From mboxrd@z Thu Jan 1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 3/3] suricata.yaml: Fix Landlock path settings
Date: Mon, 22 Apr 2024 16:44:00 +0000
Message-ID: <323d35e9-a5ea-4967-8e98-9299aebff868@ipfire.org>
In-Reply-To: <0a12ec92-7119-4c7f-aafc-9257cbec1ff8@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8474649882151959173=="
List-Id: <development.lists.ipfire.org>
--===============8474649882151959173==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Suricata will complain if it cannot read its own configuration file,
hence read-only access to /etc/suricata must be allowed. Since the list
applies to directories, rather than files, restricting read access to
only /usr/share/misc/magic.mgc is not possible; reading /usr/share/misc
must be allowed instead.
Fixes: #13645
Tested-by: Peter Müller <peter.mueller(a)ipfire.org>
Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
config/suricata/suricata.yaml | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
index b57a1d9d4..faa1aa71d 100644
--- a/config/suricata/suricata.yaml
+++ b/config/suricata/suricata.yaml
@@ -775,7 +775,8 @@ security:
# /usr and /etc folders are added to read list to allow
# file magic to be used.
read:
- - /usr/share/misc/magic.mgc
+ - /etc/suricata
+ - /usr/share/misc
- /usr/share/suricata
- /var/ipfire/suricata
- /var/lib/suricata
--
2.35.3
--===============8474649882151959173==--