.

for the files which exist :
perhaps it is because clamd and other process want to access at the same time to the file.

[val-ms]

I see you're using the OnAccess options in clamd.conf. I don't see any other mention of clamonacc, but can I assume this issue is specific to clamonacc?

If you're running clamonacc with clamd, it may be that clamd is running as the "clamav" user and does not have permission to open these files in your home directory.

Others have reported the same or similar issue with clamonacc. See #1050, #514 and #857. In #1050, the reporter noted that clamonacc --fdpass also seems to fix the issue. Can you try this? The --fdpass option give the file handle from clamonacc to clamd so that clamd does not need permission to open the file.

[promeneur]

I only installed packages. I don't have any knowledge for setting any clamav component.
In what conf file to put "--fdpass" ?

ACL of the file :

File path check failure for: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 10 12:03:30 grincheux clamd[1729]: File path check failure on: /home/roubach/.local/share/kactivitymanagerd/resources/database-wal
janv. 10 12:03:31 grincheux clamd[1729]: File path check failure for: /home/roubach/.cache/plasma-svgelements.lock
janv. 10 12:03:31 grincheux clamd[1729]: File path check failure on: /home/roubach/.cache/plasma-svgelements.lock
janv. 10 12:03:31 grincheux clamd[1729]: File path check failure for: /home/roubach/.cache/plasma-svgelements
janv. 10 12:03:31 grincheux clamd[1729]: File path check failure on: /home/roubach/.cache/plasma-svgelements
janv. 10 12:03:31 grincheux clamd[1729]: File path check failure for: /home/roubach/.cache/plasma-svgelements
janv. 10 12:03:31 grincheux clamd[1729]: File path check failure on: /home/roubach/.cache/plasma-svgelements
janv. 10 12:03:31 grincheux clamd[1729]: File path check failure for: /home/roubach/.mozilla/firefox/cjx7x4b0.default-release/sessionstore-backups/recovery.jsonlz4.tmp
janv. 10 12:03:31 grincheux clamd[1729]: File path check failure on: /home/roubach/.mozilla/firefox/cjx7x4b0.default-release/sessionstore-backups/recovery.jsonlz4.tmp

You can see this is never the same list of files.

[val-ms]

In what conf file to put "--fdpass" ?

"--fdpass" is an extra commandline option when you start the clamonacc service.

I see you have a /usr/lib/systemd/system/clamd.service

It is probably something similar for clmonacc on your system, like /usr/lib/systemd/system/clamonacc.service

[promeneur]

it seem ok now.

janv. 13 08:05:13 grincheux clamd[1705]: XMLDOCS support enabled.
janv. 13 08:05:13 grincheux clamd[1705]: HWP3 support enabled.
janv. 13 08:05:13 grincheux clamd[1705]: Self checking every 600 seconds.
janv. 13 08:05:13 grincheux systemd[1]: Started Clam AntiVirus userspace daemon.
janv. 13 08:15:24 grincheux clamd[1705]: SelfCheck: Database status OK.
janv. 13 08:18:52 grincheux clamd[1705]: /home/roubach/.local/share/local-mail/.Personnel.directory/hsbc/new/1697804512359.R403.grincheux: Heuristics.Phishing.Email.SpoofedDomain FOUND
janv. 13 08:18:52 grincheux clamd[1705]: /home/roubach/.local/share/akonadi/file_db_data/91/79891_r0: Heuristics.Phishing.Email.SpoofedDomain FOUND
janv. 13 08:18:52 grincheux clamd[1705]: /home/roubach/.local/share/akonadi/file_db_data/91/79891_r0: Heuristics.Phishing.Email.SpoofedDomain FOUND
janv. 13 08:18:59 grincheux clamd[1705]: /home/roubach/.local/share/akonadi/file_db_data/91/79891_r0: Heuristics.Phishing.Email.SpoofedDomain FOUND
janv. 13 08:25:25 grincheux clamd[1705]: SelfCheck: Database status OK.

What is the meaning of

/home/roubach/.local/share/akonadi/file_db_data/91/79891_r0: Heuristics.Phishing.Email.SpoofedDomain FOUND

[val-ms]

The SpoofedDomain heuristic means the scan found some HTML links where the display text is made to look like a link, but the domain does not match the actual domain that the link takes you to. ClamAV doesn't complain about this for every link, but only for a specific websites that are higher risk of being used in phishing such as websites for banks, paypal, etc.

If you scan those files with clamscan, there should be some additional text output that will show the display URL and real URL so you can find out which links are causing problems. If you find out, i would be curious to know. If it makes sense to do it, we can add a rule to ignore a false positive. This happens quite a bit for companies like paypal that lie about the domain in their link display text when sending you to paypal-related websites that aren't actually paypal.com.

[promeneur]

Thanks for the explanation.

1. I explored the mails in /Personnel/hsbc.
   There are only three mails.

These mail was scanned by clamav via spamassassin and declared "ham" with "X-Virus-Flag: no".
These mails are really HSBC mails.

The false positives spoofing urls (I assume)

bienvenue.ccf.fr
https://l.mail.hsbc.fr/rts/go2.aspx?h=165949&tp=i-1NGB-Hi-7cH-OAgod-2K-5SDk-1c-OASky-l9nVgnfBhR-P6DwA&pi=fg77x6EVLXYu_NmyfRdcaYn47LeLDlWzLvoiH6g-ibY

bienvenue.ccf.fr
https://l.mail.hsbc.fr/rts/go2.aspx?h=165945&tp=i-1NHD-Hi-7cH-OAgod-2K-5SDk-1c-z4w-OASky-l9nVgnfBhR-23GkWu

www.hsbc.fr/protection-des-donnees
https://l.mail.hsbc.fr/rts/go2.aspx?h=161812&tp=i-1NGB-Hi-7RR-JQboT-2K-5SDk-1c-JQSh9-l9Zk57dvJu-2JU8Qn&pi=fg77x6EVLXYu_NmyfRdcaYn47LeLDlWzLvoiH6g-ibY

www.cnil.fr/fr/contacter-la-cnil-standard-et-permanences-telephoniques
https://l.mail.hsbc.fr/rts/go2.aspx?h=161813&tp=i-1NGB-Hi-7RR-JQboT-2K-5SDk-1c-JQSh9-l9Zk57dvJu-2JU8Qn&pi=fg77x6EVLXYu_NmyfRdcaYn47LeLDlWzLvoiH6g-ibY

services.hsbc.fr/cession
https://l.mail.hsbc.fr/rts/go2.aspx?h=161815&tp=i-1NGB-Hi-7RR-JQboT-2K-5SDk-1c-JQSh9-l9Zk57dvJu-2JU8Qn&pi=fg77x6EVLXYu_NmyfRdcaYn47LeLDlWzLvoiH6g-ibY)

In the third mail I did not find any link as those above-mentioned.
I only found a non clickable link www.assetmanagement.hsbc.fr

2. What is the utility of the scanning if the user is not prevented via KDE GUI that a file is dangerous ?

[promeneur]

Surprise !

"--fdpass" disappeared.

[promeneur]

Hello

It seems that sometime clamonacc.service is updated then the option "--fdpass" disappeared.