5 ms·

Show HN: Picosnitch – a reliable and lightweight security/privacy tool for Linux

92 points by elesiuta 5y ago

elesiuta 5y ago
Picosnitch tracks every executable that connects to the internet and notifies you the first time something connects, or if the hash changes (it can also check VirusTotal). There is also a simple curses based UI for browsing and filtering the connection logs (time, executable, hash, domain, IP address, etc). It was designed using eBPF and fanotify to be extremely reliable, use very little system resources, and does not impact network performance. The entire program is only ~1500 lines.
- elesiuta 5y ago
  One thing I forgot to mention is that by using hashes to identify executables, picosnitch can provide more reliable intrusion detection since different executables can appear to be located on the same path. For example, it can successfully identify whether curl being run from inside a docker container is the same or different from curl being run on your system, even if they both appear to be located at /usr/bin/curl. To improve performance, hashes are cached based on the device and inode of the executable, and watched with fanotify to trigger a rehash if the executable is modified.
theamk 5y ago
I was curious how does session notification from system service works -- what if there is no one logged in? What if there are multiple users? How about ssh connections? The answer is as following: - user's dbus session is used for notifications. On systemd systems, user's dbus socket is in fixed, predictable location, and only depends on username. The script hardcodes this location. - The normal install procedure records the username of the user who called "install" command and uses their session for notification [0]. So if user "alice" run the install command, and user "john" is logged in, no notifications will be delivered. - If installer user is not available, an arbitrary user is chosen [1] (!) and program just expect them to be logged in. This happens when installing a .deb file for example. - If the user is not logged in, or has logged out, the notifications are enqueued and would be shown once user is logged back in. Overall, this is a bit simplistic and will fail in some multi-user situations... but it still covers most common cases (a single user on the system) and in the spirit of "lightweight" tool. [0] https://github.com/elesiuta/picosnitch/blob/master/picosnitch.py#L1383 https://github.com/elesiuta/picosnitch/blob/master/picosnitc... [1] https://github.com/elesiuta/picosnitch/blob/master/picosnitch.py#L67 https://github.com/elesiuta/picosnitch/blob/master/picosnitc...
- icedchai 5y ago
  Seems odd that it lists /home to pick a user, instead of getpwent.
nix0n 5y ago
> blocking or sandboxing... programs is out of scope for picosnitch This is reasonable. Can someone recommend a tool (preferably in the Ubuntu repos) for doing that?
- pabs3 5y ago
  Look at things like firejail, bubblewrap (which Flatpak uses) or switch to an OS like Qubes.
- sliken 5y ago
  Not sure what your goals are specifically, but even apparmor and selinux can do things like block access to the network, limit read and/or write access to certain directories, limiting what system calls can be made, and notify you of failed attempts. I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you.
  - Anonymous4272 5y ago
    >I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you. And does this happen on android aswell? Because a lot of custom rom/ root users run selinux as permissive for compatibility, so these pdfs would have full network access
- tskx2003 5y ago
  I use opensnitch, is mentioned above as well. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch
pabs3 5y ago
Some similarish things mentioned on the Debian privacy issues page: https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch https://github.com/kushaldas/unoon https://github.com/kushaldas/unoon https://github.com/nsntrace/nsntrace https://github.com/nsntrace/nsntrace https://wiki.debian.org/PrivacyIssues#Detection_tools https://wiki.debian.org/PrivacyIssues#Detection_tools

92 points by elesiuta 5y ago

Picosnitch tracks every executable that connects to the internet and notifies you the first time something connects, or if the hash changes (it can also check VirusTotal). There is also a simple curses based UI for browsing and filtering the connection logs (time, executable, hash, domain, IP address, etc). It was designed using eBPF and fanotify to be extremely reliable, use very little system resources, and does not impact network performance. The entire program is only ~1500 lines.

elesiuta 5y ago
One thing I forgot to mention is that by using hashes to identify executables, picosnitch can provide more reliable intrusion detection since different executables can appear to be located on the same path. For example, it can successfully identify whether curl being run from inside a docker container is the same or different from curl being run on your system, even if they both appear to be located at /usr/bin/curl. To improve performance, hashes are cached based on the device and inode of the executable, and watched with fanotify to trigger a rehash if the executable is modified.

theamk 5y ago

I was curious how does session notification from system service works -- what if there is no one logged in? What if there are multiple users? How about ssh connections? The answer is as following: - user's dbus session is used for notifications. On systemd systems, user's dbus socket is in fixed, predictable location, and only depends on username. The script hardcodes this location. - The normal install procedure records the username of the user who called "install" command and uses their session for notification [0]. So if user "alice" run the install command, and user "john" is logged in, no notifications will be delivered. - If installer user is not available, an arbitrary user is chosen [1] (!) and program just expect them to be logged in. This happens when installing a .deb file for example. - If the user is not logged in, or has logged out, the notifications are enqueued and would be shown once user is logged back in. Overall, this is a bit simplistic and will fail in some multi-user situations... but it still covers most common cases (a single user on the system) and in the spirit of "lightweight" tool. [0] https://github.com/elesiuta/picosnitch/blob/master/picosnitch.py#L1383 https://github.com/elesiuta/picosnitch/blob/master/picosnitc... [1] https://github.com/elesiuta/picosnitch/blob/master/picosnitch.py#L67 https://github.com/elesiuta/picosnitch/blob/master/picosnitc...

icedchai 5y ago
Seems odd that it lists /home to pick a user, instead of getpwent.

nix0n 5y ago

> blocking or sandboxing... programs is out of scope for picosnitch This is reasonable. Can someone recommend a tool (preferably in the Ubuntu repos) for doing that?

pabs3 5y ago
Look at things like firejail, bubblewrap (which Flatpak uses) or switch to an OS like Qubes.
sliken 5y ago
Not sure what your goals are specifically, but even apparmor and selinux can do things like block access to the network, limit read and/or write access to certain directories, limiting what system calls can be made, and notify you of failed attempts. I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you.
- Anonymous4272 5y ago
  >I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you. And does this happen on android aswell? Because a lot of custom rom/ root users run selinux as permissive for compatibility, so these pdfs would have full network access
tskx2003 5y ago
I use opensnitch, is mentioned above as well. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch

pabs3 5y ago

Some similarish things mentioned on the Debian privacy issues page: https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch https://github.com/kushaldas/unoon https://github.com/kushaldas/unoon https://github.com/nsntrace/nsntrace https://github.com/nsntrace/nsntrace https://wiki.debian.org/PrivacyIssues#Detection_tools https://wiki.debian.org/PrivacyIssues#Detection_tools