From a1c806a944e1e789d42e9be43192d4eec2ba6f98 Mon Sep 17 00:00:00 2001 From: Josh Patterson Date: Tue, 17 Feb 2026 16:26:46 -0500 Subject: [PATCH] fix new sensor install with bpf --- salt/bpf/pcap.map.jinja | 2 +- salt/bpf/suricata.map.jinja | 2 +- salt/bpf/zeek.map.jinja | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/bpf/pcap.map.jinja b/salt/bpf/pcap.map.jinja index 953b01a08..31e4bcaf4 100644 --- a/salt/bpf/pcap.map.jinja +++ b/salt/bpf/pcap.map.jinja @@ -13,7 +13,7 @@ {% endif %} {% if PCAPBPF %} - {% set PCAP_BPF_CALC = salt['cmd.run_all']('/usr/sbin/so-bpf-compile ' ~ GLOBALS.sensor.interface ~ ' ' ~ PCAPBPF|join(" "), cwd='/root') %} + {% set PCAP_BPF_CALC = salt['cmd.script']('salt://common/tools/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + PCAPBPF|join(" "),cwd='/root') %} {% if PCAP_BPF_CALC['retcode'] == 0 %} {% set PCAP_BPF_STATUS = 1 %} {% set STENO_BPF_COMPILED = ",\\\"--filter=" + PCAP_BPF_CALC['stdout'] + "\\\"" %} diff --git a/salt/bpf/suricata.map.jinja b/salt/bpf/suricata.map.jinja index 5ee1e5a92..0fdefd280 100644 --- a/salt/bpf/suricata.map.jinja +++ b/salt/bpf/suricata.map.jinja @@ -9,7 +9,7 @@ {% set SURICATABPF = BPFMERGED.suricata %} {% if SURICATABPF %} - {% set SURICATA_BPF_CALC = salt['cmd.run_all']('/usr/sbin/so-bpf-compile ' ~ GLOBALS.sensor.interface ~ ' ' ~ SURICATABPF|join(" "), cwd='/root') %} + {% set SURICATA_BPF_CALC = salt['cmd.script']('salt://common/tools/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + SURICATABPF|join(" "),cwd='/root') %} {% if SURICATA_BPF_CALC['retcode'] == 0 %} {% set SURICATA_BPF_STATUS = 1 %} {% endif %} diff --git a/salt/bpf/zeek.map.jinja b/salt/bpf/zeek.map.jinja index 789648bdb..ac067bbe8 100644 --- a/salt/bpf/zeek.map.jinja +++ b/salt/bpf/zeek.map.jinja @@ -9,7 +9,7 @@ {% set ZEEKBPF = BPFMERGED.zeek %} {% if ZEEKBPF %} - {% set ZEEK_BPF_CALC = salt['cmd.run_all']('/usr/sbin/so-bpf-compile ' ~ GLOBALS.sensor.interface ~ ' ' ~ ZEEKBPF|join(" "), cwd='/root') %} + {% set ZEEK_BPF_CALC = salt['cmd.script']('salt://common/tools/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + ZEEKBPF|join(" "),cwd='/root') %} {% if ZEEK_BPF_CALC['retcode'] == 0 %} {% set ZEEK_BPF_STATUS = 1 %} {% endif %}