Update README.md
This commit is contained in:
20
README.md
20
README.md
@@ -30,29 +30,29 @@ Outbound packets belonging to the program dropped
|
||||
|
||||
### Creating the Group
|
||||
First we will create the controlled access group through which programs will be denied public network access
|
||||
```
|
||||
``` bash
|
||||
groupadd no-internet
|
||||
```
|
||||
And add your user to it
|
||||
```
|
||||
``` bash
|
||||
usermod -a -G no-internet $(whoami)
|
||||
```
|
||||
You should now see no-internet as a group your user is a member of
|
||||
|
||||
To check run
|
||||
```
|
||||
``` bash
|
||||
groups $(whoami)
|
||||
````
|
||||
```
|
||||
Your user will need to be a member of the group as we will run the programs through sg
|
||||
|
||||
### Creating the Systemd Service
|
||||
Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group
|
||||
```
|
||||
``` bash
|
||||
touch /etc/systemd/system/no-internet.service
|
||||
nano /etc/systemd/system/no-internet.service
|
||||
```
|
||||
Enter the following within the service file then write and quit
|
||||
```
|
||||
``` bash
|
||||
[Unit]
|
||||
Description=Drops outbound Internet traffic for the group "no-internet"
|
||||
|
||||
@@ -78,13 +78,13 @@ Breakdown of iptables command:
|
||||
- the -j DROP flag specifies the action to take, in this case dropping the packets
|
||||
|
||||
Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot
|
||||
```
|
||||
``` bash
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now no-internet.service
|
||||
```
|
||||
|
||||
Note: a similar effect could be achieved via cron by making an entry along the lines of
|
||||
```
|
||||
``` bash
|
||||
@reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP
|
||||
```
|
||||
### Modifying .desktop entries
|
||||
@@ -98,13 +98,13 @@ They are typically located within ~/.local/share/applications
|
||||
An example of a program which I want to deny network access to due to its persistent and bothersome connections is Lutris
|
||||
|
||||
Before modification it's Exec value will likely look something like
|
||||
```
|
||||
``` bash
|
||||
Exec=/usr/bin/lutris
|
||||
```
|
||||
However we are going to modify this so it runs under the group "no-internet" any time it is launched, thereby having outbound connections dropped
|
||||
|
||||
This may be achieved by changing the line like so:
|
||||
```
|
||||
``` bash
|
||||
Exec=/usr/bin/sg no-internet -c /usr/bin/lutris
|
||||
```
|
||||
Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path
|
||||
|
||||
Reference in New Issue
Block a user