iptables mode not available

mrmnemo · 07-28-2010, 12:20 PM

hi,

Going by a tutorial found here ( see below quote ).

Quote:

Owner match

The owner match extension is used to match packets based on the identity of the process that created them. The owner can be specified as the process ID either of the user who issued the command in question, that of the group, the process, the session, or that of the command itself. This extension was originally written as an example of what iptables could be used for. The owner match only works within the OUTPUT chain, for obvious reasons: It is pretty much impossible to find out any information about the identity of the instance that sent a packet from the other end, or where there is an intermediate hop to the real destination. Even within the OUTPUT chain it is not very reliable, since certain packets may not have an owner. Notorious packets of that sort are (among other things) the different ICMP responses. ICMP responses will never match.

Table 10-24. Owner match options
Match --cmd-owner
Kernel 2.3, 2.4, 2.5 and 2.6
Example iptables -A OUTPUT -m owner --cmd-owner httpd
Explanation

This is the command owner match, and is used to match based on the command name of the process that is sending the packet. In the example, httpd is matched. This match may also be inverted by using an exclamation sign, for example -m owner ! --cmd-owner ssh.

I tried to add a rule for my torrent client with

Code:

 iptables -A OUTPUT -m owner --cmd-owner transmission -j ACCEPT

However, iptables kicks it back with

Code:

iptables v1.4.4: unknown option `--cmd-owner'
Try `iptables -h' or 'iptables --help' for more information.

The mode isnt even referenced in the iptables man on my system. Am I missing something?

Current System: Ubuntu 10.04

mrmnemo · 07-28-2010, 08:29 PM

Ok, so I guess that iptables connection tracking by process has been broken since kernel 2.0.0 ( SMP ) . I want to set up some rules based on the command-name. Any ideas on how I can do this?

mrmnemo · 07-29-2010, 07:06 PM

can anyone give some advice on setting up rules in iptables based on the owning PROCESS rather than the process-OWNER? I would like to allow traffic based on the command. Since -m owner --cmd-owner has been broken since the release of the SMP kernels what can i do?

mrmnemo · 07-29-2010, 09:36 PM

Is anyone found a way to allow / disallow traffic based on PID or command name since -m owner --cmd-owner is currently broken since kernel release 2.0 ?? I see that i can build rules based on user and group ID. However, I have been unable to figure out a way to build rules based on PID / command.

Could really use some input. I have seen dynamic rule scripts which are not really what I need to do. Is it possible to do this with out needing a "10 pound hammer" ( i.e: using iptables only):?

I could really use the help. At this point i have only been able to find reference to automated rule generation based on user or port. USER based would be to wide open and PORT would cause such a pain to the logs.

pixellany · 07-31-2010, 07:00 AM

I have merged your 2 closely-related threads. One thread per topic, please.

LQ-Robert · 09-21-2010, 04:00 PM

I've been looking for this functionality for years and I've never run across it. I just found out about the --cmd-owner IPTables option, so I guess my searches have been poor. But that doesn't work with Xbuntu 9 or Ubuntu 10, so what's the answer? There are several firewalls that work at the app level on Windows - heck even the built Win7 firewall does - and there's a really nice one for iOS (FirewallIP). Surely, oh surely there must be something in Linux that lets you set networking permissions on a per-program basis.

mrmnemo · 09-21-2010, 11:11 PM

hi,

the closest I came to finding a way to do this was with L-7 User Space. YOu can read up on it here. Still wasnt what I needed. Then again, my jedi skills are lacking and it may be the fix.

mrmnemo · 09-21-2010, 11:11 PM

hi,

the closest I came to finding a way to do this was with L-7 User Space. YOu can read up on it here. Still wasnt what I needed. Then again, my jedi skills are lacking and it may be the fix.