Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pulledpork-0.7.3 updates local.rules file when configured to ignore local.rules #312

Open
gmarkj opened this issue Aug 12, 2018 · 1 comment
Labels
bug Known bug in the code. Priority-Low

Comments

@gmarkj
Copy link

gmarkj commented Aug 12, 2018

I am running pulled pork with the -k parameter and ignore=local.rules in the configuration file. I have observed that my local.rules file is being updated by pulled pork to delete all rules starting with # (example below).
I expected the local.rules to be unchanged however wanted to check prior to proposing a patch?

my local.rules file has the following content prior to running pulled pork

----- Begin local Rules Category -----

alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:001;)
#alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000002; rev:001;)

after running pulled pork the file has been changed to

----- Begin local Rules Category -----

-- Begin GID:0 Based Rules --

alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:001;)

@shirkdog shirkdog added the bug Known bug in the code. label Sep 11, 2018
@shirkdog
Copy link
Owner

I am not seeing this issue, but there is something with this process that does not work correctly. so not an issue with removing signatures from local.rules, but not actually ignoring local.rules.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Known bug in the code. Priority-Low
Projects
None yet
Development

No branches or pull requests

2 participants