Support #1334
closedsudo suricata introduces vulnerabiltiy
Description
I am running Suricata on a SIFT Workstation 3.0 VM for an application security class assignment. According to the basic setup, to test suricata run as:
sudo suricata -c /etc/suricata/suricata.yaml -i wlan0 --init-errors-fatal
If you can own the suricata process, you immediately have root access to the system and can do anything the root user can do. This can be considered a misconfiguration bug.
I tried running without the sudo, and it aborts.
sansforensics@siftworkstation:~$ suricata c /etc/suricata/suricata.yaml -i eth0 04:26:19 - <Notice> - This is Suricata version 2.0.4 RELEASE
9/12/2014 -
9/12/2014 -- 04:26:19 - <Error> - [ERRCODE: SC_ERR_FOPEN(44)] - fopen error opening file "/var/log/suricata//stats.log". Resorting to using the standard output for output
9/12/2014 -- 04:26:25 - <Warning> - [ERRCODE: SC_ERR_FOPEN(44)] - Error opening file: "/etc/suricata//threshold.config": No such file or directory
9/12/2014 -- 04:26:25 - <Error> - [ERRCODE: SC_ERR_FOPEN(44)] - Error opening file: "/var/log/suricata//fast.log": Permission denied
9/12/2014 -- 04:26:25 - <Warning> - [ERRCODE: SC_ERR_NOT_SUPPORTED(225)] - Eve-log support not compiled in. Reconfigure/recompile with libjansson and its development files installed to add eve-log support.
9/12/2014 -- 04:26:25 - <Error> - [ERRCODE: SC_ERR_FOPEN(44)] - failed to open /var/log/suricata//unified2.alert.1418099185: Permission denied
9/12/2014 -- 04:26:25 - <Error> - [ERRCODE: SC_ERR_FOPEN(44)] - Error opening file: "/var/log/suricata//http.log": Permission denied
9/12/2014 -- 04:26:25 - <Error> - [ERRCODE: SC_ERR_PCAP_ACTIVATE_HANDLE(27)] - Couldn't activate the pcap handler, error socket: Operation not permitted
9/12/2014 -- 04:26:25 - <Error> - [ERRCODE: SC_ERR_UNIMPLEMENTED(88)] - Unix socket is not compiled
9/12/2014 -- 04:26:25 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] - thread "RxPcapeth01" closed on initialization.
9/12/2014 -- 04:26:25 - <Error> - [ERRCODE: SC_ERR_INITIALIZATION(45)] - Engine initialization failed, aborting...