Found out from a person not on the mailing list (thank you Christian Prehl!) the issue deals with AppArmor
The line: capability chown, needed to be included in /etc/apparmor.d/usr.sbin.clamd Once that was added and AppArmor restated, clamd came right up. Thanks everyone for your thoughts! Keith -----Original Message----- From: Michael Orlitzky <mich...@orlitzky.com> Sent: Saturday, April 24, 2021 9:52 AM To: clamav-users@lists.clamav.net Subject: Re: [clamav-users] Can't start clamd - lchown to user failed On Sat, 2021-04-24 at 13:46 +0000, Keith Graber wrote: > I'm running ClamAV as user 'clamav' who owns /var/log/clamav Clamd probably expects to be run as root if it's trying to use lchown(). Have you tried the --foreground flag? In any case, you will save yourself a lot of trouble if you just log to syslog and then tweak your syslog config file to put clamav entries under /var/log/clamav. Trusting users, developers, distributions, and init scripts to all agree on the permission scheme for /var/log has failed. _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
