3 ms·
only problem is that you can’t get the process ID for inbound packets like FreeBSD can, for that still remains Linux’s weakest feature. — The said feature is c
by egberts 6y ago
only problem is that you can’t get the process ID for inbound packets like FreeBSD can, for that still remains Linux’s weakest feature.
— The said feature is critical to proper DEFAULT-DENY firewall configuration/modeling.
- harporoeder 6y agoI have not attempted it but I believe this can be accomplished with eBPF https://elixir.bootlin.com/linux/v4.0/source/include/linux/security.h#L2700 https://elixir.bootlin.com/linux/v4.0/source/include/linux/s...
- egberts 6y agoI don’t see a single parameter of the process ID.
- harporoeder 6y agoWell yes you don't get it with a parameter you get it with this helper function while in those contexts `bpf_get_current_pid_tgid`. Edit to provide link: https://elixir.bootlin.com/linux/v4.6/source/samples/bpf/bpf_helpers.h#L28 https://elixir.bootlin.com/linux/v4.6/source/samples/bpf/bpf...
- egberts 6y agoUsing same bootlin search engine using your link, function nor variable not found. Furthermore, the process ID is not yet identified at early inbound stage of EBPD. We would be talking about being past the pre-inbound stage, post-table-lookup stage, and specifically just during the input-to-user land stage.
- spyc 6y agoCould you elaborate why that's critical to have?
- egberts 6y agoIRL, we are unable to force systemd NOT to use any network ports for security reason due to absence of Linux firewall ability to deal with this process ID on inbound packets. Hence, OpenRC enters the picture instead just to ensure that network port is not being used. Also, premise of the DEFAULT-DENY firewall modeling is to pinhole open the port(s) on a per-process (or per-parent-process group) basis.