5 ms·

So does this make it easier for Linux to have a version of Little Snitch?

pantalaimon 9y ago
There is https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch Haven't used it though.
brendangregg 9y ago
I haven't used Little Snitch, but if it's a firewall then yes, this work is related to the eBPF work in Linux, which has been used for custom firewalls. There's a lot of work in this space, so I don't know where best to start. One example is cilium: https://github.com/cilium/cilium https://github.com/cilium/cilium
- LamaOfRuin 9y ago
  Aha, that looks great. Yes, it's a firewall/network monitor, which monitors/controls network traffic tied to specific applications. That does appear to be the level 7 piece in cilium that, based on my naive reading of older attempts at Little Snitch-alike projects, was difficult, unreliable, and costly to do. Now I can confirm my excitement about these developments, even if I don't really understand them. :)
  - rkeene2 9y ago
    A "Little Snitch"-like system for Linux would be pretty easy to develop without these changes as well. I've thought about building such a tool, but never really had the need or saw the point over my existing workflows. I did once (over 10 years ago now) develop a tool that would, upon receiving a packet from a new source, perform an OS fingerprint on it and if it turned out to be Microsoft Windows, block it once the fingerprinting process returned... :-) This tool actually just fired off a script (JIT compiled) for every packet that matched pre-defined criteria and that script could return a verdict on what to do with that packet, which could involve inspecting userspace connections trivially
sargun 9y ago
I think the cgroup BPF filters align more with what Little Snitch can do as opposed to the TCP tracepoints. In modern versions of systemd, you can restrict a given network application to only having access to specific IPs via this mechanism.
- LamaOfRuin 9y ago
  It's more about starting out with being able to see what network activity specific applications are causing before you try to define what's allowed. There are a lot of programs running on my linux desktop that I would first need to monitor before I can decide if they should be restricted (or simply uninstalled).

There is https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch Haven't used it though.

I haven't used Little Snitch, but if it's a firewall then yes, this work is related to the eBPF work in Linux, which has been used for custom firewalls. There's a lot of work in this space, so I don't know where best to start. One example is cilium: https://github.com/cilium/cilium https://github.com/cilium/cilium

LamaOfRuin 9y ago
Aha, that looks great. Yes, it's a firewall/network monitor, which monitors/controls network traffic tied to specific applications. That does appear to be the level 7 piece in cilium that, based on my naive reading of older attempts at Little Snitch-alike projects, was difficult, unreliable, and costly to do. Now I can confirm my excitement about these developments, even if I don't really understand them. :)
- rkeene2 9y ago
  A "Little Snitch"-like system for Linux would be pretty easy to develop without these changes as well. I've thought about building such a tool, but never really had the need or saw the point over my existing workflows. I did once (over 10 years ago now) develop a tool that would, upon receiving a packet from a new source, perform an OS fingerprint on it and if it turned out to be Microsoft Windows, block it once the fingerprinting process returned... :-) This tool actually just fired off a script (JIT compiled) for every packet that matched pre-defined criteria and that script could return a verdict on what to do with that packet, which could involve inspecting userspace connections trivially

sargun 9y ago

I think the cgroup BPF filters align more with what Little Snitch can do as opposed to the TCP tracepoints. In modern versions of systemd, you can restrict a given network application to only having access to specific IPs via this mechanism.

LamaOfRuin 9y ago
It's more about starting out with being able to see what network activity specific applications are causing before you try to define what's allowed. There are a lot of programs running on my linux desktop that I would first need to monitor before I can decide if they should be restricted (or simply uninstalled).