One morning, after drinking my first cup of coffee at this day I decided to try DAZ. In handbook appeared that was required to run as root, but with the strength given by my breakfast I decided, not I will not. Here you have the result:
I'm one hardened gentoo user so I decided emerge clamav (in case you weren't you must be sure that your clamav is not compiled with –disable-clamuko). Into its configuration file (/etc/clamd.conf) I set this options in (one of them, the interesting one):
User clamav
UM RELATED STUFF
After setting up UM clamav user properly with (as secoff or bofh in my system):
bofh@orion~$rsbac_useradd -m -r -P -i 20 -d /adm/clamav -g 700 -u 700
The user was added with its own password by separation of duties concern.
I proceed to configure AUTH properly:
AUTH RELATED STUFF
bofh@orion~$auth_set_cap FD add /usr/sbin/clamd 0/700 bofh@orion~$auth_set_cap -e FD add /usr/sbin/clamd 0/700 bofh@orion~$auth_set_cap -f FD add /usr/sbin/clamd 0/700
Above commands with -e and -f flags are only required if you have CONFIG_RSBAC_AUTH_DAC_OWNER in you kernel config if not omit them.
Other question you have to keep in mind is that if you enabled CONFIG_RSBAC_AUTH_GROUP you have to add the AUTH capabilities to its group (-G -E -F flags to auth_set_cap).
And then I start granting clamd the privileges required to work (in capabilities):
CAP RELATED STUFF
In my tests, clamd needs CHOWN DAC_READ_SEARCH FOWNER SETGID and SETUID as minimal capabilities. So I grant them as minimal caps:
bofh@orion~$attr_set_file_dir FD /usr/sbin/clamd min_caps CHOWN DAC_READ_SEARCH FOWNER SETGID SETUID
and of course as I granted minimal caps I forbid passing LD environment variables
bofh@orion~$attr_set_file_dir FD /usr/sbin/clamd cap_ld_env 0
RC RELATED STUFF
If you use Role Compatibility module, you should grant required permissions, and create required roles and types. In particular you should grant R to clamav config files, RW to clamav_log file and clamav home dir, and MAP_EXEC and EXECUTE to required libraries. Grant “R” to every type of files that clamav should scan.
Clamav should access to dazuko device, grant it READ READ_WRITE_OPEN READ_OPEN WRITE and WRITE_OPEN and READ_WRITE_OPEN READ_OPEN WRITE_OPEN to common devices (as could be /dev/zero, /dev/null etc…)
It's a good idea to create its own IPC and grant clamav_r CLOSE CREATE READ WRITE LISTEN SEND RECEIVE and MAP_EXEC.
This can be a resume. Adapt number types to suit your needs
*Type creation
bofh@orion~$ rc_set_item TYPE 100 type_fd_name "bindir_t" bofh@orion~$ rc_set_item TYPE 102 type_fd_name "sbindir_t" bofh@orion~$ rc_set_item TYPE 103 type_fd_name "logdir_t" bofh@orion~$ rc_set_item TYPE 104 type_fd_name "devdir_t" bofh@orion~$ rc_set_item TYPE 105 type_fd_name "genusrdatadirt" bofh@orion~$ rc_set_item TYPE 109 type_fd_name "libdir_t" bofh@orion~$ rc_set_item TYPE 113 type_fd_name "varlibdir_t" bofh@orion~$ rc_set_item TYPE 114 type_fd_name "varrundir_t" bofh@orion~$ rc_set_item TYPE 115 type_fd_name "tmpdir_t" bofh@orion~$ rc_set_item TYPE 116 type_fd_name "vartmpdir_t" bofh@orion~$ rc_set_item TYPE 125 type_fd_name "globaletcdir_t" bofh@orion~$ rc_set_item TYPE 135 type_fd_name "usrdir_t" bofh@orion~$ rc_set_item TYPE 200 type_fd_name "clamav_t" bofh@orion~$ rc_set_item TYPE 3 type_dev_name "dazuko" bofh@orion~$ rc_set_item TYPE 4 type_dev_name "tty_t" bofh@orion~$ rc_set_item TYPE 9 type_dev_name "common_t" bofh@orion~$ rc_set_item TYPE 17 type_dev_name "console_t"
PaX RELATED STUFF
In order to get DAZ working you must disable PAX_UDEREF and PAX_USERCOPY options in your kernel config, it must be tested if UDEREF can be changed by some gcc plugin
If you wish to come back: https://www.rsbac.org/wiki/experiences/tazok