is it possible to use iptables in order to permit traffic initiated by a "process", ie using the process name? I would like for example to allow everything that is initiated by ping command.
5 Answers
It looks like the owner iptables module is that what you want. First, check if it's available in Your system:
iptables -m owner --help
You can read more here: http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#OWNERMATCH
-
7Owner only allows you to match on the user or group that owns the process, not the process name itself. (The cmd-owner flag appears to have been removed). Jun 1, 2012 at 22:10
-
4@MikeLundy: Add a group to your system (I use
nonet
myself), then add a rule to your output chain like this:-A OUTPUT -m owner --gid-owner nonet -j REJECT --reject-with icmp-net-unreachable
Run the program for which you know in advance that you want to block, with sg (sg nonet "your_prog your_args"
).– BgsNov 23, 2013 at 20:34 -
2If it's not supported, then
control groups
are the solution. It's pretty hard to setup but there's standard kernel support. It requires iptables 1.6 that can be built manually. I'll post an answer with how to setup and tag an application into a cgroup and have iptables identify it. Jun 18, 2016 at 11:24 -
@Bgs thank you for the idea! I noticed that you need ip6tables as well. I posted my recipe as an answer.– TobiaOct 11, 2020 at 20:00
-m owner --pid-owner PID
See http://linuxpoison.blogspot.com/2010/11/how-to-limit-network-access-by-user.html and http://linux.die.net/man/8/iptables
Note that you need the ipt_owner module, as --pid-owner is not supported by xt_owner.
For example (this is just an approximation)
#!/bin/bash
$@ &
iptables -m owner --pid-owner %1 -j REJECT
In reality, though, you're better off using --uid-owner and --gid-owner. First, the --pid-owner criterion only matches the exact pid, meaning your program could easily spawn a child process which would not be blocked by this rule. (At least I haven't read otherwise.) Secondly, iptables(8) warns that --pid-owner is broken on SMP systems (which may or may not apply to you, but in either case limits portability). Third, there is a race condition in the script above, because the process is started before it is blocked. (If there is a way to get a process's pid before it starts, then I've never heard about it.)
If there is a way to get a process's pid before it starts, then I've never heard about it.
You could write a wrapper which forks first, then adds the rule and execs the process (assuming the program you're running doesn't fork again), since the PID is not changed by the exec(3) call.
/* NOTE this contains zero error checking */
int main(int argc, char **argv) {
/* Eat argv[0] the name of the wrapper script */
argv++;
argc--;
pid_t my_pid = getpid();
char *iptables_cmd = NULL;
asprintf(&iptables_cmd, "/sbin/iptables -A INPUT -m owner --pid_owner %d -j ACCEPT", my_pid);
system(iptables_cmd);
execv(argv[0], argv);
}
The French Wikipedia page about iptables https://fr.wikipedia.org/wiki/Iptables states that the possibility to filter with --pid-owner or --cmd-owner was removed starting from kernel 2.6.14... and links to the kernel changelog where I couldn't check this assertion since I am not a specialist of what the kernel internal structures are for!
The equivalent page in English does not go into that level of detail.
Filtering with UID/GID still works.
Building on @Bgs's answer, I would do it like this:
- Add a new system group, eg.
snitch
sudo addgroup --system snitch
- Add yourself to that group, so that you won't be asked for a password to run processes with the primary group set to it:
sudo adduser $USER snitch
- Add IPv4 and IPv6 rules to log and reject any packets generated by processes belonging to that group:
sudo iptables -A OUTPUT -m owner --gid-owner snitch -j LOG --log-prefix 'Snitch: '
sudo ip6tables -A OUTPUT -m owner --gid-owner snitch -j LOG --log-prefix 'Snitch: '
sudo iptables -A OUTPUT -m owner --gid-owner snitch -j REJECT
sudo ip6tables -A OUTPUT -m owner --gid-owner snitch -j REJECT
- Open a tail watch on kernel messages:
dmesg -w
- Launch your target process using
sg
or any other similar means:
sg snitch 'your target program'
-
What's the advantage of spawning/filter by group rather than by user? Jul 16, 2021 at 11:28
-
@fabiomaia The advantage is to be able to run processes that access your files and your home directory, not that of another user. You want to control their network communications and that of their child processes, but not that of other processes you launch. Think, for instance, of blocking all network access to a certain program (that you may not have permission to run :-) or tunneling a particular browser into a VPN, while leaving all other processes untouched.– TobiaJul 17, 2021 at 18:36
-
@fabiomaia Note that this is not super secure: if the target program knows about this trick, it can revert its own primary group (with the same system call that
sg
is using) and thus get out of jail. But I've never seen a program that does this.– TobiaJul 17, 2021 at 18:44