Answering myself here... I'm running Suricata as suricata:suricata, and suricata-update is being run as root. So I just need to do this prior to (re)starting/reloading the suricata daemon: chown suricata:suricata /var/lib/suricata/rules Thanks, Vieri