doc/userguide: notes about Lua rules being disabled by default

diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst
index 91c0ca098584289e44421f517eb16e4d0f5490a7..13f9a8c74cae86dbeaa50c2ab706d88b4bb09993 100644 (file)
--- a/doc/userguide/configuration/suricata-yaml.rst
+++ b/doc/userguide/configuration/suricata-yaml.rst
@@ -2480,3 +2480,21 @@ detect thread. For each output script, a single state is used. Keep in
 mind that a rule reload temporary doubles the states requirement.
 
 .. _deprecation policy: https://suricata.io/our-story/deprecation-policy/
+
+.. _suricata-yaml-config-hardening:
+
+Configuration hardening
+-----------------------
+
+Lua
+~~~
+
+Suricata 6.0.13 disables Lua rules by default. Lua rules can be
+enabled in the ``security.lua`` section of the configuration file:
+
+::
+
+   security:
+     lua:
+       # Allow Lua rules. Disabled by default.
+       #allow-rules: false

diff --git a/doc/userguide/rules/rule-lua-scripting.rst b/doc/userguide/rules/rule-lua-scripting.rst
index 53eddb7c58a3816d4c3d615053a76de4372fcd75..f2909f36e056a666e7dc5924f2378bd0f4fbf5b8 100644 (file)
--- a/doc/userguide/rules/rule-lua-scripting.rst
+++ b/doc/userguide/rules/rule-lua-scripting.rst
@@ -3,6 +3,10 @@
 Lua Scripting
 =============
 
+.. note:: Lua is disabled by default for use in rules, it must be
+          enabled in the configuration file. See the ``security.lua``
+          section of ``suricata.yaml`` and enable ``allow-rules``.
+
 Syntax:
 
 ::

diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst
index b7ee28ac22b47c6bc97ec797d6695431ee0e0680..c93ba03d7c4c9b303772e82d0be1480ca8553b52 100644 (file)
--- a/doc/userguide/upgrade.rst
+++ b/doc/userguide/upgrade.rst
@@ -30,6 +30,11 @@ by the ones Suricata supplies.
 Major updates include new features, new default settings and often also
 remove features.
 
+Upgrading to 6.0.13
+-------------------
+- Lua rules have been disabled. To enable them see
+  :ref:`suricata-yaml-config-hardening`.
+
 Upgrading from 6.0.4 to 6.0.5
 -----------------------------
 - FTP has been updated with a maximum command request and response line length of 4096 bytes. To change the default see :ref:`suricata-yaml-configure-ftp`.