Imunify360 PermissionError (Python Traceback)

[hassan.draga]

In our server (CentOS7 & WHM/cPanel) we try to scan uploaded files using Imunify360, its working fine using root user privileges, but using normal user we get this python Traceback:

/usr/bin/imunify-antivirus malware on-demand start --path /home/foo/public_html/upload/test.pdf

> Traceback (most recent call last):
> File "/usr/bin/imunify-antivirus", line 11, in <module>
> load_entry_point(imunify-antivirus==1.0, console_scripts, imunify-antivirus)()
> File "/opt/alt/python38/lib/python3.8/site-packages/pkg_resources/__init__.py", line 489, in load_entry_point
> return get_distribution(dist).load_entry_point(group, name)
> File "/opt/alt/python38/lib/python3.8/site-packages/pkg_resources/__init__.py", line 2852, in load_entry_point
> return ep.load()
> File "/opt/alt/python38/lib/python3.8/site-packages/pkg_resources/__init__.py", line 2443, in load
> return self.resolve()
> File "/opt/alt/python38/lib/python3.8/site-packages/pkg_resources/__init__.py", line 2449, in resolve
> module = __import__(self.module_name, fromlist=[__name__], level=0)
> File "/opt/alt/python38/lib/python3.8/site-packages/defence360agent/cli.py", line 23, in <module>
> from defence360agent import defence360, rpc_handlers
> File "/opt/alt/python38/lib/python3.8/site-packages/defence360agent/rpc_handlers.py", line 32, in <module>
> from defence360agent.malwarelib.rpc.endpoints.base import (
> File "/opt/alt/python38/lib/python3.8/site-packages/defence360agent/malwarelib/rpc/endpoints/__init__.py", line 22, in <module>
> from . import base
> File "/opt/alt/python38/lib/python3.8/site-packages/defence360agent/malwarelib/rpc/endpoints/base.py", line 51, in <module>
> from defence360agent.malwarelib.plugins.scan_queue import QueueSupervisorSync
> File "/opt/alt/python38/lib/python3.8/site-packages/defence360agent/malwarelib/plugins/scan_queue.py", line 65, in <module>
> class QueueSupervisorSync:
> File "/opt/alt/python38/lib/python3.8/site-packages/defence360agent/malwarelib/plugins/scan_queue.py", line 66, in QueueSupervisorSync
> queue = ScanQueue()
> File "/opt/alt/python38/lib/python3.8/site-packages/defence360agent/malwarelib/scan/queue.py", line 201, in __init__
> self._scans: Deque[QueuedScan] = unserialize(
> File "/opt/alt/python38/lib/python3.8/site-packages/defence360agent/utils/serialization.py", line 76, in unserialize
> with open(path, "rb") as r:
> PermissionError: [Errno 13] Permission denied: /var/imunify360/aibolit/scans.pickle

My question is how to scan a file using non sudo users?

[hassan.draga]

10709204285 Thank you for your response, we are interested in CLI, can we scan a file using non root user? I saw you links and I did as root :

# imunify-antivirus config update {"PERMISSIONS": {"allow_malware_scan": true}}

Output

> {ADMIN_CONTACTS: {emails: []}, AUTO_WHITELIST: {after_unblock_timeout: 1440, timeout: 1440}, BACKUP_RESTORE: {cl_backup_allowed: True, cl_on_premise_backup_allowed: False, max_days_in_backup: 90}, BLOCKED_PORTS: {default_mode: allowed}, CAPTCHA: {cert_refresh_timeout: 3600}, CAPTCHA_DOS: {enabled: True, max_count: 100, time_frame: 21600, timeout: 864000}, CSF_INTEGRATION: {catch_lfd_events: False}, DOS: {default_limit: 250, enabled: False, interval: 30, port_limits: {}}, ERROR_REPORTING: {enable: True}, FIREWALL: {TCP_IN_IPv4: [20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 2077-2080, 2082-2083, 2086-2087, 2095, 2096], TCP_OUT_IPv4: [20, 21, 22, 25, 37, 43, 53, 80, 110, 113, 443, 587, 873, 993, 995, 2073, 2086-2087, 2089, 2195, 2703, 6277, 24441], UDP_IN_IPv4: [20, 21, 53, 443], UDP_OUT_IPv4: [20, 21, 53, 113, 123, 873, 6277, 24441], port_blocking_mode: ALLOW}, INCIDENT_LOGGING: {limit: 100000, min_log_level: 4, num_days: 100, ui_autorefresh_timeout: 10}, KERNELCARE: {edf: False}, LOGGER: {backup_count: 5, max_log_file_size: 62914560}, MALWARE_CLEANUP: {keep_original_files_days: 14, trim_file_instead_of_removal: True}, MALWARE_SCANNING: {cloud_assisted_scan: True, default_action: notify, detect_elf: True, enable_scan_inotify: False, enable_scan_modsec: True, enable_scan_pure_ftpd: True, max_cloudscan_size_to_scan: 10485760, max_mrs_upload_file: 10485760, max_signature_size_to_scan: 1048576, notify_on_detect: False, optimize_realtime_scan: True, rapid_scan: True, rapid_scan_rescan_unchanging_files_frequency: None, scan_modified_files: None, sends_file_for_analysis: True, try_restore_from_backup_first: False}, MALWARE_SCAN_INTENSITY: {cpu: 2, io: 2, ram: 2048, user_scan_cpu: 2, user_scan_io: 2, user_scan_ram: 1024}, MALWARE_SCAN_SCHEDULE: {day_of_month: 8, day_of_week: 0, hour: 3, interval: month}, MOD_SEC: {app_specific_ruleset: True, cms_account_compromise_prevention: False, prev_settings: , ruleset: FULL}, MOD_SEC_BLOCK_BY_CUSTOM_RULE: {33332: {check_period: 120, max_incidents: 10}, 33339: {check_period: 120, max_incidents: 10}}, MOD_SEC_BLOCK_BY_SEVERITY: {check_period: 120, denied_num_limit: 2, enable: True, max_incidents: 2, severity_limit: 2}, NETWORK_INTERFACE: {eth6_device: None, eth_device: None, eth_device_skip: []}, OSSEC: {active_response: False}, PAM: {enable: False, exim_dovecot_protection: False, ftp_protection: False}, PERMISSIONS: {advisor: True, allow_malware_scan: True, support_form: True, upgrade_button: True, user_ignore_list: True}, PROACTIVE_DEFENCE: {blamer: True, mode: LOG, php_immunity: False}, RESOURCE_MANAGEMENT: {cpu_limit: 2, io_limit: 2, ram_limit: 500}, SEND_ADDITIONAL_DATA: {enable: True}, SMTP_BLOCKING: {allow_groups: [mail], allow_local: False, allow_users: [], enable: False, ports: [25, 587, 465], redirect: False}, STOP_MANAGING: {modsec_directives: False}, WEBSHIELD: {captcha_secret_key: , captcha_site_key: , enable: True, known_proxies_support: True, splash_screen: False}, WEB_SERVICES: {http_ports: [], https_ports: []}}

Thank you