Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting netstat and iptables but this seems terribly inefficient since if a process is only active for a small time-frame the script might miss it. Basically I want to enforce specific restrictions regarding port and dst on a process while leaving other processes unaffected. Any ideas?


For reference selinux can do exactly this and it works fairly well. Setup is a bit of a pain though.

share|improve this question
1  
Maybe LXC (Linux Containers) will do the trick? lxc.sourceforge.net –  nsg Feb 21 '12 at 13:29
    
What is so difficult about selinux? Sure there is a bit of a learning curve, but there are great tools, both graphical and command line to assist with configuration. Support is available on IRC on #selinux as well as #fedora –  bodhi.zazen Dec 12 '13 at 21:59

2 Answers 2

Your question is a very similar to http://stackoverflow.com/questions/5451206/linux-per-program-firewall-similar-to-windows-and-mac-counterparts

There was the --cmd-owner for iptables's owner module, but it was removed because it worked not properly. Now a first beta version of Leopard Flower is available, which solves the problem by a user space daemon.

In general a per-process firewall is not very useful unless you really isolate and restrict the programs. For this, you should look at security solutions like TOMOYO Linux, SELinux, AppArmor, grsecurity, SMACK,...

share|improve this answer

Easy, run your process under different user and use '--uid-owner' :)

share|improve this answer
1  
That was my first thought as well but as I noted it doesn't work for listening processes. –  s3c Feb 21 '12 at 13:13
    
What is exactly your intention? To be sure a specific owner/process has its own openports for incoming/outgoing connection? –  Jiri Xichtkniha Feb 22 '12 at 8:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.