[Oisf-devel] Suricata Spec File for openSUSE 11.x

[Steve Grubb]

On Thursday 11 March 2010 09:43:47 am Tedi Heriyanto wrote:
> Last month I've created a Suricata 0.8 RPM spec file for openSUSE 11.x.

I am not trying to jump your thread, but to get suricata to build with modern 
tools you have to do a couple of changes. The current makefiles produce rpath 
issues. Also, you have to disable inline functions under recent gcc.  I 
created a package that is now in rawhide that has the fixes in the spec file. It 
also includes logrotate scripts and an initscript so it can run from system 
boot. You can look at my sources here:

http://cvs.fedoraproject.org/viewvc/rpms/suricata/devel/

Their are still two issues that I think need solving before people start using 
this. One was pointed out by Pierre Chifflier...suricata is not writing out a 
pid file. This is necessary for the daemon to be controlled properly by the 
initscripts. This should be about a 20 line patch. I may send a patch today 
addressing this if no one else does.

The other is that its dissecting malicious packets while running as root. It 
really needs to run under another account and perhaps retain some 
capabilities. I sent a patch for this already, but the discussion trailed 
off...

-Steve