Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to block the (outgoing) network access of a single process?

share|improve this question
3  
How do you intend to identify the process? PID, name, path? –  Marco Mar 24 '13 at 0:14
    
What access do you want to block? Some programs use network access via localhost (to the same machine) to do their jobs. –  vonbrand Mar 24 '13 at 2:13
    
See also LD_PRELOAD or similar to prevent network access, if the process is cooperating. –  Gilles Sep 1 '13 at 19:50
add comment

4 Answers

up vote 16 down vote accepted

With new enough Linux kernel, you can use network namespaces for that. You need to have the 'network namespaces' enabled in your kernel (CONFIG_NET_NS=y) and util-linux with the unshare tool.

Then, starting a process without network access is as simple as:

unshare -n program ...

This creates an empty network namespace for the process. That is, it is run with no network interfaces, including no loopback. In other words:

$ unshare -n ping 127.0.0.1
connect: Network is unreachable

If your app needs one, you can set a new up;

$ unshare -n -- sh -c 'ifconfig lo up; ping 127.0.0.1'
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=32 time=0.066 ms

Note that this will create a new, local loopback. That is, the spawned process won't be able to access open ports of the host's 127.0.0.1.


If you need to gain access to the original networking inside the namespace, you can use nsenter to enter the other namespace.

The following example runs ping with network namespace that is used by PID 1 (it is specified through -t 1):

$ nsenter -n -t 1 -- ping -c4 example.com
PING example.com (93.184.216.119) 56(84) bytes of data.
64 bytes from 93.184.216.119: icmp_seq=1 ttl=50 time=134 ms
64 bytes from 93.184.216.119: icmp_seq=2 ttl=50 time=134 ms
64 bytes from 93.184.216.119: icmp_seq=3 ttl=50 time=134 ms
64 bytes from 93.184.216.119: icmp_seq=4 ttl=50 time=139 ms

--- example.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 134.621/136.028/139.848/2.252 ms
share|improve this answer
    
How do you block all programs by default, then start a specific program with network access (basically the opposite of what you show in your answer (share))? –  trusktr Aug 3 '13 at 7:28
    
I've added that to the answer :). –  Michał Górny Aug 3 '13 at 10:27
    
Thanks Michał Górny. I'm not exactly sure how that all works though. What I'm looking to do is to just boot my machine, and have all programs blocked from network access by default, with the ability to allow some (whitelist) to access the network. I think perhaps AppArmor might be suited for what I want to do. –  trusktr Aug 16 '13 at 5:09
    
unshare -n seems to throw "Operation not permitted" without root privileges, anything I missing about it? –  baldrs Dec 30 '13 at 21:42
    
To use it, you either need root privileges, or CAP_SYS_ADMIN capability. –  Michał Górny Dec 31 '13 at 8:43
show 1 more comment

Yes, with customized apparmor profile, i.e

/usr/bin/curl {
    ...

    # block ipv4 acces
    deny network inet,
    # ipv6 
    deny network inet6,
    # raw socket
    deny network raw,

}

But in that way, you will need to generate a list of allowed files to access as well, the whole procedure can be a bit of complicated. And see the help document here

share|improve this answer
add comment

You cannot do it with iptables alone. This feature briefly existed, but couldn't be made to work reliably and was abandoned.

If you can run the process as a dedicated user ID, iptables can do it with the owner module:

iptables -A OUTPUT -m owner --uid-owner 1234 -j DROP

See examples in Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops, iptables/pf rule to only allow XY application/user?

If you can run the process in its own container, you can firewall that container independently (even make it completely disconnected from the network).

A security module can filter a process's access to networking features. warl0ck's answer gives an example with AppArmor.

share|improve this answer
add comment

It depends on what distro you're using but that's a feature usually included in the OS's MAC system. As stated previously Ubuntu or SuSE's AppArmor can do this. If you're using RHEL you can configure SELinux to either allow or deny access to a particular port number based on the executing process's label. This is all I could find after some fast googling but there are probably more in depth resources online if you look harder and it gives you the general idea.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.