13 ms·

Douane: Linux personal firewall with per application rule controls

135 points by severine 6y ago

severine 6y ago
Previous discussion, 4 years ago: https://news.ycombinator.com/item?id=13450226 https://news.ycombinator.com/item?id=13450226 (131 points, 45 comments)
rdn 6y ago
After the Big Sur update, I realized Little Snitch was the last reason I was sticking with MacOS. Now I have no reason. I really hope Linux gets a viable alternative to Little Snitch, such as this Douane, or OpenSnitch.
- m463 6y ago
  I've been thinking the same thing. Take that away and I would... (maybe stay on an old version of macos where I can block apple) Honestly I feed my macos box through a web proxy (currently privoxy) and block the crap out of everything.
- temptemptemp111 6y ago
  Couldn't one be implemented using Wireguard kernel module?
- lukami 6y ago
  OpenSnitch has been abandoned. Fortunately, this fork is actively being developed and looks very promising: https://github.com/gustavo-iniguez-goya/opensnitch https://github.com/gustavo-iniguez-goya/opensnitch
  - beagle3 6y ago
    An overlooked feature of opensnitch is that the packet filter can run on a gateway (say, OpenWRT) and the GUI on any station. That’s something I’m missing with little snitch.
    - deleted 6y ago
      [deleted]
- sneak 6y ago
  I still think the new (since Catalina) macOS per-app, per-directory permissions is critical to avoid being vulnerable to ransomware. Not everything that runs as my uid should have access to everything my posix permissions allow, especially ~/Documents and such. Dockerizing every GUI app I run is going to be a pain, otherwise.
  - 1over137 6y ago
    It'd be nice to have both. But with Big Sur crippling Little Snitch, like rdn, I too am looking to bail from Apple. One can be selective in the apps one chooses to install, but one can no longer block Apple's telemetry and cloud stuff. Pity. I've been Apple-only since the Apple IIgs.
    - miles 6y ago
      > one can no longer block Apple's telemetry and cloud stuff Here are two workarounds: Install Little Snitch 4.6 instead of 5: https://www.obdev.at/support/littlesnitch/245913651253917 https://www.obdev.at/support/littlesnitch/245913651253917 Hacky method to disable Apple's exceptions: https://tinyapps.org/blog/202010210700_whose_computer_is_it.html https://tinyapps.org/blog/202010210700_whose_computer_is_it....
      - sneak 6y ago
        That first link is gold! The second one is bad because you can't disable the signed system (readonly) root without disabling FileVault and leaving it disabled, which is a showstopper for me. Will 4.x be installable on ARM? I imagine the kernel extension needs to match the arch of the kernel, and because ARM macs don't run anything before Big Sur, I imagine only 5.x has ARM builds available?
  - XorNot 6y ago
    Isn't this pretty much SELinux?
    - hxtk 6y ago
cmroanirgo 6y ago
> Warning: unfortunately the project is suffering of a kernel freeze bug [0] that can break your machine! > You can follow the bug resolution from this issue. Have a look at the Roadmap [1] to see when this issue should be fixed! > The current version is 0.8.2 This does not seem to be the fastest of projects... The bug was reported 6 years ago. From the bug report (6 months ago): > So, could a noob use it already without breaking the computer? > No, not yet [0] https://gitlab.com/douaneapp/douane-dkms/-/issues/3 https://gitlab.com/douaneapp/douane-dkms/-/issues/3 [1] https://douaneapp.com/#roadmap https://douaneapp.com/#roadmap
grantseltzer 6y ago
I don't see a reason to implement anything like this without using bpf.
- tuzakey 6y ago
  Right!? That's the first thing I looked for in the project page. I'm really surprised it isn't using ebpf, but netfilter and a kernel module let them run back on 2.4 (but why?) I'm waiting for a bpf based solution to pop up as I think it will be superior in performance, ability, and maintainability.
- kortilla 6y ago
  The same reason that all new C projects aren’t being written in rust. There is a lot of expertise floating around in the ~30ish years of netfilter so that is a ton of momentum in terms of the personal expertise of more experienced devs as well as the blogs/tutorials available when you search for “network filtering Linux”. The default of kubernetes is still huge iptables chains and the only realistic ebpf alternative is mainly driven by a currently unsustainable startup (Cilium). The maturity just isn’t there yet.
  - grantseltzer 6y ago
    I believe Cilium (ebpf based) is now default in kubernetes.
    - pepemon 6y ago
      Can you elaborate more on the source of your belief?
- tifadg1 6y ago
  BPF is so cool, yet so inaccessible so most tinkerers. If it had Python bindings I'd start using it today, but as is - it's esoteric.
  - grantseltzer 6y ago
azalemeth 6y ago
An alternative that does not come with a potentially machine-bricking kernel panic bug is Opensnitch [1], last updated 14 months ago with a change to "funding.yaml" asking for donations. A fork seems to be relatively alive [2] and I use it personally -- it works well, but is a bit of a PITA to build. Time to buy the devs a coffee... [1] https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch [2] https://github.com/gustavo-iniguez-goya/opensnitch https://github.com/gustavo-iniguez-goya/opensnitch
- lukami 6y ago
  I second that fork [2]. It is very actively developed and it's already a huge improvement over the original project. But why do you have to build it? It has rpm and deb packages readily available.
- josephcsible 6y ago
  I wouldn't call a kernel panic bug "machine-bricking", since after the panic happens, your system is usable again upon reboot. "Bricking" implies that wouldn't be the case.
scaramanga 6y ago
A quick look at the code reveals a kernel module with major security vulnerabilities, so I wouldn't call it "privacy respecting." Avoid...
- andrewnicolalde 6y ago
  Which vulnerabilities?
nathants 6y ago
i also built off the original opensnitch[1]. libnetfilterqueue is really great. i used bpftrace instead of ftrace to get the process metadata, but eventually removed it after frustration building bpftrace. currently it is a global inbound/outbound firewall with ui prompts. i’ve recently had success running archlinux packaged bpftrace in a privileged container, so will be adding process metadata back in soon. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch
TedDoesntTalk 6y ago
“ You need to enable JavaScript to run this app.” Why? What does JavaScript have to do with a personal firewall?
n0nc3 6y ago
Privacy tooling should not come from a page that does not work without javascript. Moreover, this functionality is easy to achieve using user groups and the iptables owner module. Here's an example that prevents atom from leaking telemetry. # add group atomblind sudo groupadd atomblind # add your username to atomblind group sudo usermod -a -G atomblind <username> # do not allow outbound traffic from group atomblind sudo iptables -I OUTPUT -m owner --gid-owner atomblind -j DROP # overwrite atom binary with a hook # atom_binary is absolute path to your atom binary echo "#!/bin/bash" > atom_hook echo "sg atomblind -c 'atom_binary'" >> atom_hook chmod +x atom_hook ./atom_hook
- tifadg1 6y ago
  it's never this straight-forwarding. What if I want the app to have partial connectivity?
  - n0nc3 6y ago
    Then create a separate chain with the "partial connectivity" rules you want and jump to that. Not everyone is comfortable running random github code as root.
demosito666 6y ago
Do I get it correctly that the only reason for the kernel module is to be able to show GUI popup live when an app accesses the network for the first time? Because otherwise I believe it's easier to mark the packets with selinux and then filter them with netfilter.
- n0nc3 6y ago
  For us mortals, SELinux is a synonym for "complicated, scary thing that I don't know how to use properly". Can you link to something with minimal working "mark and block" examples?
  - hxtk 6y ago
    Here's a short article on it by Dan "Mr. SELinux" Walsh himself [1]. To understand it, though, you need to understand at least a little bit about type enforcement, which is a somewhat steep learning curve to get over. If you have nftables (replaces iptables, default back-end to firewalld in RHEL 8), you might consult /usr/share/doc/nftables/examples/secmark.nft but again, this requires some background on nftables (or iptables—they're both just front-ends to the kernel netfilter module) and are pretty similar. However it's also worth noting that most one could also stand to learn a thing or two about netfilter if this is a topic they're interested in. For example, netfilter allows you to filter packets based on the user, group, or pid of the process. I found this page [2] quite helpful, and especially the packet flow diagram contained within it. [1]: https://www.linux.com/training-tutorials/using-selinux-and-iptables-together/ https://www.linux.com/training-tutorials/using-selinux-and-i... [2]: https://www.booleanworld.com/depth-guide-iptables-linux-firewall/ https://www.booleanworld.com/depth-guide-iptables-linux-fire...
    - touisteur 6y ago
      User, group and pid of the process are available through iptables. Really a great, simple way (in addition to other stuff) to compartmentalize complex applications. Shame it doesn't cross machine boundaries :-) (I know it's stupid but I like the simple user+group abstraction.
andikleen2 6y ago
Seems trivial to exploit the kernel module: struct network_activity * activity = NLMSG_DATA(nlh); <untrusted data from the netlink socket> append_rule(activity->process_path, (activity->allowed == 1)); ... append_rule: // Don't do anything if the process_path length is > PATH_LENGTH if (strlen(process_path) > PATH_LENGTH) return; But nobody enforces the process_path has a terminating 0 byte, so likely it can be abused for all kinds of attacks on the kernel. Better don't run it anywhere you care about security. I found this from about 2 minutes code reading, so likely there wasn't any code audit done ever.

135 points by severine 6y ago

Previous discussion, 4 years ago: https://news.ycombinator.com/item?id=13450226 https://news.ycombinator.com/item?id=13450226 (131 points, 45 comments)

rdn 6y ago

After the Big Sur update, I realized Little Snitch was the last reason I was sticking with MacOS. Now I have no reason. I really hope Linux gets a viable alternative to Little Snitch, such as this Douane, or OpenSnitch.

m463 6y ago
I've been thinking the same thing. Take that away and I would... (maybe stay on an old version of macos where I can block apple) Honestly I feed my macos box through a web proxy (currently privoxy) and block the crap out of everything.
temptemptemp111 6y ago
Couldn't one be implemented using Wireguard kernel module?
lukami 6y ago
OpenSnitch has been abandoned. Fortunately, this fork is actively being developed and looks very promising: https://github.com/gustavo-iniguez-goya/opensnitch https://github.com/gustavo-iniguez-goya/opensnitch
- beagle3 6y ago
  An overlooked feature of opensnitch is that the packet filter can run on a gateway (say, OpenWRT) and the GUI on any station. That’s something I’m missing with little snitch.
  - deleted 6y ago
    [deleted]
sneak 6y ago
I still think the new (since Catalina) macOS per-app, per-directory permissions is critical to avoid being vulnerable to ransomware. Not everything that runs as my uid should have access to everything my posix permissions allow, especially ~/Documents and such. Dockerizing every GUI app I run is going to be a pain, otherwise.
- 1over137 6y ago
  It'd be nice to have both. But with Big Sur crippling Little Snitch, like rdn, I too am looking to bail from Apple. One can be selective in the apps one chooses to install, but one can no longer block Apple's telemetry and cloud stuff. Pity. I've been Apple-only since the Apple IIgs.
  - miles 6y ago
    > one can no longer block Apple's telemetry and cloud stuff Here are two workarounds: Install Little Snitch 4.6 instead of 5: https://www.obdev.at/support/littlesnitch/245913651253917 https://www.obdev.at/support/littlesnitch/245913651253917 Hacky method to disable Apple's exceptions: https://tinyapps.org/blog/202010210700_whose_computer_is_it.html https://tinyapps.org/blog/202010210700_whose_computer_is_it....
    - sneak 6y ago
      That first link is gold! The second one is bad because you can't disable the signed system (readonly) root without disabling FileVault and leaving it disabled, which is a showstopper for me. Will 4.x be installable on ARM? I imagine the kernel extension needs to match the arch of the kernel, and because ARM macs don't run anything before Big Sur, I imagine only 5.x has ARM builds available?
- XorNot 6y ago
  Isn't this pretty much SELinux?
  - hxtk 6y ago

cmroanirgo 6y ago

> Warning: unfortunately the project is suffering of a kernel freeze bug [0] that can break your machine! > You can follow the bug resolution from this issue. Have a look at the Roadmap [1] to see when this issue should be fixed! > The current version is 0.8.2 This does not seem to be the fastest of projects... The bug was reported 6 years ago. From the bug report (6 months ago): > So, could a noob use it already without breaking the computer? > No, not yet [0] https://gitlab.com/douaneapp/douane-dkms/-/issues/3 https://gitlab.com/douaneapp/douane-dkms/-/issues/3 [1] https://douaneapp.com/#roadmap https://douaneapp.com/#roadmap

grantseltzer 6y ago

I don't see a reason to implement anything like this without using bpf.

tuzakey 6y ago
Right!? That's the first thing I looked for in the project page. I'm really surprised it isn't using ebpf, but netfilter and a kernel module let them run back on 2.4 (but why?) I'm waiting for a bpf based solution to pop up as I think it will be superior in performance, ability, and maintainability.
kortilla 6y ago
The same reason that all new C projects aren’t being written in rust. There is a lot of expertise floating around in the ~30ish years of netfilter so that is a ton of momentum in terms of the personal expertise of more experienced devs as well as the blogs/tutorials available when you search for “network filtering Linux”. The default of kubernetes is still huge iptables chains and the only realistic ebpf alternative is mainly driven by a currently unsustainable startup (Cilium). The maturity just isn’t there yet.
- grantseltzer 6y ago
  I believe Cilium (ebpf based) is now default in kubernetes.
  - pepemon 6y ago
    Can you elaborate more on the source of your belief?
tifadg1 6y ago
BPF is so cool, yet so inaccessible so most tinkerers. If it had Python bindings I'd start using it today, but as is - it's esoteric.
- grantseltzer 6y ago

azalemeth 6y ago

An alternative that does not come with a potentially machine-bricking kernel panic bug is Opensnitch [1], last updated 14 months ago with a change to "funding.yaml" asking for donations. A fork seems to be relatively alive [2] and I use it personally -- it works well, but is a bit of a PITA to build. Time to buy the devs a coffee... [1] https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch [2] https://github.com/gustavo-iniguez-goya/opensnitch https://github.com/gustavo-iniguez-goya/opensnitch

lukami 6y ago
I second that fork [2]. It is very actively developed and it's already a huge improvement over the original project. But why do you have to build it? It has rpm and deb packages readily available.
josephcsible 6y ago
I wouldn't call a kernel panic bug "machine-bricking", since after the panic happens, your system is usable again upon reboot. "Bricking" implies that wouldn't be the case.

scaramanga 6y ago

A quick look at the code reveals a kernel module with major security vulnerabilities, so I wouldn't call it "privacy respecting." Avoid...

andrewnicolalde 6y ago
Which vulnerabilities?

nathants 6y ago

i also built off the original opensnitch[1]. libnetfilterqueue is really great. i used bpftrace instead of ftrace to get the process metadata, but eventually removed it after frustration building bpftrace. currently it is a global inbound/outbound firewall with ui prompts. i’ve recently had success running archlinux packaged bpftrace in a privileged container, so will be adding process metadata back in soon. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch

TedDoesntTalk 6y ago

“ You need to enable JavaScript to run this app.” Why? What does JavaScript have to do with a personal firewall?

n0nc3 6y ago

Privacy tooling should not come from a page that does not work without javascript. Moreover, this functionality is easy to achieve using user groups and the iptables owner module. Here's an example that prevents atom from leaking telemetry. # add group atomblind sudo groupadd atomblind # add your username to atomblind group sudo usermod -a -G atomblind <username> # do not allow outbound traffic from group atomblind sudo iptables -I OUTPUT -m owner --gid-owner atomblind -j DROP # overwrite atom binary with a hook # atom_binary is absolute path to your atom binary echo "#!/bin/bash" > atom_hook echo "sg atomblind -c 'atom_binary'" >> atom_hook chmod +x atom_hook ./atom_hook

tifadg1 6y ago
it's never this straight-forwarding. What if I want the app to have partial connectivity?
- n0nc3 6y ago
  Then create a separate chain with the "partial connectivity" rules you want and jump to that. Not everyone is comfortable running random github code as root.

demosito666 6y ago

Do I get it correctly that the only reason for the kernel module is to be able to show GUI popup live when an app accesses the network for the first time? Because otherwise I believe it's easier to mark the packets with selinux and then filter them with netfilter.

n0nc3 6y ago
For us mortals, SELinux is a synonym for "complicated, scary thing that I don't know how to use properly". Can you link to something with minimal working "mark and block" examples?
- hxtk 6y ago
  Here's a short article on it by Dan "Mr. SELinux" Walsh himself [1]. To understand it, though, you need to understand at least a little bit about type enforcement, which is a somewhat steep learning curve to get over. If you have nftables (replaces iptables, default back-end to firewalld in RHEL 8), you might consult /usr/share/doc/nftables/examples/secmark.nft but again, this requires some background on nftables (or iptables—they're both just front-ends to the kernel netfilter module) and are pretty similar. However it's also worth noting that most one could also stand to learn a thing or two about netfilter if this is a topic they're interested in. For example, netfilter allows you to filter packets based on the user, group, or pid of the process. I found this page [2] quite helpful, and especially the packet flow diagram contained within it. [1]: https://www.linux.com/training-tutorials/using-selinux-and-iptables-together/ https://www.linux.com/training-tutorials/using-selinux-and-i... [2]: https://www.booleanworld.com/depth-guide-iptables-linux-firewall/ https://www.booleanworld.com/depth-guide-iptables-linux-fire...
  - touisteur 6y ago
    User, group and pid of the process are available through iptables. Really a great, simple way (in addition to other stuff) to compartmentalize complex applications. Shame it doesn't cross machine boundaries :-) (I know it's stupid but I like the simple user+group abstraction.

andikleen2 6y ago

Seems trivial to exploit the kernel module: struct network_activity * activity = NLMSG_DATA(nlh); <untrusted data from the netlink socket> append_rule(activity->process_path, (activity->allowed == 1)); ... append_rule: // Don't do anything if the process_path length is > PATH_LENGTH if (strlen(process_path) > PATH_LENGTH) return; But nobody enforces the process_path has a terminating 0 byte, so likely it can be abused for all kinds of attacks on the kernel. Better don't run it anywhere you care about security. I found this from about 2 minutes code reading, so likely there wasn't any code audit done ever.