Package: snort-rules-default Severity: normal Dear Maintainer,
the snort-rules-default package is currently storing its rules files in /etc/snort/rules, and RULE_PATH in the Snort config is set to this directory as well by default. The /etc directory is meant to hold 'static' files according to FHS section 3.7 [1]. While it is not strongly defined what exactly is meant by the term 'static', one might argue that a frequent updates of the rules files from an external source (e.g. via oinkmaster or pulledpork, which is quite common) might disqualify them as being largely static. As a suitable alternative location, one might think of something along the lines of /var/lib/snort/rules -- FHS states that the contents of /var/lib should reflect a program’s variable internal state while running [2], and the rules may be a special case here (as they change the internal state of Suricata only when loaded or reloaded). It is also stated that the user should never need to modify these files, but I am not sure whether this also includes using a specific automation tool such as oinkmaster or pulledpork for that purpose. Still, this sounds like the best option. Any comments? I am aware that the paths for rules updated via these tools can be tweaked easily, but I'm trying to come up with a solution that would make Snort and Suricata work 'out of the box' with oinkmaster and (an upcoming) pulledpork package. This complements #853154, which raises the same question for Suricata. Cheers Sascha [1] http://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch03s07.html [2] http://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch05s08.html
