Preventing program from using internet

Question

Is there a way to block certain programs from being able to connect to the internet in Debian (a firewall blocking outgoing connections), so for example, to block a windows program running in wine from being able to call home?

Answer 1

One of the easier ways would be to run the WINE program as a different user and set up netfilter to drop packets from that user.

Eg, where "wineusername" is your Wine user and em1 is your network interface:

iptables -A OUTPUT -o em1 -m owner --uid-owner wineusername -j DROP
iptables -A FORWARD -o em1 -m owner --uid-owner wineusername -j DROP
iptables -A INPUT -o em1 -m owner --uid-owner wineusername -j DROP

Answer 2

You could use Linux containers to create an environment with no network interfaces. For example, if I create a configuration file like this:

# lxc.network.type = empty

And then start a shell like this:

# lxc-execute --name bash -f /tmp/lxc.conf /bin/bash

I will find that within this shell there are no network devices available other than lo:

# ifconfig -a
lo        Link encap:Local Loopback  
          LOOPBACK  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

Note that you must be root in order to run lxc-execute, so getting this to work for wine in your desktop environment may be tricky.

There is also apparently a sandbox command available as part of SELinux. Here's an example using sandbox to run Firefox. This requires that you have selinux enabled.