3

I would like to get Skype working with iptables and don't want to allow a huge range of ports thus I thought a solution might be

iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT 
iptables -A INPUT -m owner --gid-owner skypeGrp -j ACCEPT

where in advance I had created a group called skypeGrp and then put the skype application into it:

sudo addgroup skypeGrp
sudo usermod some_username -G skypeGrp
sudo chgrp skypeGrp /usr/bin/skype

Shouldn't this work?

EDIT:

I think another key insight here to make the method I originally outlined in my question work, is to realise that it active group that iptables takes notice of. Thus my user doesn't just have to belong to the skypeGrp, this also must be his active group at the time of running Skype (see here for more).

1 Answer 1

3

No because the rule will check against the groups of the user, and not the group owner of the file.

But if you setgid the skype executable, the group owner of the file will also be part of the groups of the user.

chmod g+s /usr/bin/skype

Then your iptables rules should work... if Skype works and does not drop privileges.

9
  • My user that will be running Skype does not have sudo privileges, so cannot chmod, how else can I achieve this for that user? (I edited my answer to put the user in the skypeGrp as well, although this didn't seem to fix anything)
    – fpghost
    Mar 14, 2013 at 16:06
  • OK, let's say my user is called userChild so I did chown userChild /usr/bin/skype followed by chmod g+s /usr/bin/skype when logged in as userChild. So now ls -l says -rwxr-xr-x 1 userChild skypeGrp 28356768 Nov 1 01:19 /usr/bin/skype
    – fpghost
    Mar 14, 2013 at 17:00
  • the chmod g+s must obviously be made by root, this is a privileged operation. your ls -l shows clearly your file is not setgid.
    – BatchyX
    Mar 14, 2013 at 18:47
  • ls -l now gives -rwxr-sr-x 1 root skypeGrp 8429 Oct 30 2011 /usr/bin/skype and id userChild gives uid=1000(userChild) gid=1000(userChild),1006(skype),1000(userChild). This still does not seem to work however.
    – fpghost
    Mar 14, 2013 at 19:20
  • Indeed even doing chmod u+s as root to setuid as root for skype giving ls -l -rwsr-sr-x 1 root skypeGrp 8429 Oct 30 2011 /usr/bin/skype doesn't work. Even though I have the rule iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT allowing all OUTPUT from root.
    – fpghost
    Mar 14, 2013 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.