Update README.md
This commit is contained in:
16
README.md
16
README.md
@@ -1,7 +1,7 @@
|
|||||||
# No-Internet Group
|
# No-Internet Group
|
||||||
|
|
||||||
## Description
|
## Description
|
||||||
Simple minimalistic methodology to prevent specified Linux programs having access to the public Internet via iptables
|
Simple and minimalistic methodology to prevent specified Linux programs having access to the public Internet via iptables
|
||||||
|
|
||||||
## Workflow
|
## Workflow
|
||||||
|
|
||||||
@@ -43,7 +43,7 @@ To check run
|
|||||||
``` bash
|
``` bash
|
||||||
groups $(whoami)
|
groups $(whoami)
|
||||||
```
|
```
|
||||||
Your user will need to be a member of the group as we will run the programs through sg
|
Your user will need to be a member of the group as the programs will be ran via sg
|
||||||
|
|
||||||
### Creating the Systemd Service
|
### Creating the Systemd Service
|
||||||
Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group
|
Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group
|
||||||
@@ -77,13 +77,13 @@ Breakdown of iptables command:
|
|||||||
|
|
||||||
- the -j DROP flag specifies the action to take, in this case dropping the packets
|
- the -j DROP flag specifies the action to take, in this case dropping the packets
|
||||||
|
|
||||||
Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot
|
Next we will reload our systemctl services, and enable the no-internet unit so it persistently starts at boot
|
||||||
``` bash
|
``` bash
|
||||||
systemctl daemon-reload
|
systemctl daemon-reload
|
||||||
systemctl enable --now no-internet.service
|
systemctl enable --now no-internet.service
|
||||||
```
|
```
|
||||||
|
|
||||||
Note: a similar effect could be achieved via cron by making an entry along the lines of
|
Note: a similar effect could be achieved with cron by making an entry along the lines of
|
||||||
``` bash
|
``` bash
|
||||||
@reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP
|
@reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP
|
||||||
```
|
```
|
||||||
@@ -91,7 +91,7 @@ Note: a similar effect could be achieved via cron by making an entry along the l
|
|||||||
|
|
||||||
.desktop files are used within graphical Linux shells to launch programs
|
.desktop files are used within graphical Linux shells to launch programs
|
||||||
|
|
||||||
Simply put when a program is ran through an application launcher the .desktop file is what is what is being read from and executed in the background
|
Simply put, when a program is ran through an application launcher the .desktop file is what is what is being read from and executed in the background
|
||||||
|
|
||||||
They are typically located within ~/.local/share/applications
|
They are typically located within ~/.local/share/applications
|
||||||
|
|
||||||
@@ -107,9 +107,9 @@ This may be achieved by changing the line like so:
|
|||||||
``` bash
|
``` bash
|
||||||
Exec=/usr/bin/sg no-internet -c /usr/bin/lutris
|
Exec=/usr/bin/sg no-internet -c /usr/bin/lutris
|
||||||
```
|
```
|
||||||
Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path
|
Note: your binaries may be located in a different place, type ``` which [program_name] ``` or ``` type [program_name] ``` into the terminal to find their path
|
||||||
|
|
||||||
Now any time lutris is launched from my desktop it will be ran through the "no-internet" group
|
Now any time Lutris is launched from my desktop it will be ran through the "no-internet" group
|
||||||
|
|
||||||
### Usage Examples
|
### Usage Examples
|
||||||
|
|
||||||
@@ -122,4 +122,4 @@ Desktop example:
|
|||||||

|

|
||||||
|
|
||||||
### Limitations
|
### Limitations
|
||||||
As iptables is operating at layer 3 programs ran through this sandboxed group will still be able to reach devices within the same broadcast domain
|
As iptables is operating at layer 3 of the OSI model programs ran through this sandboxed group will still be able to reach devices within the same broadcast domain
|
||||||
|
|||||||
Reference in New Issue
Block a user