4 ms·

Make applications on your machine comply to whatever network policy you have? I honestly don't want to have to whitelist every single one program I run to be ab

by trezor 17y ago

Make applications on your machine comply to whatever network policy you have? I honestly don't want to have to whitelist every single one program I run to be able to do access the network. Do you? I'm also pretty sure changing firewall-rules requires administrator priveledges, and hence it's no different than it is on Linux. Except ofcourse on Linux, the firewall isn't application-aware, so you can't even control which processes are allowed to open inbound communication. This really is a lot of noise over nothing.

JadeNB 17y ago
> I honestly don't want to have to whitelist every single one program I run to be able to do access the network. Do you? Yes. How many programs do you have accessing the internet? I don't think that I've used, total, more than 10 or 11 programs that need internet access (and it's probably more like 3 or 4 for any given year or so); and I can live with that kind of one-time bother in exchange for knowing that other processes aren't chatting about me without my knowledge.
tene 17y ago
> Except of course on Linux, the firewall isn't application-aware, so you can't even control which processes are allowed to open inbound communication. You certainly can set application-level network privileges, and Red Hat derived distros do by default. For example, to list all the applications that are allowed to bind to port 80: [sweeks@kweh ~]$ sudo sesearch --allow -t http_port_t -p name_bind Found 15 semantic av rules: allow httpd_t http_port_t : tcp_socket { name_bind name_connect } ; allow kerneloops_t http_port_t : tcp_socket { name_bind name_connect } ; allow varnishd_t http_port_t : tcp_socket { name_bind name_connect } ; allow dnsmasq_t port_type : udp_socket { recv_msg send_msg name_bind } ; allow svirt_t port_type : tcp_socket { name_bind name_connect } ; allow svirt_t port_type : udp_socket { recv_msg send_msg name_bind } ; allow squid_t http_port_t : tcp_socket { name_bind name_connect } ; allow corenet_unconfined_type port_type : tcp_socket { recv_msg send_msg name_bind name_connect } ; allow portreserve_t port_type : tcp_socket name_bind ; allow corenet_unconfined_type port_type : udp_socket { recv_msg send_msg name_bind } ; allow portreserve_t port_type : udp_socket name_bind ; allow varnishd_t port_type : tcp_socket { name_bind name_connect } ; allow qemu_t port_type : tcp_socket { name_bind name_connect } ; allow qemu_t port_type : udp_socket { recv_msg send_msg name_bind } ; allow squid_t port_type : tcp_socket { name_bind name_connect } ; Any processes running under other domains won't be allowed to bind to port 80.

by trezor 17y ago

JadeNB 17y ago

> I honestly don't want to have to whitelist every single one program I run to be able to do access the network. Do you? Yes. How many programs do you have accessing the internet? I don't think that I've used, total, more than 10 or 11 programs that need internet access (and it's probably more like 3 or 4 for any given year or so); and I can live with that kind of one-time bother in exchange for knowing that other processes aren't chatting about me without my knowledge.

tene 17y ago

> Except of course on Linux, the firewall isn't application-aware, so you can't even control which processes are allowed to open inbound communication. You certainly can set application-level network privileges, and Red Hat derived distros do by default. For example, to list all the applications that are allowed to bind to port 80: [sweeks@kweh ~]$ sudo sesearch --allow -t http_port_t -p name_bind Found 15 semantic av rules: allow httpd_t http_port_t : tcp_socket { name_bind name_connect } ; allow kerneloops_t http_port_t : tcp_socket { name_bind name_connect } ; allow varnishd_t http_port_t : tcp_socket { name_bind name_connect } ; allow dnsmasq_t port_type : udp_socket { recv_msg send_msg name_bind } ; allow svirt_t port_type : tcp_socket { name_bind name_connect } ; allow svirt_t port_type : udp_socket { recv_msg send_msg name_bind } ; allow squid_t http_port_t : tcp_socket { name_bind name_connect } ; allow corenet_unconfined_type port_type : tcp_socket { recv_msg send_msg name_bind name_connect } ; allow portreserve_t port_type : tcp_socket name_bind ; allow corenet_unconfined_type port_type : udp_socket { recv_msg send_msg name_bind } ; allow portreserve_t port_type : udp_socket name_bind ; allow varnishd_t port_type : tcp_socket { name_bind name_connect } ; allow qemu_t port_type : tcp_socket { name_bind name_connect } ; allow qemu_t port_type : udp_socket { recv_msg send_msg name_bind } ; allow squid_t port_type : tcp_socket { name_bind name_connect } ; Any processes running under other domains won't be allowed to bind to port 80.