Networking Lockdown For Specific Process

steampunk · 01-24-2012, 03:48 AM

I would like to lock down specific executables from being able to use networking: bluetooth, wireless, ethernet, etc.

I've downloaded untrusted Linux apps (that I like). I'd just like to be precautionary because I don't have the time to read all the source code.

Is there anyway to sand box these apps, while still using them?

I.e., is it possible to change permissions so a specific app can't use networking or any process it spawns?

unSpawn · 01-24-2012, 10:45 AM

Quickest and most efficient way IMHO would be to run it as a virtualization guest.

steampunk · 01-24-2012, 11:07 AM

Quote:

Originally Posted by unSpawn

Quickest and most efficient way IMHO would be to run it as a virtualization guest.

Ok, so create a specific user account with no networking privileges. Do you know if it is possible to execute a program as this virtual guest, but be signed in as another user? Sort of like sudo, but guest-do? (You know, skip all the logging out and in, just lock the permission around the exe)

Cedrik · 01-24-2012, 11:11 AM

Eventually, you could check what the apps do network wise by using iptables, block and log all connections attempts, then setup iptables rules accordingly. Tedious somewhat, but instructive

steampunk · 01-24-2012, 04:34 PM

Cedrik,

Do you know of a how-to that could walk me through the process getting the logs set up for each app?

unSpawn · 01-24-2012, 05:10 PM

Quote:

Originally Posted by steampunk

Ok, so create a specific user account with no networking privileges.

That's what you make of it. I didn't say that. Using a regular user account without networking privileges on the host exposes the host to everything the untrusted application will throw at it. Running untrusted applications in virtualization adds a layer of complexity (as you have to configure private subnet networking, install an OS inside the guest, harden it properly, add tracing if required) but shields the virtualization host from most the untrusted application may throw at it.

Cedrik · 01-24-2012, 05:53 PM

Quote:

Originally Posted by steampunk

Cedrik,

Do you know of a how-to that could walk me through the process getting the logs set up for each app?

I was thinking of general blocking rules, eg during the time you run the app and check the log, then flush the rules when you finish testing

something like (assuming you connect to the net with eth0 interface):

Code:

iptables -A OUTPUT -o eth0 -j LOG --log-prefix 'Packet Dropped: '
iptables -A OUTPUT -o eth0 -j DROP

On a terminal check log:

Code:

tail -f /var/log/syslog

Then you run iptables -F when you're finished after quitting the app, to flush/remove the rules and be able to connect to network again

edit, if you run behind a router/gateway, better to add accept connection for the gateway/router IP

Code:

iptables -A OUTPUT -o eth0 -d <Gateway IP> -j ACCEPT
iptables -A OUTPUT -o eth0 -j LOG --log-prefix 'Packet Dropped: '
iptables -A OUTPUT -o eth0 -j DROP

Tinkster · 01-24-2012, 06:05 PM

Another thing to explore would be SELinux; but you may find the time you'll need to invest
prohibitive for that particular approach. I like Unspawns suggestion of virtualising a box
and locking it off.