Debian10 Sophos error message

Hello Linuxa,

a similar problem has been reported in the Server Protection forum.
Perhaps DouglasLeeder has an idea what the cause could be.

Christian

Hi Linuxa,

1) savlog or syslog is likely to give more information about what error happened while scanning the file. It could be the file disappeared while we were attempting to scan it.

2) The lack of translation is probably caused by the locale that the pop-up ended up running in.

Thanks,

Douglas.

Hi Douglas,

in savlog I found following message:

Error occurred while scanning /tmp/.gnome_desktop_thumbnail.0K9Y4Z: 0x3c: Unable to write to talpa socket (Close). (The operation was denied)

I found a lot more messages. All say: Unable to write to talpa socket

Do you have any idea?

Thanks

Linuxa

I think Talpa needs some work to support the kernel version that ships with Debian 10, so it'll not work properly until the next SAV release.

I found some information in the knowledge base: https://community.sophos.com/kb/en-us/117403

I am not an expert to undertsand the details. Is Apparmor the problem or can this be fixed by sophos?

Thanks

Linuxa

That is for a similar error for pid/lock files accessed by ntpd, which has an apparmor profile that allows ntpd to only write to the files, not read them.

I don't think this is related to that, since it's likely that anything in /tmp will be read as well as written.

Debian uses fanotify

www.sophos.com/.../savl_9_cgeng.pdf

debian:/boot$ grep -i fanotify config-4.19.0-5-amd64
CONFIG_FANOTIFY=y
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y

 

so you can use it

/opt/sophos-av/bin/savconfig set PreferFanotify true

 

Everything works fine with Fanotify.

Thanks

Linuxa