Update README.md

This commit is contained in:
2026-05-18 19:00:17 +01:00
parent 564cfd918c
commit a368c574bf

View File

@@ -30,29 +30,29 @@ Outbound packets belonging to the program dropped
### Creating the Group ### Creating the Group
First we will create the controlled access group through which programs will be denied public network access First we will create the controlled access group through which programs will be denied public network access
``` ``` bash
groupadd no-internet groupadd no-internet
``` ```
And add your user to it And add your user to it
``` ``` bash
usermod -a -G no-internet $(whoami) usermod -a -G no-internet $(whoami)
``` ```
You should now see no-internet as a group your user is a member of You should now see no-internet as a group your user is a member of
To check run To check run
``` ``` bash
groups $(whoami) groups $(whoami)
```` ```
Your user will need to be a member of the group as we will run the programs through sg Your user will need to be a member of the group as we will run the programs through sg
### Creating the Systemd Service ### Creating the Systemd Service
Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group
``` ``` bash
touch /etc/systemd/system/no-internet.service touch /etc/systemd/system/no-internet.service
nano /etc/systemd/system/no-internet.service nano /etc/systemd/system/no-internet.service
``` ```
Enter the following within the service file then write and quit Enter the following within the service file then write and quit
``` ``` bash
[Unit] [Unit]
Description=Drops outbound Internet traffic for the group "no-internet" Description=Drops outbound Internet traffic for the group "no-internet"
@@ -78,13 +78,13 @@ Breakdown of iptables command:
- the -j DROP flag specifies the action to take, in this case dropping the packets - the -j DROP flag specifies the action to take, in this case dropping the packets
Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot
``` ``` bash
systemctl daemon-reload systemctl daemon-reload
systemctl enable --now no-internet.service systemctl enable --now no-internet.service
``` ```
Note: a similar effect could be achieved via cron by making an entry along the lines of Note: a similar effect could be achieved via cron by making an entry along the lines of
``` ``` bash
@reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP @reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP
``` ```
### Modifying .desktop entries ### Modifying .desktop entries
@@ -98,13 +98,13 @@ They are typically located within ~/.local/share/applications
An example of a program which I want to deny network access to due to its persistent and bothersome connections is Lutris An example of a program which I want to deny network access to due to its persistent and bothersome connections is Lutris
Before modification it's Exec value will likely look something like Before modification it's Exec value will likely look something like
``` ``` bash
Exec=/usr/bin/lutris Exec=/usr/bin/lutris
``` ```
However we are going to modify this so it runs under the group "no-internet" any time it is launched, thereby having outbound connections dropped However we are going to modify this so it runs under the group "no-internet" any time it is launched, thereby having outbound connections dropped
This may be achieved by changing the line like so: This may be achieved by changing the line like so:
``` ``` bash
Exec=/usr/bin/sg no-internet -c /usr/bin/lutris Exec=/usr/bin/sg no-internet -c /usr/bin/lutris
``` ```
Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path