Update README.md
This commit is contained in:
20
README.md
20
README.md
@@ -30,29 +30,29 @@ Outbound packets belonging to the program dropped
|
|||||||
|
|
||||||
### Creating the Group
|
### Creating the Group
|
||||||
First we will create the controlled access group through which programs will be denied public network access
|
First we will create the controlled access group through which programs will be denied public network access
|
||||||
```
|
``` bash
|
||||||
groupadd no-internet
|
groupadd no-internet
|
||||||
```
|
```
|
||||||
And add your user to it
|
And add your user to it
|
||||||
```
|
``` bash
|
||||||
usermod -a -G no-internet $(whoami)
|
usermod -a -G no-internet $(whoami)
|
||||||
```
|
```
|
||||||
You should now see no-internet as a group your user is a member of
|
You should now see no-internet as a group your user is a member of
|
||||||
|
|
||||||
To check run
|
To check run
|
||||||
```
|
``` bash
|
||||||
groups $(whoami)
|
groups $(whoami)
|
||||||
````
|
```
|
||||||
Your user will need to be a member of the group as we will run the programs through sg
|
Your user will need to be a member of the group as we will run the programs through sg
|
||||||
|
|
||||||
### Creating the Systemd Service
|
### Creating the Systemd Service
|
||||||
Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group
|
Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group
|
||||||
```
|
``` bash
|
||||||
touch /etc/systemd/system/no-internet.service
|
touch /etc/systemd/system/no-internet.service
|
||||||
nano /etc/systemd/system/no-internet.service
|
nano /etc/systemd/system/no-internet.service
|
||||||
```
|
```
|
||||||
Enter the following within the service file then write and quit
|
Enter the following within the service file then write and quit
|
||||||
```
|
``` bash
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=Drops outbound Internet traffic for the group "no-internet"
|
Description=Drops outbound Internet traffic for the group "no-internet"
|
||||||
|
|
||||||
@@ -78,13 +78,13 @@ Breakdown of iptables command:
|
|||||||
- the -j DROP flag specifies the action to take, in this case dropping the packets
|
- the -j DROP flag specifies the action to take, in this case dropping the packets
|
||||||
|
|
||||||
Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot
|
Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot
|
||||||
```
|
``` bash
|
||||||
systemctl daemon-reload
|
systemctl daemon-reload
|
||||||
systemctl enable --now no-internet.service
|
systemctl enable --now no-internet.service
|
||||||
```
|
```
|
||||||
|
|
||||||
Note: a similar effect could be achieved via cron by making an entry along the lines of
|
Note: a similar effect could be achieved via cron by making an entry along the lines of
|
||||||
```
|
``` bash
|
||||||
@reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP
|
@reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP
|
||||||
```
|
```
|
||||||
### Modifying .desktop entries
|
### Modifying .desktop entries
|
||||||
@@ -98,13 +98,13 @@ They are typically located within ~/.local/share/applications
|
|||||||
An example of a program which I want to deny network access to due to its persistent and bothersome connections is Lutris
|
An example of a program which I want to deny network access to due to its persistent and bothersome connections is Lutris
|
||||||
|
|
||||||
Before modification it's Exec value will likely look something like
|
Before modification it's Exec value will likely look something like
|
||||||
```
|
``` bash
|
||||||
Exec=/usr/bin/lutris
|
Exec=/usr/bin/lutris
|
||||||
```
|
```
|
||||||
However we are going to modify this so it runs under the group "no-internet" any time it is launched, thereby having outbound connections dropped
|
However we are going to modify this so it runs under the group "no-internet" any time it is launched, thereby having outbound connections dropped
|
||||||
|
|
||||||
This may be achieved by changing the line like so:
|
This may be achieved by changing the line like so:
|
||||||
```
|
``` bash
|
||||||
Exec=/usr/bin/sg no-internet -c /usr/bin/lutris
|
Exec=/usr/bin/sg no-internet -c /usr/bin/lutris
|
||||||
```
|
```
|
||||||
Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path
|
Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path
|
||||||
|
|||||||
Reference in New Issue
Block a user