4 ms·

My biggest problem with Linux is that there are no per-process firewall settings. I think one can get around this by using AppArmor or using an user per app and

My biggest problem with Linux is that there are no per-process firewall settings. I think one can get around this by using AppArmor or using an user per app and assigning rules to a user. I've used Linux for over a decade now, but there are still many things I haven't learned, so maybe I'm missing something in this regard. The GitHub page says - TCP network access control (binding and connecting) and - Support for UDP and other network protocol restrictions (when supported by Linux kernel) so maybe this can be used to firewall processes in an easy way (assuming that it is easy to set up landrun)?

tobias2014 2y ago
You can use firejail for network isolation, it can run applications in a new network namespace [1]. I'm using this to run applications over tor to make sure that nothing leaks. [1] https://firejail.wordpress.com/documentation-2/basic-usage/#namespace https://firejail.wordpress.com/documentation-2/basic-usage/#... "A network namespace is a new, independent TCP/IP stack attached to the sandbox. The stack has its own routing table, firewall and set of interfaces."
- throwfaraway398 2y ago
  I saw there's an option to match on a cgroup among nft meta expressions (but I've never tried it). It could be enough if you just want to add per-process firewall rules, but not configure an additional namespace with it's associated interfaces, routing/nating.
  - kanbankaren 2y ago
    Yes. You could match packets based on username or even SELinux labels. You could also set a special mark on a packet for each container and then filter based on that. The Internet is surprsingly very thin on nft resources. I spent a few weeks learning how to write them. Definitely, not for the average consumer.
nolist_policy 2y ago
> My biggest problem with Linux is that there are no per-process firewall settings. There is, with cgroups: https://www.kernel.org/doc/Documentation/cgroup-v1/net_cls.txt https://www.kernel.org/doc/Documentation/cgroup-v1/net_cls.t...
- NewJazz 2y ago
  Is there an example of this that uses cgroup2?
  - zokier 2y ago
    https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html#NFTSet=family:table:set https://www.freedesktop.org/software/systemd/man/latest/syst...
QuantumNoodle 2y ago
Why not use linux network namespaces to run your processes in different network stack? nftables rules are per network namespaces so you can get all sorts of sophisticated and achieve essentially per process firewalling. The pattern is to create a network namespace, create a veth pair and move one end of the pair into the namespace. Then you could set up rules to route traffic from default namespace to the process namespace via veth device. Systemd has `NetworkNamespacePath` directive which can spin up services in new namespaces as well. See `man 5 systemd.exec`
- mikedelfino 2y ago
  I'm not sure about the other commenter's intentions, but on desktop, I wish every program started in a restricted network namespace. Instead of blocking all incoming and outgoing connections by default, it would request user permission interactively and adjust access accordingly.
  - ranger_danger 2y ago
    opensnitch does this
    - y7 2y ago
      Are you sure? Because last I checked OpenSnitch used different techniques from namespaces, that seemed more brittle to me.
      - ranger_danger 2y ago
        I was referring to "request user permission interactively and adjust access accordingly"... it can do that. It uses eBPF though
  - coppsilgold 2y ago
    On Linux you can do the next best thing which is to move out all the interfaces from the default network namespace and use iptables rules for it which block everything just in case. Then you have to explicitly launch applications in a desired network namespace such as physical (eth0, wlan0 etc) or vpn (wg0). Accidentally launched applications, or something like the desktop environment have no network connectivity.
GS523523 2y ago
[dead]
fulafel 2y ago
Attaching a separate firewall rules to every process would be a bit heavyweight. What we do have is network namespaces that let you have networking rules (incl firewall) per a group of processes.
- 1oooqooq 2y ago
  that's what all firewall apps on Android (bastardized Linux) does. well, they already have a user namespace per app which they can match on the firewall rule, but a per "main" program pid net namespace would be pretty much the same. i guess this can be a cool patch to this plus a one weekend qt+rust gui to manage the firewall (or a patch to firewalld gui)... only if i ever had a weekend.

tobias2014 2y ago

You can use firejail for network isolation, it can run applications in a new network namespace [1]. I'm using this to run applications over tor to make sure that nothing leaks. [1] https://firejail.wordpress.com/documentation-2/basic-usage/#namespace https://firejail.wordpress.com/documentation-2/basic-usage/#... "A network namespace is a new, independent TCP/IP stack attached to the sandbox. The stack has its own routing table, firewall and set of interfaces."

throwfaraway398 2y ago
I saw there's an option to match on a cgroup among nft meta expressions (but I've never tried it). It could be enough if you just want to add per-process firewall rules, but not configure an additional namespace with it's associated interfaces, routing/nating.
- kanbankaren 2y ago
  Yes. You could match packets based on username or even SELinux labels. You could also set a special mark on a packet for each container and then filter based on that. The Internet is surprsingly very thin on nft resources. I spent a few weeks learning how to write them. Definitely, not for the average consumer.

nolist_policy 2y ago

> My biggest problem with Linux is that there are no per-process firewall settings. There is, with cgroups: https://www.kernel.org/doc/Documentation/cgroup-v1/net_cls.txt https://www.kernel.org/doc/Documentation/cgroup-v1/net_cls.t...

NewJazz 2y ago
Is there an example of this that uses cgroup2?
- zokier 2y ago
  https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html#NFTSet=family:table:set https://www.freedesktop.org/software/systemd/man/latest/syst...

QuantumNoodle 2y ago

Why not use linux network namespaces to run your processes in different network stack? nftables rules are per network namespaces so you can get all sorts of sophisticated and achieve essentially per process firewalling. The pattern is to create a network namespace, create a veth pair and move one end of the pair into the namespace. Then you could set up rules to route traffic from default namespace to the process namespace via veth device. Systemd has `NetworkNamespacePath` directive which can spin up services in new namespaces as well. See `man 5 systemd.exec`

mikedelfino 2y ago
I'm not sure about the other commenter's intentions, but on desktop, I wish every program started in a restricted network namespace. Instead of blocking all incoming and outgoing connections by default, it would request user permission interactively and adjust access accordingly.
- ranger_danger 2y ago
  opensnitch does this
  - y7 2y ago
    Are you sure? Because last I checked OpenSnitch used different techniques from namespaces, that seemed more brittle to me.
    - ranger_danger 2y ago
      I was referring to "request user permission interactively and adjust access accordingly"... it can do that. It uses eBPF though
- coppsilgold 2y ago
  On Linux you can do the next best thing which is to move out all the interfaces from the default network namespace and use iptables rules for it which block everything just in case. Then you have to explicitly launch applications in a desired network namespace such as physical (eth0, wlan0 etc) or vpn (wg0). Accidentally launched applications, or something like the desktop environment have no network connectivity.

GS523523 2y ago

[dead]

fulafel 2y ago

Attaching a separate firewall rules to every process would be a bit heavyweight. What we do have is network namespaces that let you have networking rules (incl firewall) per a group of processes.

1oooqooq 2y ago
that's what all firewall apps on Android (bastardized Linux) does. well, they already have a user namespace per app which they can match on the firewall rule, but a per "main" program pid net namespace would be pretty much the same. i guess this can be a cool patch to this plus a one weekend qt+rust gui to manage the firewall (or a patch to firewalld gui)... only if i ever had a weekend.