Control: tags 1068797 + patch Attached is a patch changing both IncludeOptional directives in debian/owasp-crs.load to Include, matching what you (Ervin) already confirmed in this thread is upstream's own recommendation since CRS v4.
Verified before making the change, rather than assuming the reporter's claim: both referenced files (REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf and RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf) are unconditionally installed by debian/rules (the .conf.example -> .conf move happens unconditionally, not behind any flag), so Include is safe for the default, unmodified case. One tradeoff worth being explicit about: debian/README.Debian documents these two files as living under /etc/modsecurity/crs/ specifically because they're meant to be user-editable, which makes them very likely dpkg conffiles. If an existing Apache user has deliberately deleted one of these conffiles as part of local customization, this change turns that into a config load failure instead of a silent skip. Given nginx cannot use IncludeOptional at all today -- meaning nginx users are currently forced to hand-patch this same conffile on every single upgrade just to get CRS working -- and upstream's own stated direction is Include for all cases since v4, this seems like the right tradeoff, but flagging it rather than glossing over it. Patch applies cleanly against a fresh pristine 3.3.9-1 source tree. Changes: - debian/owasp-crs.load (two directives changed) - debian/changelog
diff -ruN '--exclude=.pc' pristine-crs/debian/changelog modsecurity-crs-3.3.9/debian/changelog --- pristine-crs/debian/changelog 2026-03-29 15:21:27.000000000 +0000 +++ modsecurity-crs-3.3.9/debian/changelog 2026-10-07 07:42:19.077717650 +0000 @@ -1,3 +1,16 @@ +modsecurity-crs (3.3.9-2) UNRELEASED; urgency=medium + + * Change IncludeOptional to Include for the two exclusion-rule files + in owasp-crs.load (Closes: #1068797). nginx's mod_security + connector does not support IncludeOptional at all, forcing nginx + users to hand-patch this conffile on every upgrade; both files are + unconditionally installed by debian/rules, so Include is safe for + the default case. Matches upstream's own recommendation to use + Include for nginx compatibility since CRS v4. Note for Apache + users: this does mean a config load failure instead of a silent + skip if either conffile has been deliberately removed locally. + + -- Stefan Andrei Ionut <[email protected]> Wed, 7 Oct 2026 10:42:11 +0300 modsecurity-crs (3.3.9-1) unstable; urgency=medium * New upstream version 3.3.9 diff -ruN '--exclude=.pc' pristine-crs/debian/owasp-crs.load modsecurity-crs-3.3.9/debian/owasp-crs.load --- pristine-crs/debian/owasp-crs.load 2023-03-22 16:17:38.000000000 +0000 +++ modsecurity-crs-3.3.9/debian/owasp-crs.load 2026-10-07 07:42:06.933407227 +0000 @@ -3,6 +3,6 @@ ## It is Included by libapache2-mod-security2 ## Include /etc/modsecurity/crs/crs-setup.conf -IncludeOptional /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf +Include /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf Include /usr/share/modsecurity-crs/rules/*.conf -IncludeOptional /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf +Include /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
