Clamd Permissions Fix for Debian AppArmor

defaults/main.yml

@@ -1,5 +1,13 @@
 clamav_cron_frequency: weekly
 
+# Task control to handle an AppArmor/Clamd defect
+# Defect: Defect Notes: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1842695
+# Evidence: This issue is evident by daemon permission errors accessing clamd or freshclam
+#   log files or in AuditD logs "apparmor="DENIED""
+apparmor_clamd_configuration_path: /etc/apparmor.d/usr.sbin.clamd
+apparmor_freshclam_configuration_path: /etc/apparmor.d/usr.bin.freshclam
+apparmor_complain: false
+
 # A dictionary of values to be configured in the clamd and freshclam configuration files.
 # Multivalued keys are specified as lists.
 # A Nonetype value means that the key will be removed from the file.

tasks/main.yml

@@ -16,6 +16,30 @@
     name: "{{ package_names }}"
     state: present
 
+- name: Configure AppArmor for Clamd
+  when: ansible_apparmor.status == "enabled" and apparmor_complain
+  block:
+    - name: Configure clamd in apparmor
+      ansible.builtin.lineinfile:
+        firstmatch: true
+        line: /usr/sbin/clamd flags=(complain) {
+        path: "{{ apparmor_clamd_configuration_path }}"
+        search_string: /usr/sbin/clamd {
+        state: present
+
+    - name: Configure freshclam in apparmor
+      ansible.builtin.lineinfile:
+        firstmatch: true
+        line: "/usr/bin/freshclam flags=(attach_disconnected,complain) {"
+        path: "{{ apparmor_freshclam_configuration_path }}"
+        search_string: "/usr/bin/freshclam flags=(attach_disconnected) {"
+        state: present
+
+    - name: Reload AppArmor profiles
+      ansible.builtin.service:
+        name: apparmor
+        state: reloaded
+
 - name: Install virus_scan cron job
   ansible.builtin.template:
     dest: /etc/cron.{{ clamav_cron_frequency }}/virus_scan