[Rocky]

Hey,

Incoming Work Group in MailScanner.conf is responsible for changing the folder's permission. That permission needs to be so in order for Clamav to have access to scan emails for viruses. Things are pointing towards Clamav being the culprit.

Make sure you have the following settings in /etc/clamav/clamd.conf:

LocalSocket /var/run/clamav/clamd.ctl
LocalSocketGroup clamav
LocalSocketMode 666
User clamav
AllowSupplementaryGroups true
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav

Also, do the following:
usermod -a -G www-data clamav


vi /etc/apparmor.d/usr.sbin.clamd


and add the Incoming folder to the list of folders
/usr/sbin/clamd { #clamav /var/spool/MailScanner/** rw, /var/spool/MailScanner/incoming/** rw, } Reload apparmor:


/etc/init.d/apparmor reload

Let me know how that works out for you.