27

is it possible to use iptables in order to permit traffic initiated by a "process", ie using the process name? I would like for example to allow everything that is initiated by ping command.

5 Answers 5

30

It looks like the owner iptables module is that what you want. First, check if it's available in Your system:

iptables -m owner --help

You can read more here: http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#OWNERMATCH

4
  • 7
    Owner only allows you to match on the user or group that owns the process, not the process name itself. (The cmd-owner flag appears to have been removed).
    – Mike Lundy
    Jun 1, 2012 at 22:10
  • 4
    @MikeLundy: Add a group to your system (I use nonet myself), then add a rule to your output chain like this: -A OUTPUT -m owner --gid-owner nonet -j REJECT --reject-with icmp-net-unreachable Run the program for which you know in advance that you want to block, with sg (sg nonet "your_prog your_args").
    – Bgs
    Nov 23, 2013 at 20:34
  • 2
    If it's not supported, then control groups are the solution. It's pretty hard to setup but there's standard kernel support. It requires iptables 1.6 that can be built manually. I'll post an answer with how to setup and tag an application into a cgroup and have iptables identify it.
    – KrisWebDev
    Jun 18, 2016 at 11:24
  • @Bgs thank you for the idea! I noticed that you need ip6tables as well. I posted my recipe as an answer.
    – Tobia
    Oct 11, 2020 at 20:00
10
-m owner --pid-owner PID

See http://linuxpoison.blogspot.com/2010/11/how-to-limit-network-access-by-user.html and http://linux.die.net/man/8/iptables

Note that you need the ipt_owner module, as --pid-owner is not supported by xt_owner.

For example (this is just an approximation)

#!/bin/bash
$@ &
iptables -m owner --pid-owner %1 -j REJECT

In reality, though, you're better off using --uid-owner and --gid-owner. First, the --pid-owner criterion only matches the exact pid, meaning your program could easily spawn a child process which would not be blocked by this rule. (At least I haven't read otherwise.) Secondly, iptables(8) warns that --pid-owner is broken on SMP systems (which may or may not apply to you, but in either case limits portability). Third, there is a race condition in the script above, because the process is started before it is blocked. (If there is a way to get a process's pid before it starts, then I've never heard about it.)

4

If there is a way to get a process's pid before it starts, then I've never heard about it.

You could write a wrapper which forks first, then adds the rule and execs the process (assuming the program you're running doesn't fork again), since the PID is not changed by the exec(3) call.

/* NOTE this contains zero error checking */
int main(int argc, char **argv) {
    /* Eat argv[0] the name of the wrapper script */
    argv++;
    argc--;

    pid_t my_pid = getpid();

    char *iptables_cmd = NULL;
    asprintf(&iptables_cmd, "/sbin/iptables -A INPUT -m owner --pid_owner %d -j ACCEPT", my_pid);

    system(iptables_cmd);

    execv(argv[0], argv);
}
3

The French Wikipedia page about iptables https://fr.wikipedia.org/wiki/Iptables states that the possibility to filter with --pid-owner or --cmd-owner was removed starting from kernel 2.6.14... and links to the kernel changelog where I couldn't check this assertion since I am not a specialist of what the kernel internal structures are for!

The equivalent page in English does not go into that level of detail.

Filtering with UID/GID still works.

3

Building on @Bgs's answer, I would do it like this:

  1. Add a new system group, eg. snitch
sudo addgroup --system snitch
  1. Add yourself to that group, so that you won't be asked for a password to run processes with the primary group set to it:
sudo adduser $USER snitch
  1. Add IPv4 and IPv6 rules to log and reject any packets generated by processes belonging to that group:
sudo iptables  -A OUTPUT -m owner --gid-owner snitch -j LOG --log-prefix 'Snitch: '
sudo ip6tables -A OUTPUT -m owner --gid-owner snitch -j LOG --log-prefix 'Snitch: '
sudo iptables  -A OUTPUT -m owner --gid-owner snitch -j REJECT
sudo ip6tables -A OUTPUT -m owner --gid-owner snitch -j REJECT
  1. Open a tail watch on kernel messages:
dmesg -w
  1. Launch your target process using sg or any other similar means:
sg snitch 'your target program'
3
  • What's the advantage of spawning/filter by group rather than by user?
    – fabiomaia
    Jul 16, 2021 at 11:28
  • @fabiomaia The advantage is to be able to run processes that access your files and your home directory, not that of another user. You want to control their network communications and that of their child processes, but not that of other processes you launch. Think, for instance, of blocking all network access to a certain program (that you may not have permission to run :-) or tunneling a particular browser into a VPN, while leaving all other processes untouched.
    – Tobia
    Jul 17, 2021 at 18:36
  • @fabiomaia Note that this is not super secure: if the target program knows about this trick, it can revert its own primary group (with the same system call that sg is using) and thus get out of jail. But I've never seen a program that does this.
    – Tobia
    Jul 17, 2021 at 18:44

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.