3 ms·
Would you mind sharing your experience afterwards? The alternatives to SELinux in terms of network filtering seem to be so rare.
by phil294 6y ago
Would you mind sharing your experience afterwards? The alternatives to SELinux in terms of network filtering seem to be so rare.
- dijit 6y agoI can give you mine, since I use(d) opensnitch for a while. It works quite well but requires a GUI (obviously), it looks like it primarily supports GTK. If you're hoping to use the machine purely from the CLI (like, when sshing into your work machine) it won't work well. It is significantly less powerful than LittleSnitch, some options don't exist (like, allowing access to a domain), but you get similar functionality in many cases. Overall, it's definitely worth testing out to see if it works for you.
- qwerty456127 6y ago> It is significantly less powerful than LittleSnitch To make it no-less powerfull somebody has to invest time and expertise into extending the kernel for it - AFAIK LittleSnitch works this way on MacOS.
- gus_ 6y agoI think you haven't tested last versions. GUI is not GTK, but Qt. > If you're hoping to use the machine purely from the CLI (like, when sshing into your work machine) it won't work well. There's no cli tool published yet. There's a PoC though that works well. > some options don't exist (like, allowing access to a domain) Since version 1.0.0b you can filter by domain. And in latest version by domain, ip, network, uid, port, command line, command path, cmd environment variables, protocol, or any combination of them. You can't filter by interface, but if aomeone needs it open a new issue. > It is significantly less powerful than LittleSnitch What options do you miss?