Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to get Skype working with iptables and don't want to allow a huge range of ports thus I thought a solution might be

iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT 
iptables -A INPUT -m owner --gid-owner skypeGrp -j ACCEPT

where in advance I had created a group called skypeGrp and then put the skype application into it:

sudo addgroup skypeGrp
sudo usermod some_username -G skypeGrp
sudo chgrp skypeGrp /usr/bin/skype

Shouldn't this work?

EDIT:

I think another key insight here to make the method I originally outlined in my question work, is to realise that it active group that iptables takes notice of. Thus my user doesn't just have to belong to the skypeGrp, this also must be his active group at the time of running Skype (see here for more).

share|improve this question
add comment

1 Answer 1

No because the rule will check against the groups of the user, and not the group owner of the file.

But if you setgid the skype executable, the group owner of the file will also be part of the groups of the user.

chmod g+s /usr/bin/skype

Then your iptables rules should work... if Skype works and does not drop privileges.

share|improve this answer
    
My user that will be running Skype does not have sudo privileges, so cannot chmod, how else can I achieve this for that user? (I edited my answer to put the user in the skypeGrp as well, although this didn't seem to fix anything) –  fpghost Mar 14 '13 at 16:06
    
OK, let's say my user is called userChild so I did chown userChild /usr/bin/skype followed by chmod g+s /usr/bin/skype when logged in as userChild. So now ls -l says -rwxr-xr-x 1 userChild skypeGrp 28356768 Nov 1 01:19 /usr/bin/skype –  fpghost Mar 14 '13 at 17:00
    
the chmod g+s must obviously be made by root, this is a privileged operation. your ls -l shows clearly your file is not setgid. –  BatchyX Mar 14 '13 at 18:47
    
ls -l now gives -rwxr-sr-x 1 root skypeGrp 8429 Oct 30 2011 /usr/bin/skype and id userChild gives uid=1000(userChild) gid=1000(userChild),1006(skype),1000(userChild). This still does not seem to work however. –  fpghost Mar 14 '13 at 19:20
    
Indeed even doing chmod u+s as root to setuid as root for skype giving ls -l -rwsr-sr-x 1 root skypeGrp 8429 Oct 30 2011 /usr/bin/skype doesn't work. Even though I have the rule iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT allowing all OUTPUT from root. –  fpghost Mar 14 '13 at 19:24
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.