21–30 of 71 posts
Dropping packets using netfilter makes many applications wait for a timeout. I prefer reject to filter unwanted outbound connections so that applications don't wait.
Earlier quoted context omitted.
Be careful with that one, this isn't as capable as the HIDS solutions available on Windows - it's not going to do things like detect exfiltration using other executables or modification of other files on your system. For example, if you allowed curl or Firefox, another executable can simply call one of them and send/receive whatever data they need to. It also can't do things like filter ptrace calls which could easil…
How does Windows prevent this type of bypass? It seems extremely hard to prevent in an unsandboxed environment.
This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.
without the overhead of completely containerizing them up front. What overhead? `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`, done. Use x11docker if needed.
Reminds me of good old Kerio Personal Firewall on Windows back in the 90s. If the UI gets some more love, I see ebpfsnitch take off like a rocket :)
only problem is that you can’t get the process ID for inbound packets like FreeBSD can, for that still remains Linux’s weakest feature. — The said feature is critical to proper DEFAULT-DENY firewall configuration/modeling.
Could you elaborate why that's critical to have?
Hence, OpenRC enters the picture instead just to ensure that network port is not being used.
Also, premise of the DEFAULT-DENY firewall modeling is to pinhole open the port(s) on a per-process (or per-parent-process group) basis.
only problem is that you can’t get the process ID for inbound packets like FreeBSD can, for that still remains Linux’s weakest feature. — The said feature is critical to proper DEFAULT-DENY firewall configuration/modeling.
I have not attempted it but I believe this can be accomplished with eBPF https://elixir.bootlin.com/linux/v4.0/source/include/linux/s...
Earlier quoted context omitted.
without the overhead of completely containerizing them up front. What overhead? `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`, done. Use x11docker if needed.
This isn't upvoted enough. I use that trick verbatim to just wrap a container's execution environment around my $PWD. It's useful way beyond just isolating a program.
Earlier quoted context omitted.
How does Windows prevent this type of bypass? It seems extremely hard to prevent in an unsandboxed environment.
I guess one might try to check the path through the process tree to see if a blacklisted application is the parent (or gp, ggp, etc.) of the process trying to communicate with the outside world.
For instance if I type "firefox 'http://google.com'" in my terminal my already-running firefox instance loads the URL in a new tab, so I assume that some kind of IPC is used behind the scenes to ask the main instance to load the URL. Of course that's harder to exploit nefariously than spawning wget from the same process but when there's a will there's a way...
Earlier quoted context omitted.
I have not attempted it but I believe this can be accomplished with eBPF https://elixir.bootlin.com/linux/v4.0/source/include/linux/s...
I don’t see a single parameter of the process ID.
Edit to provide link: https://elixir.bootlin.com/linux/v4.6/source/samples/bpf/bpf...
Reminds me of good old Kerio Personal Firewall on Windows back in the 90s. If the UI gets some more love, I see ebpfsnitch take off like a rocket :)
On Windows, Malwarebytes (now BiniSoft) still maintains a decent free product called Windows Firewall Control that works in a similar way. It augments the existing firewall. https://www.binisoft.org/wfc
It also has the option to see the location of the executable trying to access the web and to also upload a hash of the file to VirusTotal.
I have been using this back before when it was a paid program (I think it was only $15 for lifetime use) and before it was purchased by MalwareBytes.
I no longer use any Windows computers but I install it on all my friends and families Windows PC’s.
I really wish there was something similar for Linux.