[clamav-users] running freshclam and 3rd party/clamav-unofficial-sigs.sh owner name changes occasionally

[Gary R. Schmidt]

On 10/10/2020 01:10, Robert Kudyba wrote:
> Running ClamAV 103.0-1 on Fedora, I have freshclam 
> and clamav-unofficial-sigs.sh from 
> https://github.com/extremeshok/clamav-unofficial-sigs 
> <https://github.com/extremeshok/clamav-unofficial-sigs>
> 
> Every few weeks I'll start seeing this error:
> 
> ERROR: clam database directory (clam_dbs) not writable /var/lib/clamav
> 
> Running this fixes it:
> su clamav -s '/usr/local/sbin/clamav-unofficial-sigs.sh'
> 
> Here are the files not owned by clamav:
> -rw-r--r--  1 clamupdate clamupdate    296388 Sep 19  2019 bytecode.cvd
> -rw-r--r--  1 clamupdate clamupdate 112832258 Sep 17 09:53 daily.cvd
> -rw-r--r--  1 clamupdate clamupdate 117859675 Nov 25  2019 main.cvd
> 
At first glance it appears someone is running "freshclam" manually as 
clamupdate/clamupdate.

Is there only one "freshclam" binary on the system?

Is it running as a daemon or being invoked by some other method(s)?

Is there another that is set{g,u}id clamupdate?

Oh, what binaries *are* set{g,u}id clamupdate?

And who/what regularly uses the "clamupdate" id?

	Cheers,
		Gary	B-)