FIX: pip install wheels from a root-owned directory

Root ran `pip install --find-links` against directories under /opt/so/conf, which is 939:939 mode 770. Hardening those directories would not have helped: renaming an entry requires write permission on the parent, not on the entry, so uid 939 could move the wheel tree aside and substitute its own between the file.recurse that populates it and the pip install that reads it. clean: True plus the onchanges requisite narrowed that to a race rather than a straight win, but the window is real and the install runs as root. Move both wheel trees to /opt/saltstack, which is created by the salt package and is root-owned, and state the ownership explicitly rather than relying on the files being new: /opt/so/conf/salt/module_packages/docker -> /opt/saltstack/module_packages/docker /opt/so/conf/libvirt/source-packages/libvirt-python -> /opt/saltstack/source-packages/libvirt-python salt.python_modules is included by salt/salt/minion/init.sls, so the docker wheels are staged on every minion in the grid, not just the manager. Upgraded installs keep a now-unused wheel tree in the old socore-writable location, so remove it -- nothing reads it after this change, but leaving a writable staging directory behind serves no purpose.
Merge pull request #16247 from Security-Onion-Solutions/esql-fixes
2026-09-30 19:47:17 +02:00 · 2026-09-17 12:43:37 -04:00 · 2026-09-17 09:56:19 -04:00 · 2026-09-17 09:44:47 -04:00 · 2026-09-17 09:43:44 -04:00 · 2026-09-17 09:42:27 -04:00
43 changed files with 427 additions and 112 deletions
@@ -1,17 +1,17 @@
-### 3.3.0-20260908 ISO image released on 2026/09/08
+### 3.3.0-20260911 ISO image released on 2026/09/11


 ### Download and Verify

-3.3.0-20260908 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260908.iso
+3.3.0-20260911 ISO image:  
+https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso
 
-MD5: 5A2C42D0083F2D7B4DC2178C30EBC05F  
-SHA1: 505220A8A3315AFEE601C13772996018425CCD29  
-SHA256: 6EB8401296A1D051FEC558C520D2D4AB1912A72D351A2426FBF8C87FEE2BA844  
+MD5: 12B18433D3A2198A185892FF79CF638F  
+SHA1: 2B3C2E1FA7A78ED1F956E7EDCC12E32593C14EEE  
+SHA256: 0938C73B76CE30EC9E4394D312C79EA7CAC721B6818541697279A6221F7D870D  

 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260908.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig

 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS  
@@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/

 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260908.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig
 ```

 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260908.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso
 ```

 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-3.3.0-20260908.iso.sig securityonion-3.3.0-20260908.iso
+gpg --verify securityonion-3.3.0-20260911.iso.sig securityonion-3.3.0-20260911.iso
 ```

 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Tue 08 Sep 2026 10:07:12 AM EDT using RSA key ID FE507013
+gpg: Signature made Fri 11 Sep 2026 11:23:56 AM EDT using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
@@ -117,14 +117,25 @@ elastic_curl_config:
 {% endif %}


+# A non-root owner here can chmod the directory and replace any script in it, including
+# the root-owned ones. 555 is the mode the filesystem RPM ships; root ignores it anyway.
+usr_sbin_perms:
+  file.directory:
+    - name: /usr/sbin
+    - user: root
+    - group: root
+    - mode: 555
+
 common_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://common/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755
    - show_changes: False
+    - require:
+      - file: usr_sbin_perms
 {% if GLOBALS.role == 'so-heavynode' %}
    - exclude_pat:
      - so-pcap-import
@@ -159,8 +170,8 @@ common_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://common/tools/sbin_jinja
-    - user: 939
-    - group: 939 
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja
    - show_changes: False
@@ -173,6 +184,8 @@ so-status_script:
  file.managed:
    - name: /usr/sbin/so-status
    - source: salt://common/tools/sbin/so-status
+    - user: root
+    - group: root
    - mode: 755

 {% if GLOBALS.is_sensor %}
@@ -18,47 +18,61 @@ copy_so-common_common_tools_sbin:
    - name: /opt/so/saltstack/default/salt/common/tools/sbin/so-common
    - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-common
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_so-image-common_common_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/common/tools/sbin/so-image-common
    - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-image-common
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_soup_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/manager/tools/sbin/soup
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/soup
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_so-firewall_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-firewall
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-firewall
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_so-yaml_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-yaml.py
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-yaml.py
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_so-repo-sync_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-repo-sync
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-repo-sync
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_bootstrap-salt_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/salt/scripts/bootstrap-salt.sh
    - source: {{UPDATE_DIR}}/salt/salt/scripts/bootstrap-salt.sh
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 644

 # This section is used to put the new script in place so that it can be called during soup.
 # It is faster than calling the states that normally manage them to put them in place.
@@ -67,46 +81,60 @@ copy_so-common_sbin:
    - name: /usr/sbin/so-common
    - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-common
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_so-image-common_sbin:
  file.copy:
    - name: /usr/sbin/so-image-common
    - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-image-common
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_soup_sbin:
  file.copy:
    - name: /usr/sbin/soup
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/soup
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_so-firewall_sbin:
  file.copy:
    - name: /usr/sbin/so-firewall
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-firewall
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_so-yaml_sbin:
  file.copy:
    - name: /usr/sbin/so-yaml.py
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-yaml.py
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_so-repo-sync_sbin:
  file.copy:
    - name: /usr/sbin/so-repo-sync
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-repo-sync
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755

 copy_bootstrap-salt_sbin:
  file.copy:
    - name: /usr/sbin/bootstrap-salt.sh
    - source: {{UPDATE_DIR}}/salt/salt/scripts/bootstrap-salt.sh
    - force: True
-    - preserve: True
+    - user: root
+    - group: root
+    - mode: 755
@@ -240,7 +240,8 @@ copy_new_files() {
  cd $UPDATE_DIR
  rsync -a salt $DEFAULT_SALT_DIR/ --delete "${EXCLUDE_ARGS[@]}"
  rsync -a pillar $DEFAULT_SALT_DIR/ --delete "${EXCLUDE_ARGS[@]}"
-  chown -R socore:socore $DEFAULT_SALT_DIR/
+  # Root-executed code; SOC only needs to read it. Local dirs stay socore-owned.
+  chown -R root:root $DEFAULT_SALT_DIR/
  cd /tmp
 }

@@ -33,8 +33,8 @@ elastalert_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elastalert/tools/sbin
-    - user: 933
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #elastalert_sbin_jinja:
@@ -39,8 +39,8 @@ elasticagent_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticagent/tools/sbin_jinja
-    - user: 949
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja

@@ -31,8 +31,8 @@ elasticfleet_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticfleet/tools/sbin
-    - user: 947
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755
    - show_changes: False

@@ -40,8 +40,8 @@ elasticfleet_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticfleet/tools/sbin_jinja
-    - user: 947
-    - group: 939 
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja
    - exclude_pat:
@@ -81,8 +81,8 @@ eapackageupgrade:
  file.managed:
    - name: /usr/sbin/so-elastic-fleet-package-upgrade
    - source: salt://elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade
-    - user: 947
-    - group: 939
+    - user: root
+    - group: root
    - mode: 755
    - template: jinja

@@ -14,8 +14,8 @@ so-elastic-agent-install:
  file.managed:
    - name: /usr/sbin/so-elastic-agent-install
    - source: salt://elasticfleet/tools/sbin/so-elastic-agent-install
-    - user: 947
-    - group: 939
+    - user: root
+    - group: root
    - mode: 755
    - show_changes: False

@@ -37,8 +37,8 @@ elasticsearch_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticsearch/tools/sbin
-    - user: 930
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755
    - exclude_pat:
      - so-elasticsearch-pipelines # exclude this because we need to watch it for changes, we sync it in another state
@@ -49,8 +49,8 @@ so-elasticsearch-system-indices-patch-script:
  file.managed:
    - name: /usr/sbin/so-elasticsearch-system-indices-patch
    - source: salt://elasticsearch/tools/sbin/so-elasticsearch-system-indices-patch
-    - user: 930
-    - group: 939
+    - user: root
+    - group: root
    - mode: 755
    - show_changes: False

@@ -58,8 +58,8 @@ elasticsearch_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticsearch/tools/sbin_jinja
-    - user: 939
-    - group: 939 
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja
    - exclude_pat:
@@ -72,8 +72,8 @@ so-elasticsearch-ilm-policy-load-script:
  file.managed:
    - name: /usr/sbin/so-elasticsearch-ilm-policy-load
    - source: salt://elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load
-    - user: 930
-    - group: 939
+    - user: root
+    - group: root
    - mode: 754
    - template: jinja
    - defaults:
@@ -84,8 +84,8 @@ so-elasticsearch-pipelines-script:
  file.managed:
    - name: /usr/sbin/so-elasticsearch-pipelines
    - source: salt://elasticsearch/tools/sbin/so-elasticsearch-pipelines
-    - user: 930
-    - group: 939
+    - user: root
+    - group: root
    - mode: 754
    - show_changes: False

@@ -5,7 +5,8 @@
    { "rename": 	{ "field": "message2.proto", 			"target_field": "network.transport",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fileinfo.filename", 	"target_field": "file.name",		"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.fileinfo.gaps", 		"target_field": "file.bytes.missing",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.fileinfo.gaps", 		"target_field": "suricata.fileinfo.gaps",	"ignore_missing": true 	} },
+    { "set":		{ "if": "ctx.suricata?.fileinfo?.gaps == false", 	"field": "file.bytes.missing",	"value": 0 		} },
    { "rename": 	{ "field": "message2.fileinfo.magic", 		"target_field": "file.mime_type",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fileinfo.md5", 		"target_field": "hash.md5",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fileinfo.sha1", 		"target_field": "hash.sha1",		"ignore_missing": true 	} },
@@ -21,12 +21,16 @@ hypervisor_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://hypervisor/tools/sbin
+    - user: root
+    - group: root
    - file_mode: 744

 hypervisor_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://hypervisor/tools/sbin_jinja
+    - user: root
+    - group: root
    - template: jinja
    - file_mode: 744

@@ -86,8 +86,8 @@ idh_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://idh/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #idh_sbin_jinja:
@@ -41,8 +41,8 @@ influxdb_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://influxdb/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #influxdb_sbin_jinja:
@@ -30,16 +30,16 @@ kafka_sbin_tools:
  file.recurse:
    - name: /usr/sbin
    - source: salt://kafka/tools/sbin
-    - user: 960
-    - group: 960
+    - user: root
+    - group: root
    - file_mode: 755

 kafka_sbin_jinja_tools:
  file.recurse:
    - name: /usr/sbin
    - source: salt://kafka/tools/sbin_jinja
-    - user: 960
-    - group: 960
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja
    - defaults:
@@ -36,16 +36,16 @@ kibana_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://kibana/tools/sbin
-    - user: 932
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 kibana_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://kibana/tools/sbin_jinja
-    - user: 932
-    - group: 939 
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja
    - defaults:
@@ -6,6 +6,8 @@ so-fix-salt-ldap_script:
  file.managed:
    - name: /usr/sbin/so-fix-salt-ldap.py
    - source: salt://libvirt/64962/scripts/so-fix-salt-ldap.py
+    - user: root
+    - group: root
    - mode: 744

 fix-salt-ldap:
@@ -29,16 +29,27 @@ install_libvirt-libs:
  pkg.installed:
    - name: libvirt-libs

+# Root pip-installs these below, so they cannot live under /opt/so/conf (939:939 mode 770):
+# write permission on that directory lets uid 939 swap the tree between this state and the
+# install. /opt/saltstack is root-owned, so the same trick does not work there.
 libvirt_python_wheel:
  file.recurse:
-    - name: /opt/so/conf/libvirt/source-packages/libvirt-python
+    - name: /opt/saltstack/source-packages/libvirt-python
    - source: salt://libvirt/source-packages/libvirt-python
+    - user: root
+    - group: root
+    - dir_mode: 755
+    - file_mode: 644
    - makedirs: True
    - clean: True

+old_libvirt_python_wheel:
+  file.absent:
+    - name: /opt/so/conf/libvirt/source-packages
+
 libvirt_python_module:
  cmd.run:
-    - name: /opt/saltstack/salt/bin/python3 -m pip install --no-index --find-links=/opt/so/conf/libvirt/source-packages/libvirt-python libvirt-python
+    - name: /opt/saltstack/salt/bin/python3 -m pip install --no-index --find-links=/opt/saltstack/source-packages/libvirt-python libvirt-python
    - onchanges:
      - file: libvirt_python_wheel

@@ -40,8 +40,8 @@ logstash_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://logstash/tools/sbin
-    - user: 931
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #logstash_sbin_jinja:
@@ -113,8 +113,8 @@ manager_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://manager/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755
    - exclude_pat:
      - "*_test.py"
@@ -124,8 +124,8 @@ manager_sbin_jinja:
  file.recurse:
    - name: /usr/sbin/
    - source: salt://manager/tools/sbin_jinja/
-    - user: socore
-    - group: socore
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja
    - show_changes: False
@@ -190,11 +190,15 @@ so_fleetagent_monitor:
  - month: '*'
  - dayweek: '*'

-socore_own_saltstack_default:
+# This tree is the source of every root-executed script (/usr/sbin, reactors, _runners,
+# engines, salt-relay.sh). SOC mounts /opt/so/saltstack rw as uid 939 but only writes
+# under local/. Do not add dir_mode/file_mode here -- SOC reads default/ and 750/640
+# would break its config load.
+root_own_saltstack_default:
  file.directory:
    - name: /opt/so/saltstack/default
-    - user: socore
-    - group: socore
+    - user: root
+    - group: root
    - recurse:
      - user
      - group
@@ -121,8 +121,14 @@ for i in "$@"; do
 	esac
 done

-PILLARFILE=/opt/so/saltstack/local/pillar/minions/$MINION_ID.sls
-ADVPILLARFILE=/opt/so/saltstack/local/pillar/minions/adv_$MINION_ID.sls
+if [[ -n "$MINION_ID" && ! "$MINION_ID" =~ ^[A-Za-z0-9._-]{1,253}$ ]]; then
+	echo "Invalid minion id: $MINION_ID"
+	log "ERROR" "Invalid minion id: $MINION_ID"
+	exit 1
+fi
+
+readonly PILLARFILE=/opt/so/saltstack/local/pillar/minions/$MINION_ID.sls
+readonly ADVPILLARFILE=/opt/so/saltstack/local/pillar/minions/adv_$MINION_ID.sls

 function getinstallinfo() {
 	log "INFO" "Getting install info for minion $MINION_ID"
@@ -133,10 +139,23 @@ function getinstallinfo() {
 		return 1
 	fi

-	while read -r var; do export "$var"; done <<< "$INSTALLVARS"
-	if [ $? -ne 0 ]; then
-		log "ERROR" "Failed to source install variables"
-		return 1
+	# install.txt is controlled by the minion; only accept known keys and never eval or export them
+	local line key
+	while IFS= read -r line; do
+		[[ "$line" == *=* ]] || continue
+		key=${line%%=*}
+		case "$key" in
+			MAINIP|MNIC|NODE_DESCRIPTION|ES_HEAP_SIZE|PATCHSCHEDULENAME|INTERFACE|NODETYPE|CORECOUNT|LSHOSTNAME|LSHEAP|CPUCORES|IDH_MGTRESTRICT|IDH_SERVICES)
+				printf -v "$key" '%s' "${line#*=}"
+				;;
+			*)
+				log "WARN" "Ignoring unexpected install var from $MINION_ID: ${key:0:64}"
+				;;
+		esac
+	done <<< "$INSTALLVARS"
+
+	if [[ "$NODE_DESCRIPTION" == \'*\' ]]; then
+		NODE_DESCRIPTION=${NODE_DESCRIPTION:1:-1}
 	fi

 	log "INFO" "Fetched install info for $MINION_ID (node type: ${NODETYPE:-unset})"
@@ -176,6 +195,12 @@ function pcapspace() {
 		fi
 	fi

+	# Must be checked before arithmetic expansion, which evaluates array subscripts
+	if [[ ! "$SPACESIZE" =~ ^[0-9]+$ ]]; then
+		log "ERROR" "Invalid disk size for $MINION_ID: ${SPACESIZE:0:64}"
+		return 1
+	fi
+
 	local s=$(( $SPACESIZE / 1000000 ))
 	local s1=$(( $s / 4 * $PCAP_PERCENTAGE ))

@@ -1050,6 +1075,57 @@ function updateMineAndApplyStates() {
 	fi
 }

+# Values end up in a Jinja-rendered pillar and in bash, and may come from the minion
+function validate_minion_vars() {
+	local error_msg=""
+	# Inline rather than valid_ip4: so-common is not installed yet when setup runs -o=setup
+	local octet='(25[0-5]|2[0-4][0-9]|1?[0-9]?[0-9])'
+	local ip4_re="^($octet\.){3}$octet$"
+
+	case "$NODETYPE" in
+		EVAL|STANDALONE|MANAGER|MANAGERSEARCH|MANAGERHYPE|IMPORT)
+			# Manager pillars also rewrite the CA pillar, so never accept them from a remote node
+			[[ "$OPERATION" == "setup" ]] || error_msg="Node type $NODETYPE can only be configured during setup"
+			;;
+		FLEET|IDH|HEAVYNODE|SENSOR|SEARCHNODE|RECEIVER|HYPERVISOR|DESKTOP)
+			;;
+		*)
+			error_msg="Invalid node type: ${NODETYPE:0:64}"
+			;;
+	esac
+
+	if [[ -z "$error_msg" ]]; then
+		if [[ ! "$MAINIP" =~ $ip4_re ]]; then
+			error_msg="Invalid MAINIP: ${MAINIP:0:64}"
+		elif [[ ! "$MNIC" =~ ^[A-Za-z0-9._-]*$ ]]; then
+			error_msg="Invalid MNIC: ${MNIC:0:64}"
+		elif [[ ! "$INTERFACE" =~ ^[A-Za-z0-9._-]*$ ]]; then
+			error_msg="Invalid INTERFACE: ${INTERFACE:0:64}"
+		elif [[ ! "$LSHOSTNAME" =~ ^[A-Za-z0-9._-]*$ ]]; then
+			error_msg="Invalid LSHOSTNAME: ${LSHOSTNAME:0:64}"
+		elif [[ ! "$ES_HEAP_SIZE" =~ ^([0-9]+[kKmMgG]?)?$ ]]; then
+			error_msg="Invalid ES_HEAP_SIZE: ${ES_HEAP_SIZE:0:64}"
+		elif [[ ! "$LSHEAP" =~ ^([0-9]+[kKmMgG]?)?$ ]]; then
+			error_msg="Invalid LSHEAP: ${LSHEAP:0:64}"
+		elif [[ ! "$CORECOUNT" =~ ^[0-9]*$ ]]; then
+			error_msg="Invalid CORECOUNT: ${CORECOUNT:0:64}"
+		elif [[ ! "$CPUCORES" =~ ^[0-9]*$ ]]; then
+			error_msg="Invalid CPUCORES: ${CPUCORES:0:64}"
+		elif [[ ! "$IDH_MGTRESTRICT" =~ ^(True|False)?$ ]]; then
+			error_msg="Invalid IDH_MGTRESTRICT: ${IDH_MGTRESTRICT:0:64}"
+		fi
+	fi
+
+	if [[ -n "$error_msg" ]]; then
+		log "ERROR" "$error_msg"
+		echo "$error_msg"
+		return 1
+	fi
+
+	# Free text; removing braces is enough to prevent any Jinja delimiter
+	NODE_DESCRIPTION=${NODE_DESCRIPTION//[\{\}[:cntrl:]]/}
+}
+
 function setupMinionFiles() {
 	log "INFO" "Setting up minion files for $MINION_ID (pillar: $PILLARFILE)"
 	
@@ -1061,6 +1137,8 @@ function setupMinionFiles() {
 		return 1
 	fi

+	validate_minion_vars || return 1
+
 	# Create the base minion files
 	create_minion_files || return 1

@@ -124,8 +124,8 @@ copy_new_files() {
  
  rsync -a salt $default_salt_dir/
  rsync -a pillar $default_salt_dir/
-  chown -R socore:socore $default_salt_dir/salt
-  chown -R socore:socore $default_salt_dir/pillar
+  chown -R root:root $default_salt_dir/salt
+  chown -R root:root $default_salt_dir/pillar
  chmod 755 $default_salt_dir/pillar/firewall/addfirewall.sh

  rm -rf /tmp/sogh
@@ -120,6 +120,9 @@ check_err() {
      161)
        echo 'Required intermediate Elasticsearch upgrade not complete'
      ;;
+      162)
+        echo 'One or more Elastic Agent nodes do not support the x86-64-v3 CPU instruction set'
+      ;;
      170)
        echo "Intermediate upgrade completed successfully to $next_step_so_version, but next soup to Security Onion $originally_requested_so_version could not be started automatically."
        echo "Start soup again manually to continue the upgrade to Security Onion $originally_requested_so_version."
@@ -347,6 +350,83 @@ check_cluster_health() {
  exit 0
 }

+no_soup_for_you() {
+  echo ""
+  echo "No soup for you!"
+  exit 162
+}
+
+check_cpu_compatibility() {
+  # Roles running a container built from the so-elastic-agent image; mirrors the
+  # elasticagent and elasticfleet entries in salt/reactor/pillar_push_map.yaml.
+  local cpu_target='G@role:so-heavynode or G@role:so-eval or G@role:so-fleet or G@role:so-import or G@role:so-manager or G@role:so-managerhype or G@role:so-managersearch or G@role:so-standalone'
+  local expected_nodes cpu_results node result confirm
+  local -a unsupported=() offline=()
+
+  echo "Checking that Elastic Agent nodes support the x86-64-v3 CPU instruction set now required by Elastic."
+
+  if [[ "$SKIP_CPU_CHECK" == "true" ]]; then
+    printf "\nSkipping the x86-64-v3 CPU check because --skip-cpu-check was specified.\n\n"
+    return
+  fi
+
+  # Nodes that never answer are absent from the results, so diff against who should have.
+  expected_nodes=$(salt -C "$cpu_target" --preview-target --out=json 2>/dev/null | jq -r '.[]?') || true
+  if [[ -z "$expected_nodes" ]]; then
+    printf "\nCould not determine which nodes run the Elastic Agent, so the x86-64-v3 CPU check cannot run.\n"
+    no_soup_for_you
+  fi
+
+  cpu_results=$(salt -t 30 -C "$cpu_target" cmd.run "/lib64/ld-linux-x86-64.so.2 --help | grep x86-64-v3" --out=json 2>/dev/null) || true
+
+  while IFS= read -r node; do
+    [[ -z "$node" ]] && continue
+    result=$(jq -r --arg node "$node" '.[$node] // empty' <<< "$cpu_results" 2>/dev/null)
+    if [[ -z "$result" || "$result" == *"did not return"* ]]; then
+      offline+=("$node")
+    elif [[ "$result" != *"x86-64-v3 (supported"* ]]; then
+      # glibc appends "(supported, searched)" only when supported; the open paren keeps
+      # this from matching a future "(unsupported".
+      unsupported+=("$node")
+    fi
+  done <<< "$expected_nodes"
+
+  if [[ ${#unsupported[@]} -eq 0 && ${#offline[@]} -eq 0 ]]; then
+    printf "\nAll Elastic Agent nodes support x86-64-v3. We can proceed with SOUP.\n\n"
+    return
+  fi
+
+  echo ""
+  if [[ ${#unsupported[@]} -gt 0 ]]; then
+    echo "The following node(s) do NOT support the x86-64-v3 CPU instruction set:"
+    printf '  %s\n' "${unsupported[@]}"
+    echo ""
+    echo "Upstream Elastic now builds its binaries for x86-64-v3, so these nodes can no"
+    echo "longer run Elastic. Upgrading them WILL BREAK them."
+    echo ""
+  fi
+  if [[ ${#offline[@]} -gt 0 ]]; then
+    echo "The following node(s) did not respond and could not be checked:"
+    printf '  %s\n' "${offline[@]}"
+    echo ""
+    echo "These nodes are offline, so we cannot confirm they support x86-64-v3, which"
+    echo "upstream Elastic now requires."
+    echo ""
+  fi
+
+  if [[ -n $UNATTENDED ]]; then
+    echo "Unattended mode cannot prompt for an override. Re-run soup interactively, or pass --skip-cpu-check to bypass this check."
+    no_soup_for_you
+  fi
+
+  read -rp "Type 'override' to continue anyway, or press Enter to exit: " confirm
+  if [[ "${confirm,,}" == "override" ]]; then
+    printf "\nOverride accepted. Continuing at your own risk.\n\n"
+  else
+    no_soup_for_you
+  fi
+}
+
 check_fleet_server() {
  echo "Checking that Elastic Fleet Server is responding."
  # Modeled on the wait_for_so-elastic-fleet state check in elasticfleet/enabled.sls,
@@ -1977,6 +2057,9 @@ main() {

  echo "Let's see if we need to update Security Onion."
  upgrade_check
+
+  check_cpu_compatibility
+
  upgrade_space

  echo "Verifying Elasticsearch version compatibility across the grid before upgrading."
@@ -2255,6 +2338,17 @@ fi
  echo "### soup has been served at $(date) ###"
 }

+SKIP_CPU_CHECK=false
+declare -a SOUP_ARGS=()
+for arg in "$@"; do
+  if [[ "$arg" == "--skip-cpu-check" ]]; then
+    SKIP_CPU_CHECK=true
+  else
+    SOUP_ARGS+=("$arg")
+  fi
+done
+set -- "${SOUP_ARGS[@]}"
+
 while getopts ":b:f:y" opt; do
  case ${opt} in
    b )
@@ -2278,7 +2372,7 @@ while getopts ":b:f:y" opt; do
      ISOLOC="$OPTARG"
    ;;
    \? )
-      echo "Usage: soup [-b] [-y] [-f <iso location>]"
+      echo "Usage: soup [-b] [-y] [-f <iso location>] [--skip-cpu-check]"
      exit 1
    ;;
    : )
@@ -57,8 +57,8 @@ nginx_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://nginx/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #nginx_sbin_jinja:
@@ -50,16 +50,16 @@ redis_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://redis/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 redis_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://redis/tools/sbin_jinja
-    - user: 939
-    - group: 939 
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja

@@ -3,6 +3,8 @@ salt_bootstrap:
  file.managed:
    - name: /usr/sbin/bootstrap-salt.sh
    - source: salt://salt/scripts/bootstrap-salt.sh
+    - user: root
+    - group: root
    - mode: 755
    - show_changes: False

@@ -10,6 +12,6 @@ salt_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://salt/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755
@@ -3,19 +3,34 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.

+# These wheels are pip-installed by root below, so they cannot live under /opt/so/conf:
+# that directory is 939:939 mode 770, and write permission on it is what lets uid 939
+# rename the tree aside and substitute its own wheels between this state and the install.
+# Hardening only the files here would not help -- renaming an entry needs write on the
+# parent, not on the entry.
 docker_module_package:
  file.recurse:
-    - name: /opt/so/conf/salt/module_packages/docker
+    - name: /opt/saltstack/module_packages/docker
    - source: salt://salt/module_packages/docker
+    - user: root
+    - group: root
+    - dir_mode: 755
+    - file_mode: 644
    - clean: True
    - makedirs: True

+# Installs before this change left wheels in a socore-writable directory; nothing reads
+# them now, but leaving them behind leaves a writable staging area lying around.
+old_docker_module_package:
+  file.absent:
+    - name: /opt/so/conf/salt/module_packages
+
 # fail hard on this state so that soup would be cancelled on a manager (eventhough salt would have already updated)
 # on a non manager, failing hard here will prevent the minion from upgrading
 # we want to fail hard here to prevent the minion from upgrading and potetially being able to manager docker containers from a dep mismatch
 docker_python_module_install:
  cmd.run:
-    - name: /opt/saltstack/salt/bin/python3.10 -m pip install docker --no-index --find-links=/opt/so/conf/salt/module_packages/docker/ --upgrade
+    - name: /opt/saltstack/salt/bin/python3.10 -m pip install docker --no-index --find-links=/opt/saltstack/module_packages/docker/ --upgrade
    - onchanges:
      - file: docker_module_package
    - failhard: True
@@ -35,6 +35,8 @@ combine_bond_script:
  file.managed:
    - name: /usr/sbin/so-combine-bond
    - source: salt://sensor/tools/sbin_jinja/so-combine-bond
+    - user: root
+    - group: root
    - mode: 755
    - template: jinja
    - defaults:
@@ -64,8 +64,8 @@ sensoroni_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://sensoroni/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #sensoroni_sbin_jinja:
@@ -171,8 +171,8 @@ soc_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://soc/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #soc_sbin_jinja:
@@ -1465,6 +1465,7 @@ soc:
            - core
            - emerging_threats_addon
          useEsql: false
+          esqlCaseInsensitive: true
        elastic:
          hostUrl:
          remoteHostUrls: []
@@ -1537,7 +1538,7 @@ soc:
            Orchestrator: sonnet@SOAI
            Investigator: gemma@SOAI
            DetectionEngineer: gemma@SOAI
-          useMemory: true
+          useMemory: false
          useMemoryScanner: false
          dontScanBefore: ""
          memoryScanIntervalSeconds: 300
@@ -18,8 +18,8 @@ hypervisor_annotation:
    - name: /opt/so/saltstack/default/salt/hypervisor/soc_hypervisor.yaml
    - source: salt://soc/dyanno/hypervisor/soc_hypervisor.yaml.jinja
    - template: jinja
-    - user: socore
-    - group: socore
+    - user: root
+    - group: root
    - defaults:
        HYPERVISORS: {{ HYPERVISORS }}
        baseDomainStatus: {{ salt['pillar.get']('baseDomain:status', 'Initialized') }}
@@ -1,6 +1,31 @@
 name: Security Onion Baseline Pipeline
 priority: 90
 transformations:
+    # ES|QL scalar == returns null on multivalued fields; the
+    # backend reads this key and emits MV_INTERSECTS instead.
+    - id: declare_multivalue_fields
+      type: set_state
+      key: multivalue_fields
+      val:
+        - event.type
+        - event.action
+        - event.category
+        - tags
+        - process.args
+        - related.ip
+        - dns.resolved_ip
+    - id: esql_default_index
+      type: set_state
+      key: index
+      val: .ds-logs-*
+    - id: esql_source_metadata
+      type: set_state
+      key: metadata
+      val: "_id, _index, _source"
+    - id: esql_source_keep
+      type: set_state
+      key: keep
+      val: "_id, _index, _source"
    - id: baseline_field_name_mapping
      type: field_name_mapping
      mapping:
@@ -396,6 +396,11 @@ soc:
            global: True
            advanced: True
            forcedType: bool
+          esqlCaseInsensitive:
+            description: "Match string values case-insensitively when converting Sigma rules. Applies to ES|QL only"
+            global: True
+            advanced: True
+            forcedType: bool
        elastic:
          index:
            description: Comma-separated list of indices or index patterns (wildcard "*" supported) that SOC will search for records.
@@ -51,8 +51,8 @@ strelka_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://strelka/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 {% else %}
@@ -76,16 +76,16 @@ suricata_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://suricata/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 suricata_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://suricata/tools/sbin_jinja
-    - user: 939
-    - group: 939 
+    - user: root
+    - group: root
    - file_mode: 755
    - template: jinja

@@ -65,8 +65,8 @@ telegraf_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://telegraf/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #telegraf_sbin_jinja:
@@ -101,8 +101,8 @@ zeek_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://zeek/tools/sbin
-    - user: 939
-    - group: 939
+    - user: root
+    - group: root
    - file_mode: 755

 #zeek_sbin_jinja:
@@ -18,6 +18,7 @@ zeek:
      StatsLogEnable: 0
      StatsLogExpireInterval: 0
      StatusCmdShowAll: 0
+      StopWait: 1
      CrashExpireInterval: 0
      SitePolicyScripts: local.zeek
      LogDir: /nsm/zeek/logs
@@ -9,9 +9,19 @@
 include:
  - zeek.sostatus
  
+# Stop first so the entrypoint's SIGTERM trap can archive the final logs; docker_container.absent
+# with force is a 'docker rm -f', which never delivers SIGTERM. force stays so the state still
+# converges if the stop overruns.
+so-zeek_stopped:
+  docker_container.stopped:
+    - name: so-zeek
+    - error_on_absent: False
+
 so-zeek:
  docker_container.absent:
    - force: True
+    - require:
+      - docker_container: so-zeek_stopped

 so-zeek_so-status.disabled:
  file.comment:
@@ -19,6 +19,10 @@ so-zeek:
    - restart_policy: unless-stopped
    - start: True
    - privileged: True
+    # Docker's default 10s grace is not enough for the entrypoint's SIGTERM trap to run
+    # 'zeekctl stop' and let StopWait archive the final logs. Overrunning it means SIGKILL,
+    # which strands those logs in spool/tmp and marks every node crashed on the next start.
+    - stop_timeout: 180
    {% if DOCKERMERGED.containers['so-zeek'].ulimits %}
    - ulimits:
    {%   for ULIMIT in DOCKERMERGED.containers['so-zeek'].ulimits %}
@@ -99,6 +99,18 @@ zeek:
        regexFailureMessage: You must enter a whole number of days, or 0 to keep crash directories forever.
        helpLink: zeek
        advanced: True
+      StopWait:
+        description: >-
+          Set to 1 to make "zeekctl stop" wait for the final logs to be archived instead of
+          letting that finish in the background. Security Onion stops Zeek by stopping its
+          container, so anything still running in the background is killed when the container
+          exits - without this, the last logs of each run are stranded unarchived in
+          /nsm/zeek/spool/tmp and never reach Elasticsearch. It is read only for that reason.
+        regex: ^[01]$
+        regexFailureMessage: You must enter 0 or 1.
+        helpLink: zeek
+        advanced: True
+        readonly: True
      MinDiskSpace:
        description: >-
          Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check
@@ -2105,6 +2105,8 @@ setup_salt_master_dirs() {

 	info "Chown the salt dirs on the manager for socore"
 	logCmd "chown -R socore:socore /opt/so"
+	# The default tree is root-executed code; SOC reads it but never writes it.
+	logCmd "chown -R root:root $default_salt_dir"
 }

 set_progress_str() {
Author	SHA1	Message	Date
Josh Patterson	098699613e	FIX: pip install wheels from a root-owned directory Root ran `pip install --find-links` against directories under /opt/so/conf, which is 939:939 mode 770. Hardening those directories would not have helped: renaming an entry requires write permission on the parent, not on the entry, so uid 939 could move the wheel tree aside and substitute its own between the file.recurse that populates it and the pip install that reads it. clean: True plus the onchanges requisite narrowed that to a race rather than a straight win, but the window is real and the install runs as root. Move both wheel trees to /opt/saltstack, which is created by the salt package and is root-owned, and state the ownership explicitly rather than relying on the files being new: /opt/so/conf/salt/module_packages/docker -> /opt/saltstack/module_packages/docker /opt/so/conf/libvirt/source-packages/libvirt-python -> /opt/saltstack/source-packages/libvirt-python salt.python_modules is included by salt/salt/minion/init.sls, so the docker wheels are staged on every minion in the grid, not just the manager. Upgraded installs keep a now-unused wheel tree in the old socore-writable location, so remove it -- nothing reads it after this change, but leaving a writable staging directory behind serves no purpose.	2026-09-17 12:43:37 -04:00
Josh Brower	0f7adbbecc	Merge pull request #16247 from Security-Onion-Solutions/esql-fixes Refactor for ESQL	2026-09-17 09:56:19 -04:00
Josh Patterson	aeb4fe8f50	Merge pull request #16250 from Security-Onion-Solutions/fix/root-own-sbin-and-salt-tree FIX: root-own /usr/sbin management scripts and the Salt default tree	2026-09-17 09:44:47 -04:00
defensivedepth	f3aa39c5a4	Tweak name	2026-09-17 09:43:44 -04:00
Doug Burks	24077ba974	Merge pull request #16249 from Security-Onion-Solutions/dougburks/fix-eval-suricata-file-drops FIX: suricata.fileinfo maps boolean gaps into long file.bytes.missing	2026-09-17 09:42:27 -04:00
Doug Burks	b3567405f9	FIX: suricata.fileinfo maps boolean gaps into long file.bytes.missing	2026-09-17 07:57:44 -04:00
defensivedepth	1fc5bb7afa	Refactor for ESQL	2026-09-17 07:56:42 -04:00
Josh Patterson	1f1d3ded41	FIX: root-own the Salt default tree so a SOC file-write cannot reach root code /opt/so/saltstack/default holds the source for every root-executed script -- /usr/sbin, the reactors, _runners/_modules/_beacons, the master engines and salt-relay.sh -- plus every state the root master renders. SOC mounts /opt/so/saltstack rw as uid 939, so root-owning /usr/sbin alone was not enough: the next highstate would copy attacker-controlled bytes out of the tree into the root-owned destination and run them. SOC never writes under default/, it only reads it. Every SOC write targets local/, which stays socore-owned, as does /opt/so/state. No mode is enforced on default/ -- SOC reads that tree, and 750/640 would break its config load. Also stops copy_new_files(), so-saltstack-update and setup from chowning the tree back to socore, and replaces preserve: True in soup_scripts.sls, which carried uid/gid in from the /tmp staging tree and would have undone the ownership before the first post-soup highstate.	2026-09-16 10:34:21 -04:00
Josh Patterson	1e86be11b2	FIX: install /usr/sbin management scripts as root Salt installed the so-* scripts into /usr/sbin owned by unprivileged service UIDs (939/socore, plus 930-960 per service) at mode 755, while root executes those same files from cron, systemd and state cmd.run. Any file-write primitive as one of those UIDs was therefore root. Two mechanisms behind this are not visible in the diff: file.recurse also manages the destination directory, so /usr/sbin itself was chowned to whichever service UID ran last. A directory's owner may always chmod it, so that UID could replace even the scripts already declared user: root -- so-config-backup, so-suricata-eve-clean, so-nsm-mount-nvme. usr_sbin_perms now pins the directory to root:root 555, the mode the filesystem RPM ships. Omitting user:/group: is a no-op on files that already exist, because check_perms only chowns when a user is named. Explicit user: root is what lets upgraded grids self-heal on the next highstate, and what makes a revert chown back rather than silently do nothing.	2026-09-16 10:34:20 -04:00
Josh Patterson	f4518e2620	Merge pull request #16246 from Security-Onion-Solutions/fix/so-minion-install-vars Fix/so minion install vars	2026-09-16 09:06:01 -04:00
Josh Patterson	a9f7ffc3fe	FIX: validate MAINIP without so-common during setup setup runs so-minion -o=setup before /usr/sbin/so-common is installed, so valid_ip4 was undefined, every MAINIP was rejected, and no minion pillar was written. Pillar compile then failed for the new manager and setup gave up waiting for the salt master. Use an inline IPv4 regex instead.	2026-09-15 13:10:33 -04:00
Josh Patterson	b018277d68	FIX: prevent joining minion from executing code as root on the manager so-minion exported every line of the minion-controlled /opt/so/install.txt into its root shell and wrote the values unescaped into a Jinja-rendered pillar, allowing a rogue node to redefine PILLARFILE or run code on the master at the next pillar compile. pcapspace also fed minion-returned disk.usage output into bash arithmetic, which evaluates array subscripts. - Parse install.txt against an allowlist of known keys; never export - Validate MINION_ID before building pillar paths; make them readonly - Validate node type, IP, interface, hostname, heap and core values before any pillar is written; strip braces and control chars from the free-text node description - Require a numeric disk size before pcapspace arithmetic - Refuse manager node types on add/addVM so a remote node cannot rewrite the CA pillar; only setup may create them	2026-09-15 09:58:38 -04:00
Josh Patterson	3be603e203	Merge pull request #16243 from Security-Onion-Solutions/fix/so-sensor-clean FIX: prevent so-sensor-clean runaway loop and concurrent instances	2026-09-14 14:53:12 -04:00
Josh Patterson	fee401a912	Merge pull request #16242 from Security-Onion-Solutions/zeekrestart stop Zeek gracefully preventing post-terminate logs	2026-09-14 08:54:08 -04:00
Mike Reeves	496b61966f	Merge pull request #16240 from Security-Onion-Solutions/clear-hotfix-3dev Remove outdated HOTFIX version number	2026-09-11 16:48:01 -04:00
Mike Reeves	52037314be	Remove outdated HOTFIX version number	2026-09-11 16:47:13 -04:00
Mike Reeves	9c12c10f96	Merge pull request #16239 from Security-Onion-Solutions/hotfix/3.3.0 Hotfix/3.3.0	2026-09-11 16:46:56 -04:00
Mike Reeves	9fc9be2cc9	Merge pull request #16237 from Security-Onion-Solutions/hf33 3.3.0 hotfix	2026-09-11 16:20:23 -04:00
Mike Reeves	7245843a3c	3.3.0 hotfix	2026-09-11 16:17:34 -04:00
Mike Reeves	a1d17417ea	3.3.0 hotfix	2026-09-11 16:16:01 -04:00
Mike Reeves	bee03d5bae	3.3.0 hotfix	2026-09-11 16:13:09 -04:00
Josh Patterson	56e3e44d04	Merge remote-tracking branch 'origin/3/dev' into zeekrestart	2026-09-11 15:06:28 -04:00
Mike Reeves	3f3f091a7f	Merge pull request #16235 from Security-Onion-Solutions/soup-x86-64-v3-check Add x86-64-v3 CPU pre-flight check to soup	2026-09-11 11:00:34 -04:00
Mike Reeves	cb48909578	Add x86-64-v3 CPU pre-flight check to soup Upstream Elastic now ships binaries built for the x86-64-v3 micro-architecture level. This is not a Security Onion choice: nodes whose CPUs predate x86-64-v3 can no longer run Elastic's own builds, so those nodes break once they are upgraded. Check for support before soup modifies anything, and require the operator to type "override" to proceed when a node is unsupported or offline. Runs after upgrade_check so a grid that is already current exits without prompting. Targets only the roles that run a container built from the so-elastic-agent image, using the role lists already maintained in salt/reactor/pillar_push_map.yaml. Adds --skip-cpu-check to bypass the gate for automation, and exit code 162 when the operator declines to override.	2026-09-11 10:51:25 -04:00
Mike Reeves	3057775770	Merge pull request #16234 from Security-Onion-Solutions/TOoSmOotH-patch-3 Update version number in HOTFIX file	2026-09-11 09:04:04 -04:00
Mike Reeves	e4e8b90b9c	Update version number in HOTFIX file	2026-09-11 09:03:24 -04:00
Mike Reeves	223ace6ff3	Merge pull request #16233 from Security-Onion-Solutions/TOoSmOotH-patch-2 Update HOTFIX version to 3.3.0-20260911	2026-09-11 08:57:31 -04:00
Mike Reeves	66e7863336	Update HOTFIX version to 3.3.0-20260911	2026-09-11 08:56:00 -04:00
Corey Ogburn	8f253d17a6	Default Memory to Disabled Gives users a chance to reconfigure embed model before messages they send to the OnionAI get sent to SOAI by default.	2026-09-10 15:18:35 -06:00
Josh Patterson	9652a2053b	Stop the Zeek container gracefully zeekctl's post-terminate archives the final logs in the background and returns immediately unless StopWait is set, so the container exits and takes the archiving with it, stranding unarchived logs in /nsm/zeek/spool/tmp on every restart. Docker's default 10s grace is also too tight for the entrypoint's SIGTERM trap; overrunning it means SIGKILL and crash directories on the next start. Both are needed. StopWait alone gives the stop more work to do inside the same 10s window, which was measured ending in SIGKILL with logs stranded in the spool. disabled.sls used docker rm -f, which never delivers SIGTERM, so stop the container before removing it. Reported in discussion #16174.	2026-09-10 13:20:20 -04:00
Mike Reeves	8f14e96215	Merge pull request #16215 from Security-Onion-Solutions/3/dev 3.3.0	2026-09-08 15:00:13 -04:00
Mike Reeves	23a9daf7a2	Merge pull request #16125 from Security-Onion-Solutions/3/dev 3.2.0	2026-07-29 14:10:31 -04:00