4 ms·

> That way only locally running programs can access your service A web browser is a locally running program. You mean, of course, that access to the socket ca

> That way only locally running programs can access your service A web browser is a locally running program. You mean, of course, that access to the socket can be limited to programs running under a user account sufficiently privileged to read and/or write to the socket file. Can all services be made to communicate only through domain sockets? I agree that choosing randomly from the available loopback addresses and/or ports isn't providing any real security; it surely wouldn't take the web browser very long to make a connection to every port in the 127/8 address range.

dividuum 10y ago
> A web browser is a locally running program That is of course correct. I should have worded it a bit more technical, I guess :-) Support of unix domain sockets depends on the program, so not all support that, but Redis and memcache do. At least for those you can prevent the browser from connecting to them using TCP. I guess another option would be to just limit what ports a browser can access. Some ports a blocked by default, but I feel like a whitelist instead of a blacklist makes more sense and I'm fairly certain that most of my daily browser usage would still work if only 80, 443 and maybe 8080 would be whitelisted. Is there a way to archive this (in chrome/Firefox) without reverting to some outside sandbox?
- bahjoite 10y ago
  > limit what ports a browser can access After briefly looking into this:- - there doesn't seem to be a way to configure firefox with a whitelist of ports it may connect to - AppArmor doesn't appear to yet be capable of constraining network access at the level of IP address or port number - The good news is that it should be possible to use linux network namespaces along with iptables - I've not attempted it
minitech 10y ago
> You mean, of course, that access to the socket can be limited to programs running under a user account sufficiently privileged to read and/or write to the socket file. They might mean instead that browsers can’t access domain sockets.

dividuum 10y ago

> A web browser is a locally running program That is of course correct. I should have worded it a bit more technical, I guess :-) Support of unix domain sockets depends on the program, so not all support that, but Redis and memcache do. At least for those you can prevent the browser from connecting to them using TCP. I guess another option would be to just limit what ports a browser can access. Some ports a blocked by default, but I feel like a whitelist instead of a blacklist makes more sense and I'm fairly certain that most of my daily browser usage would still work if only 80, 443 and maybe 8080 would be whitelisted. Is there a way to archive this (in chrome/Firefox) without reverting to some outside sandbox?

bahjoite 10y ago
> limit what ports a browser can access After briefly looking into this:- - there doesn't seem to be a way to configure firefox with a whitelist of ports it may connect to - AppArmor doesn't appear to yet be capable of constraining network access at the level of IP address or port number - The good news is that it should be possible to use linux network namespaces along with iptables - I've not attempted it

minitech 10y ago

> You mean, of course, that access to the socket can be limited to programs running under a user account sufficiently privileged to read and/or write to the socket file. They might mean instead that browsers can’t access domain sockets.