diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls
index 11732ad29..17162fb16 100644
--- a/salt/pcap/init.sls
+++ b/salt/pcap/init.sls
@@ -41,7 +41,7 @@ stenoconfdir:
     - makedirs: True
 
 {% if BPF_STENO %}
-   {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', INTERFACE + ' ' + BPF_STENO|join(" ")  ) %}
+   {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', INTERFACE + ' ' + BPF_STENO|join(" "),cwd='/root') %}
    {% if BPF_CALC['stderr'] == "" %}
       {% set BPF_COMPILED =  ",\\\"--filter=" + BPF_CALC['stdout'] + "\\\""  %}
    {% else  %}
diff --git a/salt/suricata/init.sls b/salt/suricata/init.sls
index dcea927ae..da1220e63 100644
--- a/salt/suricata/init.sls
+++ b/salt/suricata/init.sls
@@ -84,7 +84,7 @@ surithresholding:
 
 # BPF compilation and configuration
 {% if BPF_NIDS %}
-   {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', interface + ' ' + BPF_NIDS|join(" ")  ) %}
+   {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', interface + ' ' + BPF_NIDS|join(" "),cwd='/root') %}
    {% if BPF_CALC['stderr'] == "" %}
       {% set BPF_STATUS = 1  %}
    {% else  %}
diff --git a/salt/zeek/init.sls b/salt/zeek/init.sls
index e7124727e..db54bf62e 100644
--- a/salt/zeek/init.sls
+++ b/salt/zeek/init.sls
@@ -95,7 +95,7 @@ plcronscript:
 
 # BPF compilation and configuration
 {% if BPF_ZEEK %}
-   {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', INTERFACE + ' ' + BPF_ZEEK|join(" ")  ) %}
+   {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', INTERFACE + ' ' + BPF_ZEEK|join(" "),cwd='/root') %}
    {% if BPF_CALC['stderr'] == "" %}
        {% set BPF_STATUS = 1  %}
   {% else  %}