Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I wish to prevent some programs from "phoning home", and to allow other programs to access only specific web servers.

Is there any way to interactively allow or decline outbound communication from individual programs on Ubuntu?

share|improve this question
add comment

4 Answers

You could give Anoubis a try. There are installation instructions and packages for Karmic Koala available (I'm new to superuser, so you'll have to find them yourself >:-S Hint: on the Download page scroll down to "Distributions").

share|improve this answer
add comment

Well not exactly interactive but I know about 3 ways to restrict network access to programs.

  1. By default linux assigns permissions to users and every program they run has the same permissions. Run the untrusted program as a separate user. This is pretty simple if you can do it. (Sometimes you can't like when a program requres root privileges.) Add the following firewall rule:

    iptables -A OUTPUT -m owner --uid-owner ${untrusted_uid} -j DROP
    
  2. If you are not afraid of patching the kernel try grsecurity. It allows different permissions for different executables for the same user. This is probably the best way because you can integrate it with iptables rules and specify detailed restrictions. The rules should look something like:

    ...
    role your_regular_user u
        ...
        subject /path/to/untrusted/program
            connect disabled
        ...
    ...
    
  3. Disable the connect() function with LD_PRELOAD. This is the ugliest way only use it if you have no other option. You will need a library like this:

    #include <errno.h>
    #include <stdio.h>
    #include <sys/types.h>
    #include <sys/socket.h>
    
    
    int connect(int sockfd, struct sockaddr const* addr, socklen_t addrlen) {
        errno = ECONNREFUSED;
        printf("connection refused\n");
        return -1;
    }
    

    Compile this with

    gcc -fPIC -shared -Wl,-soname,fake_connect fake_connect.c -o libfake_connect.so
    

    Start the program with

    LD_PRELOAD="./libfake_connect.so" ./untrusted_program
    
share|improve this answer
add comment

That would be netfilter/ipfilter with some script that would do things interactively (maybe with the nice API available on Ubuntu) using a background scripting.

There is some old discussion at this UbuntuForums page.
Also see, Ubuntu IPTablesHowTo and Firewall pages.

share|improve this answer
add comment

I had been using gufw for some time, it's nice and easy to install/configure. gufw doesn't come with Ubuntu installations. You have to install it manually 'sudo apt-get install gufw'.

Here are some of the references.

https://help.ubuntu.com/community/Gufw

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.