0

Since last friday (October 21st, 2016) a reboot of both 10.6 (Snow Leopard Server) and 10.7 (Lion Server) result in numerous repetitions of the logged error message:

LibClamAV Error: mpool_malloc(): Attempt to allocate 8388608 bytes.

and

WARNING: [LibClamAV] mpool_malloc(): Attempt to allocate 8388608 bytes. Please report to http://bugs.clamav.net Log size = 1048612, max = 1048576 LOGGING DISABLED (Maximal log file size exceeded).

Workaround (not a fix)

After disabling "Server Admin" > "Mail" > "Settings" > "General" > "Filters":

  1. [ ] Enable junk mail filtering
  2. [ ] Enable virus filtering

the error message was gone and the reboots stopped.

Regression

It seems that the ClamAV engine ($ /usr/bin/clamscan --version ... 0.97.8) is too old according to ClamAV.net bug 11647.

How to fix?

How to fix the ClamAV "LibClamAV Error: mpool_malloc(): Attempt to allocate 8388608 bytes" error permanently and having email junk and virus filtering functionality? In other words How to upgrade the built-in clamav scanner of Mac OS X Lion 10.7 server (without installing Xcode on the machine running the outdated ClamAV)?

  • The linked bug description recommends to upgrade the scanner. Did you already try that? – nohillside Oct 27 '16 at 14:33
  • @patrix "How to upgrade the clamav scanner on Mac OS X Lion 10.7 server?" is another way of phrasing my question. There is no upgrade available from Apple. So I am look for a recipe to (hack) upgrade the built-in ClamAV scanner. Note: I am currently stuck at sandboxing, how to edit clamd.sb from a (bash) script. – Pro Backup Oct 27 '16 at 15:13
  • Is upgrading to clamxav.com/download.html an option? Or compiling ClamAV from source? – nohillside Oct 27 '16 at 15:18
  • @patrix Upgrading to clamxav is not an option, because that doesn't fix the built-in clamd. Accidentally enabling built-in clamd or freshclam will make the system crash (reboot loop) again. Compiling from source is an option, though not on that host, only on a separate mac. My current xCode machine runs 10.9.5. Thanks for refining my question. – Pro Backup Oct 27 '16 at 15:21
  • IMHO in one way or the other you will need to upgrade (either clamav or macOS) and/or comile something yourself (and then replace the built-in version). Ruling out these options puts rather strong boundaries on the solution space here. – nohillside Oct 27 '16 at 15:54
1

I ran across this page dealing with the issue on a carefully rebuilt OS X server running 10.6 (I have reasons). The compile-it-yourself answer by Pro Backup is fantastically detailed, but I may have run across a simpler answer, at least in the short term. I noticed another machine I had, also using 10.6 Server, didn't have the issue. Checking the versions of each using /usr/bin/clamscan --version, I saw they were the same engine versions, but different definition versions:

Has the issue

ClamAV 0.97.8/22421/Sun Oct 23 22:58:38 2016
ClamAV 0.97.8/22422/Mon Oct 24 12:02:38 2016

versus

Doesn't have the issue

ClamAV 0.97.8/22470/Wed Nov  2 19:05:24 2016

Manual download clamAV definitions

So, decided to try manually downloading the virus definitions using /usr/bin/freshclam (as sudo). It ran through lots of versions, finishing with 22471. Not yet sure if this will do the trick, but I'm hoping it's on the right track.

  • I can confirm that the manual ClamAV definition update works. Though that still leaves your ClamAV engine at the outdated and no longer signature tested version 0.97. ClamAV announced engine 0.97 End Of Life: June 1, 2016. Quote: signatures may work past June 1st, we are no longer testing that configuration, so you are on your own. – Pro Backup Dec 14 '16 at 15:49
  • Though only updating the definitions is a quick short-therm fix, the root cause is that definitions for this engine will not be tested any longer. Therefore I can't award this answer the accepted answer flag. – Pro Backup Dec 14 '16 at 15:56
0

I had the same issue and disabled mail (we don't use it), the issue seems to have gone away.

I'm thinking ClamAV pushed out a definition or update that was bad. Your best bet is to probably keep filtering disabled for now until they release an update. It might also help to report it to them at http://bugs.clamav.net as requested.

  • Please tell me YOU reported it too? – Maury Markowitz Oct 27 '16 at 16:50
  • @MauryMarkowitz There is not much sense to report, because ClamAV end of life policy states that they will not fix issues in engines older then current (0.99) and one major release generation before that (0.98). Quote: "Currently, every version from ClamAV .97 and down, including all minor versions, are unsupported." – Pro Backup Oct 27 '16 at 23:33
0

Updating Apple's ClamAV on 10.7 (Lion)

The update recipe below requires "Xcode" and "Xcode Command Line Tools" to build software from its source code. The Terminal.app commands below are tested with Mac OS X 10.9.5, Xcode 6.2 in a zsh shell. For details why several choices were made, see "Background" section at the bottom.

Build pcre 8.39

$ cd ~
$ mkdir src
$ cd /tmp && curl -O ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.39.tar.gz && cd -
$ cd src
$ tar zxf /tmp/pcre-8.39.tar.gz && rm /tmp/pcre-8.39.tar.gz
$ cd pcre-8.39
$ ./configure --prefix=/usr/local/pcre
$ make && make check
$ make install DESTDIR=/tmp/pcre
$ rm -r /tmp/pcre/usr/local/pcre/share #remove docs
$ tar czvf ~/pcre-8.39.tgz -C /tmp/pcre --exclude=.DS_Store usr/

Build clamav to overwrite Mac OS X built-in version

$ cd ~/src
$ cd /tmp && curl -LO https://www.clamav.net/downloads/production/clamav-0.99.2.tar.gz && cd -
$ tar zxf /tmp/clamav-0.99.2.tar.gz && rm /tmp/clamav-0.99.2.tar.gz
$ cd clamav-0.99.2

Without -mmacosx-version-min=10.X ClamAV 0.99.2 will be build with compiler code optimizations that do run on the host (10.9) OS X version, but don't work on 10.6 and 10.7.

In case you are not building for running on 10.6.8 or 10.7.5 you might need to change 10.8.0 or 11.4.2 to the output of the command uname -r executed on your (remote) host Mac.

10.6.8

$ CFLAGS="-O3 -march=nocona -mmacosx-version-min=10.6" CXXFLAGS="-O3 -march=nocona -mmacosx-version-min=10.6" ./configure --prefix=/usr --libdir=/usr/lib --with-pcre=/usr/local/pcre --enable-llvm --build=x86_64-apple-darwin`uname -r` --host=x86_64-apple-darwin10.8.0 --sysconfdir=/private/etc
$ CFLAGS="-O3 -march=nocona -mmacosx-version-min=10.6" CXXFLAGS="-O3 -march=nocona -mmacosx-version-min=10.6" make
$ CFLAGS="-O3 -march=nocona -mmacosx-version-min=10.6" CXXFLAGS="-O3 -march=nocona -mmacosx-version-min=10.6" sudo make install DESTDIR=/tmp/clamav-0.99.2 && sudo rm -r /tmp/clamav-0.99.2/{private,usr/include} && sudo chown -R root:wheel /tmp/clamav-0.99.2
$ tar czvf ~/clamav-0.99.2.tgz -C /tmp/clamav-0.99.2 --exclude=.DS_Store usr/

10.7.5

$ CFLAGS="-O3 -march=nocona -mmacosx-version-min=10.7" CXXFLAGS="-O3 -march=nocona -mmacosx-version-min=10.7" ./configure --prefix=/usr --libdir=/usr/lib --with-pcre=/usr/local/pcre --enable-llvm --build=x86_64-apple-darwin`uname -r` --host=x86_64-apple-darwin11.4.2 --sysconfdir=/private/etc
$ CFLAGS="-O3 -march=nocona -mmacosx-version-min=10.7" CXXFLAGS="-O3 -march=nocona -mmacosx-version-min=10.7" make
$ CFLAGS="-O3 -march=nocona -mmacosx-version-min=10.7" CXXFLAGS="-O3 -march=nocona -mmacosx-version-min=10.7" sudo make install DESTDIR=/tmp/clamav-0.99.2 && sudo rm -r /tmp/clamav-0.99.2/{private,usr/include} && sudo chown -R root:wheel /tmp/clamav-0.99.2
$ tar czvf ~/clamav-0.99.2.tgz -C /tmp/clamav-0.99.2 --exclude=.DS_Store usr/

Upload or copy the .tgz files to the remote 10.7 machine

SSH should be enabled on the remote (receiving) host for these example commands to work.

$ scp ~/pcre-8.39.tgz remote.host.tld:/tmp/
$ scp ~/clamav-0.99.2.tgz remote.host.tld:/tmp/

You could also upload the .tgz files to a webserver and download them on the remote host machine(s), for example with this command:

$ cd /tmp && curl -O http://crashplan.probackup.nl/install/mac/pcre-8.39.tgz && cd -
$ cd /tmp && curl -O http://crashplan.probackup.nl/install/mac/clamav-0.99.2.tgz && cd -

Install pcre 8.39 on remote host Mac at /usr/local/pcre

$ sudo tar zxvf /tmp/pcre-8.39.tgz -C /

Optionally create links to pcre executables in /usr/local/bin

$ cd /usr/local/bin && sudo ln -s ../pcre/usr/local/pcre/bin/{pcre-config,pcregrep,pcretest} . && cd -

Install ClamAV 0.99.2 on remote host Mac

$ sudo tar zxvf /tmp/clamav-0.99.2.tgz -C /

Update clamd sandbox configuration (for 10.7)

$ sudo sed -i '' 's#(lib|share)#(lib|share|local/pcre/lib)#' /usr/share/sandbox/clamd.sb
$ grep -q -F '(regex #"^/System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/TrustEvaluationAgent$")' /usr/share/sandbox/clamd.sb || { awk '/\(regex #"\^\/private\/var\/clamav\/"\)/ {print "\t(regex #\"^/System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/TrustEvaluationAgent\$\")"}; {print}' /usr/share/sandbox/clamd.sb > ~/temp-clamd.sb; cat ~/temp-clamd.sb | sudo tee /usr/share/sandbox/clamd.sb > /dev/null; rm ~/temp-clamd.sb; };

Start freshclam daemon

$ sudo /bin/launchctl load -w /System/Library/LaunchDaemons/org.clamav.freshclam.plist

See whether freshclam is updating

$ tail -f /private/var/log/freshclam.log

Press Ctrl + C stop stop displaying the "tail" of the log file.

Or check the database version at the clamd executable:

$ clamd --version
ClamAV 0.99.2/22442/Thu Oct 27 20:03:54 2016

Start clamd daemon

$ sudo /bin/launchctl load -w /System/Library/LaunchDaemons/org.clamav.clamd.plist

Cleanup installer archive files

$ rm /tmp/pcre-8.39.tgz
$ rm /tmp/clamav-0.99.2.tgz

That's it.


Background

Overwrite Apple's clamav

Because the Mac OS X 10.7 ClamAV version 0.97 is so outdated that it breaks the system, I think it is wise to overwrite the built-in ClamAV with a more recent version. Normally this it not recommended because Apple updates would overwrite such a change. The last "Software Update" for 10.7 that Apple released dates back to September 2012 September 24th, 2014. For that reason I don't expect that Apple will release any software update for Lion, ever.

pcre

The current (October 2016) release of ClamAV is 0.99.2. That clamav release has a dependency named "pcre" that wasn't required for running the current failing clamav version 0.97. Therefore some newly required software needs to be installed too. I am not sure where it is better to install that in location /usr or /usr/local. To be one the safer side I choose to not change system software at /usr, thus use the folder /usr/local/pcre.

Seperate built and release machines

For open source it is quite common to built and install the software from source on the same machine. Because the server that runs outdated clamav is a production server, I don't mess with it. Software compilation/building is done on a different Mac box.

Regards

With regards to Wildcard for help building the awk command to insert a new line prepended with tab character to clamd.sb.

You must log in to answer this question.

protected by Community Dec 14 '16 at 19:36

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .