diff --git a/README.md b/README.md index f286623..8974c1e 100644 --- a/README.md +++ b/README.md @@ -30,29 +30,29 @@ Outbound packets belonging to the program dropped ### Creating the Group First we will create the controlled access group through which programs will be denied public network access -``` +``` bash groupadd no-internet ``` And add your user to it -``` +``` bash usermod -a -G no-internet $(whoami) ``` You should now see no-internet as a group your user is a member of To check run -``` +``` bash groups $(whoami) -```` +``` Your user will need to be a member of the group as we will run the programs through sg ### Creating the Systemd Service Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group -``` +``` bash touch /etc/systemd/system/no-internet.service nano /etc/systemd/system/no-internet.service ``` Enter the following within the service file then write and quit -``` +``` bash [Unit] Description=Drops outbound Internet traffic for the group "no-internet" @@ -78,13 +78,13 @@ Breakdown of iptables command: - the -j DROP flag specifies the action to take, in this case dropping the packets Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot -``` +``` bash systemctl daemon-reload systemctl enable --now no-internet.service ``` Note: a similar effect could be achieved via cron by making an entry along the lines of -``` +``` bash @reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP ``` ### Modifying .desktop entries @@ -98,13 +98,13 @@ They are typically located within ~/.local/share/applications An example of a program which I want to deny network access to due to its persistent and bothersome connections is Lutris Before modification it's Exec value will likely look something like -``` +``` bash Exec=/usr/bin/lutris ``` However we are going to modify this so it runs under the group "no-internet" any time it is launched, thereby having outbound connections dropped This may be achieved by changing the line like so: -``` +``` bash Exec=/usr/bin/sg no-internet -c /usr/bin/lutris ``` Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path