Project

General

Profile

Actions

Optimization #3085

closed

Suggest more appropriate location to store eBPF binaries

Added by Sascha Steinbiss over 4 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

I noticed that the documentation (https://suricata.readthedocs.io/en/latest/capture-hardware/ebpf-xdp.html#setup-ebpf-filter) suggests /etc/suricata/ebpf to store compiled eBPF programs. I think that there might be a better location for those. The FHS defines /etc as the place to store configuration files. By their definition, a "configuration file" is a local file used to control the operation of a program; it must be static and cannot be an executable binary. One might argue that the eBPF programs are not meant to be executable by the host operating system directly, but you get the idea.

I would propose to suggest /usr/share/suricata/ebpf instead. /usr/share is meant to contain read-only architecture independent data files, which is the case here (AFAICS the eBPF binary format is independent of the host architecture). For downstream packagers it will make a difference to have a preferred location that most likely complies with their own constraints for installed files -- especially once https://github.com/OISF/suricata/pull/3674 (or one of its descendents) gets merged.

Actions

Also available in: Atom PDF