Update README.md

This commit is contained in:
2026-05-18 19:00:17 +01:00
parent 564cfd918c
commit a368c574bf

View File

@@ -30,29 +30,29 @@ Outbound packets belonging to the program dropped
### Creating the Group
First we will create the controlled access group through which programs will be denied public network access
```
``` bash
groupadd no-internet
```
And add your user to it
```
``` bash
usermod -a -G no-internet $(whoami)
```
You should now see no-internet as a group your user is a member of
To check run
```
``` bash
groups $(whoami)
````
```
Your user will need to be a member of the group as we will run the programs through sg
### Creating the Systemd Service
Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group
```
``` bash
touch /etc/systemd/system/no-internet.service
nano /etc/systemd/system/no-internet.service
```
Enter the following within the service file then write and quit
```
``` bash
[Unit]
Description=Drops outbound Internet traffic for the group "no-internet"
@@ -78,13 +78,13 @@ Breakdown of iptables command:
- the -j DROP flag specifies the action to take, in this case dropping the packets
Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot
```
``` bash
systemctl daemon-reload
systemctl enable --now no-internet.service
```
Note: a similar effect could be achieved via cron by making an entry along the lines of
```
``` bash
@reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP
```
### Modifying .desktop entries
@@ -98,13 +98,13 @@ They are typically located within ~/.local/share/applications
An example of a program which I want to deny network access to due to its persistent and bothersome connections is Lutris
Before modification it's Exec value will likely look something like
```
``` bash
Exec=/usr/bin/lutris
```
However we are going to modify this so it runs under the group "no-internet" any time it is launched, thereby having outbound connections dropped
This may be achieved by changing the line like so:
```
``` bash
Exec=/usr/bin/sg no-internet -c /usr/bin/lutris
```
Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path