suricata: Force Suricata to write a PID file again

The PID file does not get written when Suricata is not being started in
daemon mode and therefore we need to pass it as a command line
parameter.

The initscript should not deal with the PID file when starting but needs
it to terminate the process and to check the process status.

The web UI can use the PID file again.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/suricata/suricata-watcher b/config/suricata/suricata-watcher
index af4defe04f4f9b7483dbe245f6ebeb3c884ec7f8..d937ef8cc9f4c6e6cdb63c90c64d9b60a9f48313 100644 (file)
--- a/config/suricata/suricata-watcher
+++ b/config/suricata/suricata-watcher
@@ -24,9 +24,12 @@ PIDFILE="/var/run/suricata.pid"
 main() {
        local ret
 
+       # Suricata becomes unhappy if the PID file exists
+       unlink "${PIDFILE}" &>/dev/null
+
        while :; do
                # Launch suricata
-               /usr/bin/suricata "$@" &>/dev/null
+               /usr/bin/suricata --pidfile "${PIDFILE}" "$@" &>/dev/null
 
                # Wait until suricata is done
                ret=$?

diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi
index 34e6bf233ad06d8013164ea4b87f5da02a98976f..db05df98a9143e35fdd55c085d6ba105006a90a7 100644 (file)
--- a/html/cgi-bin/ids.cgi
+++ b/html/cgi-bin/ids.cgi
@@ -1011,7 +1011,7 @@ sub show_mainpage() {
 
        &Header::ServiceStatus({
                $Lang::tr{'intrusion prevention system'} => {
-                       "process" => "Suricata-Main",
+                       "pidfile" => "/var/run/suricata.pid",
                },
        });
 

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index f3aa18f23966e602e0cc3312368bf92d9aba0553..2890fa64be1ef73881fc9f48168ab793ce15e2d9 100644 (file)
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -159,7 +159,7 @@ case "$1" in
 
         stop)
                boot_mesg "Stopping Intrusion Detection System..."
-               killproc /usr/bin/suricata
+               killproc -p /var/run/suricata.pid /usr/bin/suricata
 
                # Flush firewall chain.
                flush_fw_chain
@@ -169,13 +169,14 @@ case "$1" in
         ;;
 
         status)
-                statusproc /usr/bin/suricata
+                PIDFILE="/var/run/suricata.pid" statusproc /usr/bin/suricata
                 ;;
 
         restart)
                 $0 stop
                 $0 start
                 ;;
+
        reload)
                # Send SIGUSR2 to the suricata process to perform a reload
                # of the ruleset.