Porting suricata to dinit

[Yakui420]

Hello, I'm kinda new to dinit and I was wondering how to port suricata.service (systemd) to dinit?

# Sample Suricata systemd unit file.
[Unit]
Description=Suricata Intrusion Detection Service
After=syslog.target network-online.target

[Service]
# Environment file to pick up $OPTIONS. On Fedora/EL this would be
# /etc/sysconfig/suricata, or on Debian/Ubuntu, /etc/default/suricata.
#EnvironmentFile=-/etc/sysconfig/suricata
#EnvironmentFile=-/etc/default/suricata
ExecStartPre=/bin/rm -f @e_rundir@suricata.pid
ExecStart=/sbin/suricata -c @e_sysconfdir@suricata.yaml --pidfile @e_rundir@suricata.pid $OPTIONS
ExecReload=/bin/kill -USR2 $MAINPID

[Install]
WantedBy=multi-user.target

It would be nice if you could explain some of the steps, as I've already read through the documentation, but I'm still pretty unsure how to set it up in the future.

[Yakui420]

This is what I have so far:

type            = process
command         = /sbin/suricata -c @e_sysconfdir@suricata.yaml --pidfile @e_rundir@suricata.pid $OPTIONS
smooth-recovery = true
logfile         = /var/log/dinit/suricata.log
depends-on      = multi-user.target
after           = syslog.target
after           = network-online.target

I'm not really sure how to port ExecStartPre and ExecReload into dinit.
Also should WantedBy=multi-user.target turn into depends-on = multi-user.target?

[mobin-2008]

We usually don't need "WantedBy" depends, So just remove it.
You didn't included any env-file so you can remove $OPTIONS from command.
You used logfile so you don't need syslog.target just remove it and set a depends-on on root read/write remount service (See below for more details).
Make sure your system has network-online.target, Unlike systemd, Dinit doesn't enforce distributions to use same services. Here's some hints:

• If your system uses Dinit stock service descriptions: Root read/write remount service is root-rw. There is no network-online.target, Use "after" on your networking daemon (For example "NetworkManager").
• If your system is Chimera Linux or Artix Linux: Root read/write remount service is early-root-rw.target. Replace network-online.target with network.target.

In systemd, You can make sure all network interfaces are up when network-online.target is started but with replacing it with network daemon, It's not guaranteed.

Best Regards

[mobin-2008]

About ExecReload, When you need to reload daemon just use this command:

$ sudo dinitctl signal USR2 suricata

About ExecStartPre, You should not need pidfile, So you can do one of these:

• Remove --pidfile @e_rundir@suricata.pid because according to https://docs.suricata.io/en/latest/manpages/suricata.html#cmdoption-D It always runs on foreground.
• Or use shell script and remove that pidfile on every start and start that script in command:

#!/bin/sh

# Remove pid-file from last start and start the deamon
/bin/rm -f @e_rundir@suricata.pid
exec /sbin/suricata -c @e_sysconfdir@suricata.yaml --pidfile @e_rundir@suricata.pid

Note: I'm not sure something like @e_rundir@ works in Dinit, If service failed to start, Replace them with explicit paths of rundir and sysconfdir (usually /run and /etc/).
Also don't forget to Reload services when you change service descriptions: sudo dinitctl reload suricata.

[davmac314]

You used logfile so you don't need syslog.target

This isn't correct, if the service logs via syslog then using logfile doesn't change that. logfile only decides where the standard output goes.

@Yakui420 some advice:

• service names will be different in a dinit system. So in after = syslog.target, the "syslog.target" is probably not the right name. It is also probably not the right dependency type. If the service actually needs syslog it should use depends-on = or perhaps waits-for = and not after = . Although this depends on what should happen if syslog doesn't start.
• WantedBy doesn't translate to depends-on =. The closest match would be before =. But it is not the same. You should read the documentation of both Systemd and Dinit to understand the difference.
• There is no equivalent to ExecStartPre except for adding a separate service which this one depends-on, or using a script which does both the ExecStartPre and ExecStart actions.

In all honesty, you need to understand the service dependencies and how they work. It seems like you're not understanding the concepts and rather just trying to find a one-to-one translation of each of the settings, but it doesn't work that way. The systems have fundamental differences and you will need to account for those.

[mobin-2008]

For more details read Dinit man-pages on Wiki: https://github.com/davmac314/dinit/wiki

[Yakui420]

Thanks for the quick answers.
Closing this for now.