Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have python script that uses pywebkitgtk for fetching web-pages, and I need to block network access for it sometimes. Any ideas how to do that?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

If you are the system administrator, you can use iptables (as root) to block certain commands from accessing certain ports, or (at your option) all ports (which is equivalent to it being totally unable to access the network).

A good reference is here but the salient point is:

If your kernel was compiled with CONFIG_IP_NF_MATCH_OWNER then you can configure your iptables firewall to allow or reject packets on a per-command basis.

The following example shows how to drop all outgoing packets from the acroread command:

iptables -A OUTPUT -m owner --cmd-owner acroread -j DROP

The owner module allows several different options to be used to match, allowing either matching against a process ID, a user ID, or a command name.

--uid-owner userid
Matches if the packet was created by a process with the given effective user id

--gid-owner userid
Matches if the packet was created by a process with the given effective group id

--pid-id processid
Matches if the packet was created by a process with the given process id

--cmd-owner name
Matches if the packet was created by a process with the given command name.

The "owner" module only allows matches on the OUTPUT chain, which lowers its usefulness a little - but if you're in a standard NAT situation it should be sufficient.

share|improve this answer
    
Thanks a lot, I hope it will help, I need to recompile my kernel to check it... There are one thing I dont sure - would iptables-magic work without restarting my program's process? –  scythargon Aug 23 '12 at 4:26
    
o_O 3.2.28 have no such key... –  scythargon Aug 23 '12 at 8:00
    
I believe if you have this enabled, it will take effect on running processes without restarting them. –  ÃŁŁǫǛȉЖΦΤїҪ Aug 23 '12 at 13:17
    
look at this - superuser.com/questions/465235/… - this key exist only in old kernels (2.6.0 - 2.6.24)... –  scythargon Aug 23 '12 at 13:37
    
It was probably wrapped into another key or enabled by default. Are you able to get the above functionality to work with iptables with your existing kernel? –  ÃŁŁǫǛȉЖΦΤїҪ Aug 23 '12 at 14:01
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.