diff --git a/appliance/packagelist.in b/appliance/packagelist.in
index 0a71cc30e..96d5ffcc3 100644
--- a/appliance/packagelist.in
+++ b/appliance/packagelist.in
@@ -52,6 +52,7 @@ ifelse(REDHAT,1,
   vim-minimal
   xz
   yajl
+  yara
   zfs-fuse
 )
 
@@ -86,6 +87,7 @@ dnl iproute has been renamed to iproute2
   libsystemd-journal0
   libtirpc1
   libyajl2
+  libyara3
   linux-image
   dnl syslinux 'suggests' mtools, but in reality it's a hard dependency:
   mtools
@@ -129,6 +131,7 @@ ifelse(ARCHLINUX,1,
   vim
   xz
   yajl
+  yara
 )
 
 ifelse(SUSE,1,
@@ -160,6 +163,7 @@ ifelse(SUSE,1,
   systemd
   vim
   xz
+  yara
 )
 
 ifelse(FRUGALWARE,1,
diff --git a/daemon/Makefile.am b/daemon/Makefile.am
index b46dd5fd3..ca01aeb4e 100644
--- a/daemon/Makefile.am
+++ b/daemon/Makefile.am
@@ -193,7 +193,8 @@ guestfsd_LDADD = \
 	$(SERVENT_LIB) \
 	$(PCRE_LIBS) \
 	$(TSK_LIBS) \
-	$(RPC_LIBS)
+	$(RPC_LIBS) \
+	$(YARA_LIBS)
 
 guestfsd_CPPFLAGS = \
 	-I$(top_srcdir)/gnulib/lib \
diff --git a/docs/guestfs-building.pod b/docs/guestfs-building.pod
index bfb46a02f..6e89acfc8 100644
--- a/docs/guestfs-building.pod
+++ b/docs/guestfs-building.pod
@@ -427,6 +427,10 @@ Optional.  For tab-completion of commands in bash.
 
 Optional.  Library for filesystem forensics analysis.
 
+=item yara
+
+Optional.  Tool for categorizing files based on their content.
+
 =back
 
 =head1 BUILDING FROM GIT
diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4
index eb5a6d5cf..522cd5f0e 100644
--- a/m4/guestfs_daemon.m4
+++ b/m4/guestfs_daemon.m4
@@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[
         AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.])
     ], [])
 ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])])
+
+dnl yara library (optional)
+PKG_CHECK_MODULES([YARA], [libyara],[
+    AC_SUBST([YARA_CFLAGS])
+    AC_SUBST([YARA_LIBS])
+    AC_DEFINE([HAVE_YARA],[1],[yara library found at compile time.])
+],[
+    AC_CHECK_LIB([yara],[yr_initialize],[
+        AC_CHECK_HEADER([yara.h],[
+            AC_SUBST([YARA_LIBS], [-lyara])
+            AC_DEFINE([HAVE_YARA], [1], [Define to 1 if Yara library is available.])
+        ], [])
+    ],[AC_MSG_WARN([Yara library not found])])
+])