Cannot connect to /tmp/esets.sock:Permission denied

[Nightowl 206]

Hello , I am reading in the logs of the software and I find it that it's trying to connect but it's being denied , can someone explain to me more about it?

18/09/18 09:04:28    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied

17/09/18 19:05:22    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 17:14:17    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 10:37:38    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 10:37:07    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 10:03:39    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 10:03:10    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 10:03:10    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 10:03:08    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 10:03:08    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
17/09/18 09:58:39    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    

I am also getting this sometimes

17/09/18 09:58:11    Media control access    Cannot unblock removable media (org.freedesktop.udisks2.filesystem-mount) 

Thanks in advance.

Edited September 18, 2018 by Rami
More details

[Marcos 5,259]

Please contact your local customer care for help with further troubleshooting. We've seen this error only in connection with Apparmor. Make sure that you don't have other security software installed.

[Nightowl 206]

So you mean I need to contact ESET support desk ? , I have no other security software installed

It's just the ESET and Apparmor is active indeed.

 

Thank you.

[Marcos 5,259]

Apparmor is not supported. It is not necessary to contact customer care because you would get the same response from developers.

[Nightowl 206]

3 minutes ago, Marcos said:

Apparmor is not supported. It is not necessary to contact customer care because you would get the same response from developers.

I see , but not being able to connect to the socket is causing me what trouble? , I can't notice anything wrong with the software itself , it's updating and running fine and also can be able to detect and scan as it should be, I don't think I can disable Apparmor and leave it disabled.

Any suggestions?

[Marcos 5,259]

You can appeal for adding support for Apparmor through your customer care. If there's a demand from users for it, I'm sure that it will be considered provided that there are no technical obstacles.

[Nightowl 206]

19 minutes ago, Marcos said:

You can appeal for adding support for Apparmor through your customer care. If there's a demand from users for it, I'm sure that it will be considered provided that there are no technical obstacles.

Ok I will try to send a feedback requesting support for Apparmor.

Thank you Marcos.

[Nightowl 206]

On 9/18/2018 at 1:55 PM, Marcos said:

You can appeal for adding support for Apparmor through your customer care. If there's a demand from users for it, I'm sure that it will be considered provided that there are no technical obstacles.

Sorry for the double post but unfortunately no one is answering me from the support desk.

Is it not an important problem? not like breaking problem?

I could find this while doing a netstat :

 

unix  2      [ ACC ]     STREAM     LISTENING     30140    @/tmp/esets.sock@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@Marcos

Edited September 24, 2018 by Rami
updated

[Marcos 5,259]

I will notify your local support. It could be that your ticket is treated with a lower priority because of trial license.

[Nightowl 206]

8 minutes ago, Marcos said:

I will notify your local support. It could be that your ticket is treated with a lower priority because of trial license.

I am going to upgrade at the end of the trial license , but I just wanted to try it for Linux before, but I wish there was an IDS protection with it.

Thank you.

[fidelius2 3]

I have used Nod32 for several years and in Xubuntu 18.04 (and previous versions) I also have the same messages. This does not prevent it from updating and working properly, at least I hope it does its job. I have no other sofware protecting my OS. I have a multi boot system, one OS = one Hard Drive. Windows XP, Windows 7 and Xubuntu 18.04. NoD32 installed on each HD.

 

21/11/2018 17:09:20    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
21/11/2018 17:09:00    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
21/11/2018 17:08:54    Media control access    Impossible de débloquer le support amovible (org.freedesktop.udisks2.filesystem-mount)    
21/11/2018 06:58:55    Preload library access control    Cannot connect to /tmp/esets.sock: Permission denied    
21/11/2018 06:58:50    Media control access    Impossible de débloquer le support amovible (org.freedesktop.udisks2.filesystem-mount)   

ETC.....

Edited November 21, 2018 by fidelius2

[Nightowl 206]

I have tried to configure AppArmor to work along ESET , so far I have configured

/opt/eset/esets/lib/libesets_pac.so

AppArmor stopped blocking libesets at the moment , still trying to figure it out with the other messages.

If I succeed I will provide with the workaround.

Okay what is left and what I think now is preventing ESET is that AppArmor is denying cups and dhclient., I think AppArmor is preventing ESET from touching cups and dhclient because they are prevented in AppArmor , I guess I leave them like this.

 

What I have done : 

First of all I did use grep to find out what is being blocked in AppArmor,

grep denied /var/log/kern.log
To checkout what is being blocked

sudo aa-autodep /opt/eset/esets/lib/libesets_pac.so
To add libesets_pac.so to AppArmor in complain mode so it will prompt you with block or allow

And then for prompting of blocking and allowing : 
sudo aa-logprof

You will be prompted 2 times about libesets you need to allow it twice and then save the conf.

You will experience blocks from dhclient/dhcp-helper and cups

As far as I understand , dhclient and cups by default are denied in AppArmor by the default config , so that's why when ESET is trying to connect to them or scan or I don't know exactly it's being blocked

If someone from ESET team could provide more assistance it would be appreciated.

aa-logprof won't prompt you about dhclient,cups because they are in enforced mode not in complain, if it's possible an advice by ESET to know if it's ESET that is trying to access them or not , because in the log the DENIED time is the same as ESET's log

 

ESET is being denied this :
 

apparmor="DENIED" operation="connect" profile="/sbin/dhclient" pid=1231 comm="dhclient" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="

apparmor="DENIED" operation="connect" profile="/usr/lib/NetworkManager/nm-dhcp-helper" pid=2747 comm="nm-dhcp-helper" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect"

 

Edited November 25, 2018 by Rami