13 Commits

Include renames

Author	SHA1	Message	Date
Josh Patterson	1e86be11b2	FIX: install /usr/sbin management scripts as root ... Salt installed the so-* scripts into /usr/sbin owned by unprivileged service UIDs (939/socore, plus 930-960 per service) at mode 755, while root executes those same files from cron, systemd and state cmd.run. Any file-write primitive as one of those UIDs was therefore root. Two mechanisms behind this are not visible in the diff: file.recurse also manages the destination directory, so /usr/sbin itself was chowned to whichever service UID ran last. A directory's owner may always chmod it, so that UID could replace even the scripts already declared user: root -- so-config-backup, so-suricata-eve-clean, so-nsm-mount-nvme. usr_sbin_perms now pins the directory to root:root 555, the mode the filesystem RPM ships. Omitting user:/group: is a no-op on files that already exist, because check_perms only chowns when a user is named. Explicit user: root is what lets upgraded grids self-heal on the next highstate, and what makes a revert chown back rather than silently do nothing.	2026-09-16 10:34:20 -04:00
m0duspwnens	a74fee4cd0	strelka compiled rules	2024-05-09 11:26:02 -04:00
m0duspwnens	3a99624eb8	seperate manager states for strelka	2024-05-09 10:03:02 -04:00
weslambert	0567b93534	Remove mode	2024-05-08 15:39:59 -04:00
Wes	77e2117051	Account for 0 active rules and change watch	2024-05-08 18:47:52 +00:00
Wes	5aa611302a	Handle YARA rules for distributed deployments	2024-05-06 19:08:01 +00:00
DefensiveDepth	6c6647629c	Refactor yara for compilation	2024-04-18 11:32:17 -04:00
DefensiveDepth	8cc4d2668e	Move compile_yara	2024-04-16 12:52:14 -04:00
Corey Ogburn	858166bcae	WIP: Detections Changes ... Removed some strelka/yara rules from salt. Removed yara scripts for downloading and updating rules. This will be managed by SOC. Added a new compile_yara.py script. Added the strelka repos folder.	2024-01-30 15:43:51 -07:00
Jason Ertel	66bb1272ae	avoid volume sprawl	2023-09-18 13:39:56 -04:00
m0duspwnens	47b2481cdd	nothing in strelka/tools/sbin_jinja to file.recurse	2023-07-10 10:29:19 -04:00
Mike Reeves	b2d2a9f0ed	Rule Updates	2023-05-26 15:16:14 -04:00
m0duspwnens	54c9a3ec71	enable/disable each strelka container in ui	2023-05-10 15:50:07 -04:00