Re: [meta-security][PATCH] clamav: freshclam need bind to run

[Adrian Bunk <bunk@stusta.de>]

On Sun, Apr 07, 2019 at 11:45:18AM +0530, akuster808 wrote:
> 
> 
> On 4/7/19 10:42 AM, Adrian Bunk wrote:
> > On Sun, Apr 07, 2019 at 01:38:38AM +0530, akuster808 wrote:
> >>
> >> On 4/6/19 8:31 PM, Adrian Bunk wrote:
> >>> On Sat, Apr 06, 2019 at 08:15:40PM +0530, Armin Kuster wrote:
> >>>> Add it to the rdepends for that package
> >>>>
> >>>> Signed-off-by: Armin Kuster <akuster808@gmail.com>
> >>>> ---
> >>>>  recipes-security/clamav/clamav_0.99.4.bb | 2 ++
> >>>>  1 file changed, 2 insertions(+)
> >>>>
> >>>> diff --git a/recipes-security/clamav/clamav_0.99.4.bb b/recipes-security/clamav/clamav_0.99.4.bb
> >>>> index 6219d9e..dbe903f 100644
> >>>> --- a/recipes-security/clamav/clamav_0.99.4.bb
> >>>> +++ b/recipes-security/clamav/clamav_0.99.4.bb
> >>>> @@ -152,3 +152,5 @@ RCONFLICTS_${PN} += "${PN}-systemd"
> >>>>  SYSTEMD_SERVICE_${PN} = "${BPN}.service"
> >>>>  
> >>>>  RDEPENDS_${PN} += "openssl ncurses-libncurses libbz2 ncurses-libtinfo clamav-freshclam clamav-libclamav"
> >>>> +
> >>>> +RDEPENDS_freshclam = "bind"
> >>> freshclam depending on a DNS server looks very wrong.
> >> got talk to clamav folks then.
> >>
> >>> What is the actual problem?
> >> ClamAV update process started at Sat Apr  6 14:59:25 2019
> >> WARNING: Can't query current.cvd.clamav.net
> >> WARNING: Invalid DNS reply. Falling back to HTTP mode.
> >> ERROR: Can't get information about database.clamav.net: Temporary failure in name resolution
> >> ERROR: Can't download main.cvd from database.clamav.net
> >> Giving up on database.clamav.net...
> >>
> >> because 
> >>
> >> Use DNS to verify virus database version. Freshclam uses DNS TXT records
> >> to verify database and software versions 
> >>
> >> therefor I am including bind.
> > freshclam needing DNS information makes sense, which means it must be 
> > configured how to access a DNS server.
> >
> > On the local machine you need only DNS client funtionality,
> > just like every user needs for a web browser.
> 
> >
> > Forcing installation of a DNS server is not the correct solution
> > when the actual problem is just a configuration issue on the
> > machine where you were trying it.
> 
> So I can expect a patch to provide such configuration. I would like to
> see how you would solve this.

How are you configuring networking on your device?

> Maybe an FAQ we can add to the layer for this package?

From the error message you gave it is not obvious that there is any
problem that would be specific to this package.

I would guess that DNS configuration is missing or incorrect on your 
device, and that "ping www.google.com" would also fail with a name 
resolution error.

> - armin

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed