I've been reading around but can't seem to find a way to create per-process firewall rules. I know about
iptables --uid-owner but that only works for outgoing traffic. I've considered scripting
iptables but this seems terribly inefficient since if a process is only active for a small time-frame the script might miss it. Basically I want to enforce specific restrictions regarding port and dst on a process while leaving other processes unaffected. Any ideas?
For reference selinux can do exactly this and it works fairly well. Setup is a bit of a pain though.