Clamd Permissions Fix for Debian AppArmor

defaults/main.yml

@@ -1,5 +1,9 @@
 clamav_cron_frequency: weekly
 
+apparmor_clamd_configuration_path: /etc/apparmor.d/usr.sbin.clamd
+apparmor_freshclam_configuration_path: /etc/apparmor.d/usr.bin.freshclam
+apparmor_complain: true
+
 # A dictionary of values to be configured in the clamd and freshclam configuration files.
 # Multivalued keys are specified as lists.
 # A Nonetype value means that the key will be removed from the file.

tasks/main.yml

@@ -16,6 +16,36 @@
     name: "{{ package_names }}"
     state: present
 
+- name: Configure AppArmor for Clamd
+  when: "ansible_apparmor.status == 'enabled' and apparmor_complain"
+  block:
+    - name: Configure clamd in apparmor
+      ansible.builtin.lineinfile:
+        firstmatch: true
+        line: "/usr/sbin/clamd flags=(complain) {"
+        path: "{{ apparmor_clamd_configuration_path }}"
+        search_string: "/usr/sbin/clamd {"
+        state: present
+
+    - name: Configure freshclam in apparmor
+      ansible.builtin.lineinfile:
+        firstmatch: true
+        line: "/usr/bin/freshclam flags=(attach_disconnected,complain) {"
+        path: "{{ apparmor_freshclam_configuration_path }}"
+        search_string: "/usr/bin/freshclam flags=(attach_disconnected) {"
+        state: present
+
+    - name: Reload AppArmor profiles
+      ansible.builtin.service:
+        name: 'apparmor'
+        state: 'reloaded'
+
+- name: Reload AppArmor all profiles
+  ansible.builtin.service:
+    name: 'apparmor'
+    state: 'reloaded'
+
+
 - name: Install virus_scan cron job
   ansible.builtin.template:
     dest: /etc/cron.{{ clamav_cron_frequency }}/virus_scan