# Permissions in /var/lib/suricata to update rules as suricata user

**URL:** <https://forum.suricata.io/t/permissions-in-var-lib-suricata-to-update-rules-as-suricata-user/4577>\
**Category:** Help\
**Tags:** rules\
**Created:** [April 5, 2024, 8:22pm UTC](https://forum.suricata.io/t/permissions-in-var-lib-suricata-to-update-rules-as-suricata-user/4577 "2024-04-05T20:22:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_49100](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/alex_49100/32/2822_2.png) [@alex\_49100](https://forum.suricata.io/u/alex_49100)\
**Post date:** [April 5, 2024, 8:22pm UTC](https://forum.suricata.io/t/permissions-in-var-lib-suricata-to-update-rules-as-suricata-user/4577/1 "2024-04-05T20:22:47Z")

</div>

Hi to the Suricata community,

I am running Suricata 7.0.4 on Fedora 39 ; it was installed as a rpm.

When running suricata-update, the rules can’t get updated if I don’t run the command as root : there is an error with the permission needed to write in /var/lib/suricata/rules.

> `5/4/2024 -- 21:25:11 - <Error> -- Failed to create directory /var/lib/suricata/rules: [Errno 13] Permission denied: '/var/lib/suricata/rules'`

Going through the documentation step by step, I checked the other permissions (5.1.2 File System Permissions) and basically, they are as they should be, except /var/lib/suricata/rules.

The issue seemed to be the same as in this [post](https://forum.suricata.io/t/suricata-not-loading-rules/1348/3) so I ran the commands :

```auto
sudo chmod 2770 /var/lib/suricata
sudo chown -R root:suricata /var/lib/suricata

```

The permissions of the /var/lib/suricata directory don’t fully reflect these commands though, as the error still occurs and the output is :

> drwxrws—. 2 root suricata 4.0K Apr 5 19:57 rules  
> drwxrwsr-x. 4 root suricata 4.0K Apr 3 13:43 update

Thought to maybe check attributes, and the output is :

```auto
$ sudo lsattr /var/lib/suricata

```

> --------------e------- /var/lib/suricata/rules  
> --------------e------- /var/lib/suricata/update

Not sure about it, the Man pages for lsattr and chattr say that “e” cannot be removed.

What can / should be done please to run suricata-update without root? Or what would be your advice on this please ?

Many thanks.

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [April 5, 2024, 8:29pm UTC](https://forum.suricata.io/t/permissions-in-var-lib-suricata-to-update-rules-as-suricata-user/4577/2 "2024-04-05T20:29:32Z")

</div>

Did you add your user to the `suricata` group then re-login?

---

<div class="post-metadata">

**Author:** ![alex\_49100](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/alex_49100/32/2822_2.png) [@alex\_49100](https://forum.suricata.io/u/alex_49100)\
**Post date:** [April 6, 2024, 10:04am UTC](https://forum.suricata.io/t/permissions-in-var-lib-suricata-to-update-rules-as-suricata-user/4577/3 "2024-04-06T10:04:44Z")

</div>

Hi @ish thank you so much for your response, although I hesitated for a second to write back before the summer so that this thread might hopefully slowly sink in the depth of responded tickets 😊

Completely forgot about that - not frequently adding users to groups so to say - , and I was looking instead at something that could result from the hardening script that I might not be familiar with…

Anyway, I guess I am getting on the way for two “clean” Suricata installations now, with `suricata-update` and `suricatasc` working fine without root + Evebox.

Many thanks again and have a great day,