# Suricata-update aborts with permission error **URL:** \ **Category:** Help\ **Tags:** suricata-update\ **Created:** [July 27, 2023, 10:15pm UTC](https://forum.suricata.io/t/suricata-update-aborts-with-permission-error/3756 "2023-07-27T22:15:42Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![abwhite](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@abwhite](https://forum.suricata.io/u/abwhite)\ **Post date:** [July 27, 2023, 10:15pm UTC](https://forum.suricata.io/t/suricata-update-aborts-with-permission-error/3756/1 "2023-07-27T22:15:42Z")
I can start the suricata daemon fine, but trying to run suricata-update as root, I get this error: ```auto 27/7/2023 -- 14:55:04 - -- [ERRCODE: SC_ERR_FOPEN(44)] - Error opening file: "/tmp/tmpuCA4qJ/fast.log": Permission denied 27/7/2023 -- 14:55:04 - -- [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - output module "fast": setup failed 27/7/2023 -- 14:55:04 - -- Suricata test failed, aborting. 27/7/2023 -- 14:55:04 - -- Restoring previous rules. ``` running suricata-update as suricata user yields this error: ```auto 27/7/2023 -- 14:58:52 - -- [ERRCODE: SC_ERR_FATAL(171)] - capng_change_id for main thread failed 27/7/2023 -- 14:58:52 - -- Suricata test failed, aborting. 27/7/2023 -- 14:58:52 - -- Restoring previous rules. ``` Both root and suricata users definitely have permissions to read and write to /tmp, so not sure why there’s a permissions issue…I also didn’t see a “run-as” section in update.yaml like in suricata.yaml, so I’m assuming it just executes under the context of the user that invoked suricata-update. I have suricata.yaml configured to run-as suricata group/user. ---
**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\ **Post date:** [July 28, 2023, 4:45am UTC](https://forum.suricata.io/t/suricata-update-aborts-with-permission-error/3756/2 "2023-07-28T04:45:40Z")
The error is generated by Suricata, I think. Suricata-Update invokes Suricata to test the config+rules using `-T`. So the `suricata.yaml` is relevant here. Still, I’m not sure why it gives this error. ---
**Author:** ![abwhite](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@abwhite](https://forum.suricata.io/u/abwhite)\ **Post date:** [July 28, 2023, 8:31pm UTC](https://forum.suricata.io/t/suricata-update-aborts-with-permission-error/3756/3 "2023-07-28T20:31:57Z")
My main concern is with that last error stating that the old rules were restored. To me, that means no rules have been updated and the rules I have disabled in disabled.conf are still enabled. Is that the case? ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [July 31, 2023, 7:47pm UTC](https://forum.suricata.io/t/suricata-update-aborts-with-permission-error/3756/4 "2023-07-31T19:47:11Z")
Please post your suricata.yaml for further debugging, also the version of Suricata and suricata-update ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [July 31, 2023, 8:07pm UTC](https://forum.suricata.io/t/suricata-update-aborts-with-permission-error/3756/5 "2023-07-31T20:07:59Z")
This appears to happen when the `run-as` section of `suricata.yaml` is configured. When `suricata-update` is run, it first creates a temporary directory, but does not set the permissions to respect `run-as`, and while it should try, this may still fail. So more investigation is required here. My personal preference is to do what the RPM packages do: - do not specify a `run-as` section in `suricata.yaml` - use the command line arguments for setting the user and group (in the systemd unit file) I think this provides a good balance of expected usage from the command line and systemd. But I’ll create a ticket to see if we can do better: [Bug #6241: Suricata test-mode can fail when user and group provided with run-as. - Suricata-Update - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/6241) ---
**Author:** ![abwhite](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@abwhite](https://forum.suricata.io/u/abwhite)\ **Post date:** [July 31, 2023, 9:36pm UTC](https://forum.suricata.io/t/suricata-update-aborts-with-permission-error/3756/6 "2023-07-31T21:36:39Z")
Sure enough, commenting out `run-as` in `suricata.yaml` and adding the user/group arguments to the unit file allows `suricata-update` to run to completion. Thank you for your help and investigation into this bug @ish !