diff --git a/README.md b/README.md index 5186203..6484e71 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # No-Internet Group ## Description -Simple minimalistic methodology to prevent specified Linux programs having access to the public Internet via iptables +Simple and minimalistic methodology to prevent specified Linux programs having access to the public Internet via iptables ## Workflow @@ -43,7 +43,7 @@ To check run ``` bash groups $(whoami) ``` -Your user will need to be a member of the group as we will run the programs through sg +Your user will need to be a member of the group as the programs will be ran via sg ### Creating the Systemd Service Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group @@ -77,13 +77,13 @@ Breakdown of iptables command: - the -j DROP flag specifies the action to take, in this case dropping the packets -Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot +Next we will reload our systemctl services, and enable the no-internet unit so it persistently starts at boot ``` bash systemctl daemon-reload systemctl enable --now no-internet.service ``` -Note: a similar effect could be achieved via cron by making an entry along the lines of +Note: a similar effect could be achieved with cron by making an entry along the lines of ``` bash @reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP ``` @@ -91,7 +91,7 @@ Note: a similar effect could be achieved via cron by making an entry along the l .desktop files are used within graphical Linux shells to launch programs -Simply put when a program is ran through an application launcher the .desktop file is what is what is being read from and executed in the background +Simply put, when a program is ran through an application launcher the .desktop file is what is what is being read from and executed in the background They are typically located within ~/.local/share/applications @@ -107,9 +107,9 @@ This may be achieved by changing the line like so: ``` bash Exec=/usr/bin/sg no-internet -c /usr/bin/lutris ``` -Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path +Note: your binaries may be located in a different place, type ``` which [program_name] ``` or ``` type [program_name] ``` into the terminal to find their path -Now any time lutris is launched from my desktop it will be ran through the "no-internet" group +Now any time Lutris is launched from my desktop it will be ran through the "no-internet" group ### Usage Examples @@ -122,4 +122,4 @@ Desktop example: ![picture](https://git.tobiastime.xyz/Tobias/No-Internet.Group/raw/branch/main/images/Screenshot_20260311_203001.webp) ### Limitations -As iptables is operating at layer 3 programs ran through this sandboxed group will still be able to reach devices within the same broadcast domain +As iptables is operating at layer 3 of the OSI model programs ran through this sandboxed group will still be able to reach devices within the same broadcast domain