Skip to content

fix: service template crashes on empty AURORA_EXTRA_ARGS#8

Merged
Neo23x0 merged 1 commit intoNextron-Labs:masterfrom
RuneCode14:fix/service-template-bugs
Mar 16, 2026
Merged

fix: service template crashes on empty AURORA_EXTRA_ARGS#8
Neo23x0 merged 1 commit intoNextron-Labs:masterfrom
RuneCode14:fix/service-template-bugs

Conversation

@RuneCode14
Copy link
Copy Markdown

Bug 1: Empty env var crashes Aurora

error: unknown command "" for "aurora"

systemd's ${AURORA_EXTRA_ARGS} passes a literal empty string when the variable is empty. Cobra interprets this as an unknown subcommand and exits immediately. Every fresh install with default config hits this.

Fix: Wrap ExecStart in bash -c with unquoted $AURORA_EXTRA_ARGS — standard shell word splitting drops empty vars instead of passing them as arguments.

Bug 2: Wrong default rules path

The unit file hardcoded /opt/aurora-linux/sigma-rules/rules/linux but the install script places rules at /opt/aurora-linux/sigma-rules/linux. The EnvironmentFile override masked this on systems with a custom env file, but fresh installs without one would fail to find rules.

Tested

Aurora starts cleanly on Fedora 43 (kernel 6.18), loads 194 Sigma rules, and the eBPF listener initializes:

Sigma rules loaded  loaded=194 failed=5 unsupported=8
IOC sets loaded     filename_iocs=3732 c2_domains=1655 c2_ips=112
eBPF listener initialized, starting event collection

Two bugs in the systemd service template:

1. Empty AURORA_EXTRA_ARGS causes Aurora to crash on startup.
   systemd passes ${AURORA_EXTRA_ARGS} as a literal empty string
   argument, which cobra interprets as an unknown subcommand:
     error: unknown command "" for "aurora"
   Fix: wrap ExecStart in bash -c with unquoted $AURORA_EXTRA_ARGS
   so empty vars expand to nothing (standard shell word splitting).

2. Wrong default rules path: the unit file had
   /opt/aurora-linux/sigma-rules/rules/linux but the install script
   places rules at /opt/aurora-linux/sigma-rules/linux.
   The EnvironmentFile override masked this, but fresh installs
   without a custom env file would fail.

Tested: Aurora starts cleanly with empty AURORA_EXTRA_ARGS and
loads 194 Sigma rules from the correct path.
@Neo23x0 Neo23x0 merged commit 21f638c into Nextron-Labs:master Mar 16, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants