Skip to content

Commit

Permalink
datasets: flag to disable "write" actions
Browse files Browse the repository at this point in the history
Add a new configuration flag, "datasets.rules.allow-write" to control
if rules can contain "save" or "state" rules which allow write access
to the file system.

Ticket: #6123
  • Loading branch information
jasonish authored and victorjulien committed Jun 14, 2023
1 parent 3f7b7e0 commit 735f5aa
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 0 deletions.
9 changes: 9 additions & 0 deletions src/detect-dataset.c
Original file line number Diff line number Diff line change
Expand Up @@ -302,6 +302,15 @@ static int SetupSavePath(const DetectEngineCtx *de_ctx,
{
SCLogDebug("save %s", save);

int allow_save = 1;
if (ConfGetBool("datasets.rules.allow-write", &allow_save)) {
if (!allow_save) {
SCLogError(SC_ERR_INVALID_SIGNATURE,
"Rules containing save/state datasets have been disabled");
return -1;
}
}

int allow_absolute = 0;
(void)ConfGetBool("datasets.rules.allow-absolute-filenames", &allow_absolute);
if (allow_absolute) {
Expand Down
5 changes: 5 additions & 0 deletions suricata.yaml.in
Original file line number Diff line number Diff line change
Expand Up @@ -1004,6 +1004,11 @@ asn1-max-frames: 256
# # ".." components to reference parent directories in rules that specify
# # their filenames.
# #allow-absolute-filenames: false
#
# # Allow datasets in rules write access for "save" and
# # "state". This is enabled by default, however write access is
# # limited to the data directory.
# #allow-write: true

##############################################################################
##
Expand Down

0 comments on commit 735f5aa

Please sign in to comment.