Added the ability to install at custom location

This commit adds the ability to install psad at a custom location via the
--install-root <root> command line argument to install.pl.  This feature
was suggested by @pyllyukko.  In addition, psad can be installed by a
normal user instead requiring root.

diff --git a/install.pl b/install.pl
index 2cefdc5..4692996 100755 (executable)
--- a/install.pl
+++ b/install.pl
@@ -53,6 +53,8 @@ my $makeCmd      = '/usr/bin/make';
 my $perlCmd      = '/usr/bin/perl';
 my $wgetCmd      = '/usr/bin/wget';
 my $runlevelCmd  = '/sbin/runlevel';
+
+my $install_root = '/';
 #============ end config ============
 
 my %file_vars = (
@@ -156,6 +158,7 @@ my $cmdline_force_install = 0;
 my $force_path_update = 0;
 my $force_mod_re = '';
 my $exclude_mod_re = '';
+my $install_test_dir = 0;
 my $no_rm_old_lib_dir = 0;
 my $syslog_conf = '';
 my $locale = 'C';  ### default LC_ALL env variable
@@ -165,6 +168,7 @@ my $init_dir = '/etc/init.d';
 my $init_name = 'psad';
 my $install_syslog_fifo = 0;
 my $runlevel = -1;
+my @installation_lines = ();
 
 ### make Getopts case sensitive
 Getopt::Long::Configure('no_ignore_case');
@@ -184,6 +188,8 @@ Getopt::Long::Configure('no_ignore_case');
     'init-dir=s'        => \$init_dir,
     'init-name=s'       => \$init_name,
     'install-syslog-fifo' => \$install_syslog_fifo,
+    'install-root=s'    => \$install_root,
+    'install-test-dir'  => \$install_test_dir,
     'runlevel=i'        => \$runlevel,
     'LC_ALL=s'          => \$locale,
     'no-LC_ALL'         => \$no_locale,
@@ -194,11 +200,11 @@ Getopt::Long::Configure('no_ignore_case');
 ### set LC_ALL env variable
 $ENV{'LC_ALL'} = $locale unless $no_locale;
 
+$install_root = getcwd() . '/test/psad-install' if $install_test_dir;
+
 ### import paths from default psad.conf
 &import_config();
 
-my @LOGR_FILES = (*STDOUT, $config{'INSTALL_LOG_FILE'});
-
 $force_mod_re = qr|$force_mod_re| if $force_mod_re;
 $exclude_mod_re = qr|$exclude_mod_re| if $exclude_mod_re;
 
@@ -210,12 +216,6 @@ $cmds{'make'}     = $makeCmd;
 $cmds{'perl'}     = $perlCmd;
 $cmds{'runlevel'} = $runlevelCmd;
 
-if (-e $config{'INSTALL_LOG_FILE'}) {
-    open INSTALL, "> $config{'INSTALL_LOG_FILE'}" or
-        die "[*] Could not open $config{'INSTALL_LOG_FILE'}: $!";
-    close INSTALL;
-}
-
 my $distro = &get_distro();
 
 if ($distro eq 'redhat' or $distro eq 'fedora') {
@@ -242,16 +242,12 @@ unless (-d $init_dir) {
 
 ### need to make sure this exists before attempting to
 ### write anything to the install log.
-mkdir $config{'PSAD_DIR'}, 0500 unless -d $config{'PSAD_DIR'};
+&full_mkdir($config{'PSAD_DIR'}, 0700);
 
 ### make sure the system binaries are where we expect
 ### them to be.
 &check_commands();
 
-### check to make sure we are running as root
-$< == 0 && $> == 0 or die "You need to be root (or equivalent UID 0",
-    " account) to install/uninstall psad!";
-
 ### occasionally things from old psad installations need to be
 ### dealt with separately.
 &check_old_psad_installation();
@@ -261,6 +257,11 @@ if ($uninstall) {
 } else {
     &install();
 }
+
+open F, "> $config{'INSTALL_LOG_FILE'}" or die $!;
+print F for @installation_lines;
+close F;
+
 exit 0;
 #================= end main =================
 
@@ -280,11 +281,11 @@ sub install() {
 
     unless (-d $config{'PSAD_RUN_DIR'}) {
         &logr("[+] Creating $config{'PSAD_RUN_DIR'}\n");
-        mkdir $config{'PSAD_RUN_DIR'}, 0500;
+        &full_mkdir($config{'PSAD_RUN_DIR'}, 0700);
     }
     unless (-d $config{'PSAD_FIFO_DIR'}) {
         &logr("[+] Creating $config{'PSAD_FIFO_DIR'}\n");
-        mkdir $config{'PSAD_FIFO_DIR'}, 0500;
+        &full_mkdir($config{'PSAD_FIFO_DIR'}, 0700);
     }
 
     ### change any existing psad module directory to allow anyone to import
@@ -304,11 +305,11 @@ sub install() {
     }
     unless (-d $config{'PSAD_CONF_DIR'}) {
         &logr("[+] Creating $config{'PSAD_CONF_DIR'}\n");
-        mkdir $config{'PSAD_CONF_DIR'}, 0500;
+        &full_mkdir($config{'PSAD_CONF_DIR'}, 0700);
     }
     unless (-d $config{'CONF_ARCHIVE_DIR'}) {
         &logr("[+] Creating $config{'CONF_ARCHIVE_DIR'}\n");
-        mkdir $config{'CONF_ARCHIVE_DIR'}, 0500;
+        &full_mkdir($config{'CONF_ARCHIVE_DIR'}, 0700);
     }
 
     if ($install_syslog_fifo) {
@@ -333,8 +334,13 @@ sub install() {
 
     unless (-d $config{'PSAD_DIR'}) {
         &logr("[+] Creating $config{'PSAD_DIR'}\n");
-        mkdir $config{'PSAD_DIR'}, 0500;
+        &full_mkdir($config{'PSAD_DIR'}, 0700);
+    }
+    unless (-d $config{'PSAD_LIBS_DIR'}) {
+        &logr("[+] Creating $config{'PSAD_LIBS_DIR'}\n");
+        &full_mkdir($config{'PSAD_LIBS_DIR'}, 0755);
     }
+
     unless (-e $config{'FW_DATA_FILE'}) {
         &logr("[+] Creating $config{'FW_DATA_FILE'} file\n");
         open F, "> $config{'FW_DATA_FILE'}" or die "[*] Could not open ",
@@ -346,7 +352,7 @@ sub install() {
 
     unless (-d $USRSBIN_DIR) {
         &logr("[+] Creating $USRSBIN_DIR\n");
-        mkdir $USRSBIN_DIR,0755;
+        &full_mkdir($USRSBIN_DIR, 0755);
     }
     if (-d 'deps' and -d 'deps/whois') {
         &logr("[+] Compiling Marco d'Itri's whois client\n");
@@ -379,8 +385,7 @@ sub install() {
         &logr("[+] Installing Snort-2.3.3 signatures in " .
             "$config{'SNORT_RULES_DIR'}\n");
         unless (-d $config{'SNORT_RULES_DIR'}) {
-            mkdir $config{'SNORT_RULES_DIR'}, 0500
-                or die "[*] Could not create $config{'SNORT_RULES_DIR'}: $!";
+            &full_mkdir($config{'SNORT_RULES_DIR'}, 0700);
         }
 
         opendir D, 'deps/snort_rules' or die "[*] Could not open ",
@@ -475,7 +480,7 @@ sub install() {
 
     unless (-d $config{'PSAD_CONF_DIR'}) {
         &logr("[+] Creating $config{'PSAD_CONF_DIR'}\n");
-        mkdir $config{'PSAD_CONF_DIR'},0500;
+        &full_mkdir($config{'PSAD_CONF_DIR'}, 0700);
     }
 
     my $syslog_str = '';
@@ -715,6 +720,7 @@ sub install() {
     &install_manpage('nf2csv.1');
 
     my $init_file = '';
+    my $installed_init_script = 0;
     if ($distro eq 'redhat') {
         $init_file = 'init-scripts/psad-init.redhat';
     } elsif ($distro eq 'fedora') {
@@ -725,12 +731,13 @@ sub install() {
         $init_file = 'init-scripts/psad-init.generic';
     }
 
-    if ($init_dir) {
+    if ($init_dir and &is_root()) {
         &logr("[+] Copying $init_file -> ${init_dir}/$init_name\n");
         copy $init_file, "${init_dir}/$init_name" or die "[*] Could not copy ",
             "$init_file -> ${init_dir}/$init_name: $!";
         &perms_ownership("${init_dir}/$init_name", 0744);
         &enable_psad_at_boot($distro);
+        $installed_init_script = 1;
     }
 
     &logr("\n========================================================\n");
@@ -743,10 +750,12 @@ sub install() {
     } else {
         &logr("\n[+] psad has been installed.\n");
     }
-    if ($init_dir) {
-        &logr("\n[+] To start psad, run \"${init_dir}/psad start\"\n");
-    } else {
-        &logr("\n[+] To start psad, run ${USRSBIN_DIR}/psad\"\n");
+    if ($installed_init_script) {
+        if ($init_dir) {
+            &logr("\n[+] To start psad, run \"${init_dir}/psad start\"\n");
+        } else {
+            &logr("\n[+] To start psad, run ${USRSBIN_DIR}/psad\"\n");
+        }
     }
     return;
 }
@@ -769,6 +778,22 @@ sub import_config() {
     }
     close C;
 
+    ### see if the install root is the same as the default in psad.conf and
+    ### update if not
+    if ($install_root ne '/') {
+        $install_root = getcwd() . "/$install_root"
+            unless $install_root =~ m|^/|;
+        $config{'INSTALL_ROOT'} = $install_root;
+        $USRSBIN_DIR = $config{'INSTALL_ROOT'} . $USRSBIN_DIR;
+        $USRBIN_DIR  = $config{'INSTALL_ROOT'} . $USRBIN_DIR;
+
+        &put_string('INSTALL_ROOT', $install_root, $psad_conf_file);
+    }
+
+    for my $dir ($install_root, $USRSBIN_DIR, $USRBIN_DIR) {
+        &full_mkdir($dir, 0755) unless -d $dir;
+    }
+
     ### resolve internal vars within variable values
     &expand_vars();
 
@@ -796,7 +821,11 @@ sub expand_vars() {
                     die "[*] sub-ver $sub_var not allowed within same ",
                         "variable $var" if $sub_var eq $var;
                     if (defined $config{$sub_var}) {
-                        $val =~ s|\$$sub_var|$config{$sub_var}|;
+                        if ($sub_var eq 'INSTALL_ROOT' and $config{$sub_var} eq '/') {
+                            $val =~ s|\$$sub_var||;
+                        } else {
+                            $val =~ s|\$$sub_var|$config{$sub_var}|;
+                        }
                         $hr->{$var} = $val;
                     } else {
                         die "[*] sub-var \"$sub_var\" not defined in ",
@@ -1011,11 +1040,6 @@ sub install_perl_module() {
     }
 
     if ($install_module) {
-        unless (-d $config{'PSAD_LIBS_DIR'}) {
-            &logr("[+] Creating $config{'PSAD_LIBS_DIR'}\n");
-            mkdir $config{'PSAD_LIBS_DIR'}, 0755 or
-                die "[*] Could not mkdir $config{'PSAD_LIBS_DIR'}: $!";
-        }
         &logr("[+] Installing the $mod_name $version perl " .
             "module in $config{'PSAD_LIBS_DIR'}/\n");
         my $mod_dir = $required_perl_modules{$mod_name}{'mod-dir'};
@@ -1039,6 +1063,7 @@ sub install_perl_module() {
 
         print "\n\n";
     }
+
     return;
 }
 
@@ -1606,6 +1631,9 @@ sub scrub_prefix_ctr() {
 }
 
 sub check_old_psad_installation() {
+
+    return unless &is_root();
+
     my $old_install_dir = '/usr/local/bin';
     if (-e "${old_install_dir}/psad") {
         move "${old_install_dir}/psad", "${USRSBIN_DIR}/psad" or die "[*] ",
@@ -1657,10 +1685,15 @@ sub get_distro() {
 
 sub perms_ownership() {
     my ($file, $perm_value) = @_;
+
     chmod $perm_value, $file or die "[*] Could not ",
         "chmod($perm_value, $file): $!";
+
+    return unless &is_root();
+
     ### root (maybe should take the group assignment out)
     chown 0, 0, $file or die "[*] Could not chown 0,0,$file: $!";
+
     return;
 }
 
@@ -1858,6 +1891,7 @@ sub archive() {
     }
     &logr("[+] Archiving $file -> $config{'CONF_ARCHIVE_DIR'}/${base}1.gz\n");
     unlink "${base}1.gz" if -e "${base}1.gz";
+
     ### move $file into the archive directory
     copy $file, "${base}1" or die "[*] Could not copy ",
         "$file -> ${base}1: $!";
@@ -1870,6 +1904,8 @@ sub archive() {
 sub enable_psad_at_boot() {
     my $distro = shift;
 
+    return unless &is_root();
+
     if (&query_yes_no("[+] Enable psad at boot time ([y]/n)?  ",
                 $ACCEPT_YES_DEFAULT)) {
         if ($distro eq 'redhat' or $distro eq 'fedora') {
@@ -1901,6 +1937,7 @@ sub enable_psad_at_boot() {
 
 ### check paths to commands and attempt to correct if any are wrong.
 sub check_commands() {
+
     CMD: for my $cmd (keys %cmds) {
         next CMD if defined $exclude_cmds{$cmd};
         unless (-x $cmds{$cmd}) {
@@ -1927,6 +1964,7 @@ sub check_commands() {
             }
         }
         unless (-x $cmds{$cmd}) {
+            return unless &is_root();
             die "\n[*] $cmd is located at ",
                 "$cmds{$cmd} but is not executable by uid: $<";
         }
@@ -1934,11 +1972,16 @@ sub check_commands() {
     return;
 }
 
+sub is_root() {
+    return 1 if $< == 0 and $> == 0;
+    return 0;
+}
+
 sub install_manpage() {
     my $manpage = shift;
 
-    my $name;
-    my $section;
+    my $name    = '';
+    my $section = '';
 
     if ($manpage =~ m|(\w+)\.(\d)|) {
         $name = $1;
@@ -1948,8 +1991,10 @@ sub install_manpage() {
     }
 
     ### remove old man page
-    unlink "/usr/local/man/man$section/${manpage}" if
-        (-e "/usr/local/man/man$section/${manpage}");
+    if (&is_root()) {
+        unlink "/usr/local/man/man$section/${manpage}" if
+            -e "/usr/local/man/man$section/${manpage}";
+    }
 
     ### default location to put the psad man page, but check with
     ### /etc/man.config
@@ -1993,7 +2038,12 @@ sub install_manpage() {
             }
         }
     }
-    mkdir $mpath, 0755 unless -d $mpath;
+
+    if ($install_root ne '/') {
+        $mpath = $config{'INSTALL_ROOT'} . $mpath;
+    }
+
+    &full_mkdir($mpath, 0755);
     my $mfile = "${mpath}/${manpage}";
     &logr("[+] Installing $manpage man page at $mfile\n");
     copy $manpage, $mfile or die "[*] Could not copy $manpage to ",
@@ -2006,6 +2056,23 @@ sub install_manpage() {
     return;
 }
 
+sub full_mkdir() {
+    my ($dir, $perms) = @_;
+
+    my @dirs = split /\//, $dir;
+    my $path = $dirs[0];
+    shift @dirs;
+    for my $d (@dirs) {
+        next unless $d and $d =~ /\S/;
+        $path .= "/$d";
+        unless (-d $path) {
+            printf "[+] mkdir $path, %o\n", $perms;
+            mkdir $path, $perms or die "[*] Could not mkdir($path): $!";
+        }
+    }
+    return;
+}
+
 sub has_perl_module() {
     my $module = shift;
 
@@ -2033,6 +2100,9 @@ sub update_command_paths() {
             my $cmd    = $1;
             my $spaces = $2;
             my $path   = $3;
+            if ($path =~ /\$INSTALL_ROOT/) {
+                $path =~ s|\$INSTALL_ROOT|$install_root|;
+            }
             unless (-e $path and -x $path) {
                 ### the command is not at this path, try to find it
                 my $cmd_minor_name = $cmd;
@@ -2091,18 +2161,10 @@ sub get_runlevel() {
 ### logging subroutine that handles multiple filehandles
 sub logr() {
     my $msg = shift;
-    for my $file (@LOGR_FILES) {
-        if ($file eq *STDOUT) {
-            print STDOUT $msg;
-        } elsif ($file eq *STDERR) {
-            print STDERR $msg;
-        } else {
-            open F, ">> $file" or die "[*] Could not open ",
-                "$file: $!";
-            print F $msg;
-            close F;
-        }
-    }
+
+    print STDOUT $msg;
+    push @installation_lines, $msg;
+
     return;
 }
 

diff --git a/psad b/psad
index 76d708a..fb3306c 100755 (executable)
--- a/psad
+++ b/psad
@@ -310,7 +310,7 @@ my %local_src = ();
 
 ### regex to match IP addresses
 my $ip_re   = qr|(?:[0-2]?\d{1,2}\.){3}[0-2]?\d{1,2}|;  ### IPv4
-my $ipv6_re = qr|(?:[a-f0-9]{4}:){7}(?:[a-f0-9]{4})|i;   ### IPv6
+my $ipv6_re = qr|(?:[a-f0-9]{4}:){7}(?:[a-f0-9]{4})|i;  ### IPv6
 
 ### ttl values are decremented depending on the number of hops
 ### the packet has taken before it hits the firewall.  We will
@@ -5050,7 +5050,7 @@ sub scan_logr() {
 
             ### make $src directory here in /var/log/psad
             ### unless it already exists
-            mkdir "$config{'PSAD_DIR'}/${src}", 0500
+            mkdir "$config{'PSAD_DIR'}/${src}", 0700
                 unless -d "$config{'PSAD_DIR'}/${src}";
             my $src_dir = "$config{'PSAD_DIR'}/${src}";
             my $dl_file      = "${src_dir}/danger_level";
@@ -9267,7 +9267,7 @@ sub archive_data() {
     chdir $config{'PSAD_DIR'} or die "[*] Could not chdir ",
         "$config{'PSAD_DIR'}: $!";
     unless (-d $config{'SCAN_DATA_ARCHIVE_DIR'}) {
-        mkdir $config{'SCAN_DATA_ARCHIVE_DIR'}, 0500 or
+        mkdir $config{'SCAN_DATA_ARCHIVE_DIR'}, 0700 or
             die "[*] Could not create dir: ",
             "$config{'SCAN_DATA_ARCHIVE_DIR'}: $!";
     }
@@ -9385,7 +9385,7 @@ sub make_psad_dirs() {
         PSAD_ERR_DIR
     )) {
         next if -d $config{$dir};
-        mkdir $config{$dir}, 0500 or
+        mkdir $config{$dir}, 0700 or
             die "[*] Could not mkdir $config{$dir}: $!";
     }
     return;
@@ -9701,7 +9701,7 @@ sub disk_space_exceeded() {
             ### of our worries).
             &sys_log("removing $config{'SCAN_DATA_ARCHIVE_DIR'} directory");
             rmtree $config{'SCAN_DATA_ARCHIVE_DIR'};
-            mkdir $config{'SCAN_DATA_ARCHIVE_DIR'}, 0500;
+            mkdir $config{'SCAN_DATA_ARCHIVE_DIR'}, 0700;
         }
         opendir D, $config{'PSAD_DIR'} or
             die "[*] Could not open dir: $config{'PSAD_DIR'}: $!";
@@ -10109,7 +10109,12 @@ sub expand_vars() {
                     die "[*] sub-ver $sub_var not allowed within same ",
                         "variable $var" if $sub_var eq $var;
                     if (defined $config{$sub_var}) {
-                        $val =~ s|\$$sub_var|$config{$sub_var}|;
+                        if ($sub_var eq 'INSTALL_ROOT'
+                                and $config{$sub_var} eq '/') {
+                            $val =~ s|\$$sub_var||;
+                        } else {
+                            $val =~ s|\$$sub_var|$config{$sub_var}|;
+                        }
                         $hr->{$var} = $val;
                     } else {
                         die "[*] sub-var \"$sub_var\" not defined in ",
@@ -10124,9 +10129,23 @@ sub expand_vars() {
 }
 
 sub is_root() {
-    $< == 0 && $> == 0 or
+
+    ### exceptions
+    for my $var ($download_sigs,
+            $analyze_mode,
+            $get_next_rule_id,
+            $gnuplot_mode,
+            $csv_mode,
+            $dump_conf,
+            $status_mode,
+            $benchmark,
+    ) {
+        return if $var;
+    }
+
+    $< == 0 and $> == 0 or
         die '[*] psad: You must be root (or equivalent ',
-            "UID 0 account) to execute psad!  Exiting.\n";
+            "UID 0 account) to execute psad!  Exiting.";
 }
 
 ### check to make sure all required varables are defined in the config
@@ -10513,7 +10532,7 @@ sub required_vars() {
         ENABLE_SYSLOG_FILE IPT_SYSLOG_FILE IPT_WRITE_FWDATA
         ETC_RSYSLOG_CONF IFCFGTYPE ENABLE_WHOIS_FORCE_ASCII
         ENABLE_WHOIS_FORCE_SRC_IP ENABLE_IPV6_DETECTION
-        PERSISTENCE_CTR_THRESHOLD MAX_SCAN_IP_PAIRS
+        PERSISTENCE_CTR_THRESHOLD MAX_SCAN_IP_PAIRS INSTALL_ROOT
     ));
     &defined_vars(\@required_vars);
     return;

diff --git a/psad.conf b/psad.conf
index d9694a9..da700e7 100644 (file)
--- a/psad.conf
+++ b/psad.conf
@@ -468,11 +468,12 @@ PSADWATCHD_CHECK_INTERVAL   5;  ### seconds
 PSADWATCHD_MAX_RETRIES      10;
 
 ### Directories
-PSAD_DIR                    /var/log/psad;
-PSAD_RUN_DIR                /var/run/psad;
-PSAD_FIFO_DIR               /var/lib/psad;
-PSAD_LIBS_DIR               /usr/lib/psad;
-PSAD_CONF_DIR               /etc/psad;
+INSTALL_ROOT                /;
+PSAD_DIR                    $INSTALL_ROOT/var/log/psad;
+PSAD_RUN_DIR                $INSTALL_ROOT/var/run/psad;
+PSAD_FIFO_DIR               $INSTALL_ROOT/var/lib/psad;
+PSAD_LIBS_DIR               $INSTALL_ROOT/usr/lib/psad;
+PSAD_CONF_DIR               $INSTALL_ROOT/etc/psad;
 PSAD_ERR_DIR                $PSAD_DIR/errs;
 CONF_ARCHIVE_DIR            $PSAD_CONF_DIR/archive;
 SCAN_DATA_ARCHIVE_DIR       $PSAD_DIR/scan_archive;
@@ -562,9 +563,9 @@ ipCmd            /sbin/ip;
 killallCmd       /usr/bin/killall;
 netstatCmd       /bin/netstat;
 unameCmd         /bin/uname;
-whoisCmd         /usr/bin/whois_psad;
+whoisCmd         $INSTALL_ROOT/usr/bin/whois_psad;
 dfCmd            /bin/df;
-fwcheck_psadCmd  /usr/sbin/fwcheck_psad;
-psadwatchdCmd    /usr/sbin/psadwatchd;
-kmsgsdCmd        /usr/sbin/kmsgsd;
-psadCmd          /usr/sbin/psad;
+fwcheck_psadCmd  $INSTALL_ROOT/usr/sbin/fwcheck_psad;
+psadwatchdCmd    $INSTALL_ROOT/usr/sbin/psadwatchd;
+kmsgsdCmd        $INSTALL_ROOT/usr/sbin/kmsgsd;
+psadCmd          $INSTALL_ROOT/usr/sbin/psad;

diff --git a/test/conf/default_psad.conf b/test/conf/default_psad.conf
index d9694a9..da700e7 100644 (file)
--- a/test/conf/default_psad.conf
+++ b/test/conf/default_psad.conf
@@ -468,11 +468,12 @@ PSADWATCHD_CHECK_INTERVAL   5;  ### seconds
 PSADWATCHD_MAX_RETRIES      10;
 
 ### Directories
-PSAD_DIR                    /var/log/psad;
-PSAD_RUN_DIR                /var/run/psad;
-PSAD_FIFO_DIR               /var/lib/psad;
-PSAD_LIBS_DIR               /usr/lib/psad;
-PSAD_CONF_DIR               /etc/psad;
+INSTALL_ROOT                /;
+PSAD_DIR                    $INSTALL_ROOT/var/log/psad;
+PSAD_RUN_DIR                $INSTALL_ROOT/var/run/psad;
+PSAD_FIFO_DIR               $INSTALL_ROOT/var/lib/psad;
+PSAD_LIBS_DIR               $INSTALL_ROOT/usr/lib/psad;
+PSAD_CONF_DIR               $INSTALL_ROOT/etc/psad;
 PSAD_ERR_DIR                $PSAD_DIR/errs;
 CONF_ARCHIVE_DIR            $PSAD_CONF_DIR/archive;
 SCAN_DATA_ARCHIVE_DIR       $PSAD_DIR/scan_archive;
@@ -562,9 +563,9 @@ ipCmd            /sbin/ip;
 killallCmd       /usr/bin/killall;
 netstatCmd       /bin/netstat;
 unameCmd         /bin/uname;
-whoisCmd         /usr/bin/whois_psad;
+whoisCmd         $INSTALL_ROOT/usr/bin/whois_psad;
 dfCmd            /bin/df;
-fwcheck_psadCmd  /usr/sbin/fwcheck_psad;
-psadwatchdCmd    /usr/sbin/psadwatchd;
-kmsgsdCmd        /usr/sbin/kmsgsd;
-psadCmd          /usr/sbin/psad;
+fwcheck_psadCmd  $INSTALL_ROOT/usr/sbin/fwcheck_psad;
+psadwatchdCmd    $INSTALL_ROOT/usr/sbin/psadwatchd;
+kmsgsdCmd        $INSTALL_ROOT/usr/sbin/kmsgsd;
+psadCmd          $INSTALL_ROOT/usr/sbin/psad;