3 ms·

Apparently, the whole things needs to be run as root, since it's all one huge blob. Hopefully, this'll eventually get separated into a daemon which does all th

Apparently, the whole things needs to be run as root, since it's all one huge blob. Hopefully, this'll eventually get separated into a daemon which does all the superuser bits and exposes a single API for a client GUI to consume.

rurban 9y ago
Yes, we can only hope. For the time being we should advise not using this as-is.
- wmccullough 9y ago
  Or perhaps, don't let perfect be the enemy of good?
arfp 9y ago
I've been working on a program that does this based on lpfw. It's not ready for release yet but there's a preview at https://fireprompt.com https://fireprompt.com. I'm hoping it's not eclipsed by OpenSnitch!
evilsocket 9y ago
OpenSnitch author here ... that's exactly the direction the project is going, C++ daemon running as root and low privileged UI in Python or whatever. The current implementation is more of a PoC/test to see the whole logic working before starting the real thing :)
- peterwwillis 9y ago
  Why C++? The backend only has to read ftrace events, and Python should be fast enough for that.... And why root? Can't you just create a dbus connection, open your fd to the ftrace pipe, and then drop privs to a nonroot user?
  - evilsocket 9y ago
    OpenSnitch is not only about ftrace, check the NFQUEUE handling, moving to native will improve performances and stability. Also, it requires root because that's the only way it can install the iptable rules it needs in order to function properly.
    - peterwwillis 9y ago
      The iptables rules are static though, aren't they? And they have bypass enabled, so you should be able to load them once at system boot time and leave them there to default to allow. As far as nfqueue, I googled around but I wasn't able to find out what perms you need in order to communicate with netlink. I assumed you could open an fd and drop perms but it looks like it might not allow that. I agree that eventually you'd need a pretty robust multithreaded app to handle large packet flows without adding too much latency... it seems like quite a big burden just to authorize specific applications to make specific network connections.
      - evilsocket 9y ago
        as long as i know, you definitely need root to communicate with netlink .... i don't think there're gonna be large packet flows, only first connection packets tnx to conntrack, it's doable :)
- hobarrera 9y ago
  I guessed as much, since I noticed the project is relatively young. Kudos on what's been done so far! ^_^

rurban 9y ago

Yes, we can only hope. For the time being we should advise not using this as-is.

wmccullough 9y ago
Or perhaps, don't let perfect be the enemy of good?

arfp 9y ago

I've been working on a program that does this based on lpfw. It's not ready for release yet but there's a preview at https://fireprompt.com https://fireprompt.com. I'm hoping it's not eclipsed by OpenSnitch!

evilsocket 9y ago

OpenSnitch author here ... that's exactly the direction the project is going, C++ daemon running as root and low privileged UI in Python or whatever. The current implementation is more of a PoC/test to see the whole logic working before starting the real thing :)

peterwwillis 9y ago
Why C++? The backend only has to read ftrace events, and Python should be fast enough for that.... And why root? Can't you just create a dbus connection, open your fd to the ftrace pipe, and then drop privs to a nonroot user?
- evilsocket 9y ago
  OpenSnitch is not only about ftrace, check the NFQUEUE handling, moving to native will improve performances and stability. Also, it requires root because that's the only way it can install the iptable rules it needs in order to function properly.
  - peterwwillis 9y ago
    The iptables rules are static though, aren't they? And they have bypass enabled, so you should be able to load them once at system boot time and leave them there to default to allow. As far as nfqueue, I googled around but I wasn't able to find out what perms you need in order to communicate with netlink. I assumed you could open an fd and drop perms but it looks like it might not allow that. I agree that eventually you'd need a pretty robust multithreaded app to handle large packet flows without adding too much latency... it seems like quite a big burden just to authorize specific applications to make specific network connections.
    - evilsocket 9y ago
      as long as i know, you definitely need root to communicate with netlink .... i don't think there're gonna be large packet flows, only first connection packets tnx to conntrack, it's doable :)
hobarrera 9y ago
I guessed as much, since I noticed the project is relatively young. Kudos on what's been done so far! ^_^