5 ms·

> blocking or sandboxing... programs is out of scope for picosnitch This is reasonable. Can someone recommend a tool (preferably in the Ubuntu repos) for doin

• pabs3 5y ago
  Look at things like firejail, bubblewrap (which Flatpak uses) or switch to an OS like Qubes.
• sliken 5y ago
  Not sure what your goals are specifically, but even apparmor and selinux can do things like block access to the network, limit read and/or write access to certain directories, limiting what system calls can be made, and notify you of failed attempts. I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you.
  • Anonymous4272 5y ago
    >I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you. And does this happen on android aswell? Because a lot of custom rom/ root users run selinux as permissive for compatibility, so these pdfs would have full network access
• tskx2003 5y ago
  I use opensnitch, is mentioned above as well. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch