EBPFSnitch: An eBPF based Linux Application Firewall
1–10 of 71 posts
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#2This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#3This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
Be careful with that one, this isn't as capable as the HIDS solutions available on Windows - it's not going to do things like detect exfiltration using other executables or modification of other files on your system.
For example, if you allowed curl or Firefox, another executable can simply call one of them and send/receive whatever data they need to. It also can't do things like filter ptrace calls which could easily be used to modify another process to perform exfiltration or just spawn another thread and inject a whole new dynamic library to them, a common practice to bypass detection on Windows.
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#4This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
What do you mean by "SELinux on-demand tools"?
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#5This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
Be careful with that one, this isn't as capable as the HIDS solutions available on Windows - it's not going to do things like detect exfiltration using other executables or modification of other files on your system. For example, if you allowed curl or Firefox, another executable can simply call one of them and send/receive whatever data they need to. It also can't do things like filter ptrace calls which could easil…
Windows app firewalls had similar problems, most common was to use explorer.exe
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#6This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
firejail?
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#7This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
What overhead are you worried about?
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#8only problem is that you can’t get the process ID for inbound packets like FreeBSD can, for that still remains Linux’s weakest feature.
— The said feature is critical to proper DEFAULT-DENY firewall configuration/modeling.
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#9only problem is that you can’t get the process ID for inbound packets like FreeBSD can, for that still remains Linux’s weakest feature. — The said feature is critical to proper DEFAULT-DENY firewall configuration/modeling.
I have not attempted it but I believe this can be accomplished with eBPF https://elixir.bootlin.com/linux/v4.0/source/include/linux/s...
Re: EBPFSnitch: An eBPF based Linux Application Firewall
#10This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
without the overhead of completely containerizing them up front.
What overhead? `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`, done. Use x11docker if needed.