1

I've this piece of code located in /etc/cron.hourly/hourlyclamscan.

#!/usr/bin/bash
# Create Hourly Cron Job With Clamscan

# Directories to scan
SCAN_DIR=/home/transmission/Downloads

# Temporary file
LIST_FILE=`mktemp /tmp/clamscan.XXXXXX`

# Location of log file
LOG_FILE=/var/log/clamav/hourly_clamscan.log

# Make list of new files
/usr/bin/find "$SCAN_DIR" -type f -mmin -60 -fprint ${LIST_FILE}
# Scan files and remove infected
/usr/bin/clamscan -i -f ${LIST_FILE} --remove > $LOG_FILE

# If there were infected files detected, send email alert
if [ `cat ${LOG_FILE}  | grep Infected | grep -v 0 | wc -l` != 0 ]
then
echo "$(egrep "FOUND" $LOG_FILE)" | /bin/mail -s "VIRUS PROBLEM" -r clam@nas.local #####@#####.##
fi
exit

When I run it from the terminal, it give no error.

However, when cron runs the script, it sends an error to the root mailbox: ERROR: --file-list: Can't open file /tmp/clamscan.MLXep5

The file is created by find and owned by root (permission 600). The cron job is also run as root, so I assume permissions should not be an issue (or is it?).

  • Add output of ls -l /tmp/clamscan.MLXep5, ls -ld /tmp and df /tmp. – Cyrus Oct 14 '14 at 10:00
1

It turned out the be SElinux problem.

audit2allow -a

returns:

#============= antivirus_t ==============

#!!!! This avc can be allowed using the boolean 'antivirus_can_scan_system'
allow antivirus_t home_root_t:dir read;

And solved by entering:

setsebool -P antivirus_can_scan_system 1
| improve this answer | |
0

Apart from your script being pretty much broken, I suggest you write something as the following.

Don't use capitalized variable names. Only environment variables are capitalized by convention.

Don't use absolute paths for binaries like find, mail etc.

#!/usr/bin/bash
# Create Hourly Cron Job With Clamscan

# Directories to scan
scan_dir="/home/transmission/Downloads"

# Temporary file
list_file=$(mktemp /tmp/clamscan.XXXXXX)

# Location of log file
log_file="/var/log/clamav/hourly_clamscan.log"

# Make list of new files
find "$scan_dir" -type f -mmin -60 -fprint "$list_file"
# Scan files and remove infected
clamscan -i -f "$list_file" --remove > "$log_file"

# If there were infected files detected, send email alert
grep -q "Infected" "$log_file" && mail -s "VIRUS PROBLEM" -r clam@nas.local
exit
| improve this answer | |
  • I used your more legible code. – Royco Oct 14 '14 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.