Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EBPFSnitch: An eBPF based Linux Application Firewall

github.com

Post reply on HN
Print view View original

51–60 of 71 posts

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#51

Post by spockz »

yjftsjthsd-h wrote: post #10
XorNot wrote: post #2

This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.

without the overhead of completely containerizing them up front. What overhead? `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`, done. Use x11docker if needed.

Wouldn’t you need something like gvisor and or running under a different user or podman to make this really safe? If you don’t trust the binary they can still just break out the container.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#52

Post by yjftsjthsd-h »

spockz wrote: post #51
yjftsjthsd-h wrote: post #10

Earlier quoted context omitted.

without the overhead of completely containerizing them up front. What overhead? `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`, done. Use x11docker if needed.

Wouldn’t you need something like gvisor and or running under a different user or podman to make this really safe? If you don’t trust the binary they can still just break out the container.

Container escape isn't supposed to be that easy these days, but yes there is a tradeoff between security and convenience and performance. I was objecting to the claim of overhead in using a container; if you need more protection than you can get on the same kernel then you'll pay for it in virtualization costs (granted, that's not super high anymore either).

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#53

Post by dsp »

pratio wrote: post #50

For those who're unaware. ebpf: extended berkeley packet filter Unfortunately, even the website https://ebpf.io/what-is-ebpf doesn't mention this. Interestingly, I was unable to find the words packet filter used together as well or firewall. I might be wrong. I know that if you know what it is you'd know but trying to explain that to my partner here just glancing at my screen wasn't easy.

The ebpf site doesn’t mention that because expanding the abbreviation is not helpful for understanding ebpf. The name is representative the past of ebpf, not its present use or future.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#54

Post by kortilla »

dsp wrote: post #53
pratio wrote: post #50

For those who're unaware. ebpf: extended berkeley packet filter Unfortunately, even the website https://ebpf.io/what-is-ebpf doesn't mention this. Interestingly, I was unable to find the words packet filter used together as well or firewall. I might be wrong. I know that if you know what it is you'd know but trying to explain that to my partner here just glancing at my screen wasn't easy.

The ebpf site doesn’t mention that because expanding the abbreviation is not helpful for understanding ebpf. The name is representative the past of ebpf, not its present use or future.

That’s not an excuse to not explain wtf the name means. It’s literally one of the first questions that always comes up when I explain ebpf to people.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#55

Post by e12e »

yjftsjthsd-h wrote: post #10
XorNot wrote: post #2

This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.

without the overhead of completely containerizing them up front. What overhead? `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`, done. Use x11docker if needed.

> `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`

Not sure if running a program as root in a container is the best approach to "fully sandbox" - depends on what the goal is, obviously.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#56

Post by oh_sigh »

kortilla wrote: post #54
dsp wrote: post #53

Earlier quoted context omitted.

The ebpf site doesn’t mention that because expanding the abbreviation is not helpful for understanding ebpf. The name is representative the past of ebpf, not its present use or future.

That’s not an excuse to not explain wtf the name means. It’s literally one of the first questions that always comes up when I explain ebpf to people.

Does literally everything that uses it need to expand the acronym? Even if it confuses people or gives them the false impression of what it actually does? "This product uses eBPF, or extended Berkeley Packet Filter. But forget all of that because it has no relation with Berkeley, and it doesn't filter packets."

In a sense eBPF as just some letters being a name is a better name than "extended Berkeley Packet Filter", just like DPRK is a better name than "Democratic People's Republic of Korea", since 75% of the words in the expanded acronym aren't even relevant or true.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#57

Post by arsome »

simias wrote: post #13
arsome wrote: post #3

Earlier quoted context omitted.

Be careful with that one, this isn't as capable as the HIDS solutions available on Windows - it's not going to do things like detect exfiltration using other executables or modification of other files on your system. For example, if you allowed curl or Firefox, another executable can simply call one of them and send/receive whatever data they need to. It also can't do things like filter ptrace calls which could easil…

How does Windows prevent this type of bypass? It seems extremely hard to prevent in an unsandboxed environment.

Windows itself does not, 3rd party firewall/HIDS software (ZoneAlarm, Outpost, etc) for Windows has done this by intercepting APIs to do things like call executables with internet access, OpenProcess calls, raw disk IO, registry writes to startup entries, etc.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#58

Post by thayne »

yjftsjthsd-h wrote: post #10
XorNot wrote: post #2

This looks spectacular! Finally! This is functionality I've desperately wanted on Linux desktop. Link that up with with some of the SELinux on-demand tools and you have a plausible way to run untrusted binaries without the overhead of completely containerizing them up front.

without the overhead of completely containerizing them up front. What overhead? `docker run --rm -it -v $PWD/untrustedprogram:/untrustedprogram:ro ubuntu:latest`, done. Use x11docker if needed.

That's a lot of overhead if you don't already have docker installed, don't have the the ubuntu image installed, etc.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#59

Post by sandGorgon »

This is very cool. Something like this can be a full blown commercial product.

>The control interface is implemented in Python 3 utilizing Qt5

I would recommend moving away from this and instead run the controls using a web interface. A small django/flask/fastapi app (maybe even running through docker).

U can see how that could run on a raspberry Pi and be accessible on the network through the browser.

Re: EBPFSnitch: An eBPF based Linux Application Firewall

#60

Post by calvinmorrison »

sandGorgon wrote: post #59

This is very cool. Something like this can be a full blown commercial product. > The control interface is implemented in Python 3 utilizing Qt5 I would recommend moving away from this and instead run the controls using a web interface. A small django/flask/fastapi app (maybe even running through docker). U can see how that could run on a raspberry Pi and be accessible on the network through the browser.

Transmission the torrent daemon handles this nicely. Multiple frontends including gtk, cli and web.
Post reply on HN