Allow internet/network access based on binary -- ask user for permission if a binary wants to connect to the internet

[Daniel J Walsh]

You can do this with SELinux and confined users somewhat.

YOU basically could setup a user as xguest with no network access and
then write
policy to transition to certain domains that can use the internet.  No
ability to prompt the user
though.

This will get you most of the way you want to go, but somethings can be
tricky.

Also lots of apps contact the network just by calling getpw* calls, if
you have certain settings in nsswitch.


On 12/09/2014 06:16 AM, Bastien Nocera wrote:
>
> ----- Original Message -----
>> I only want certain binaries to be allowed network access.
>>
>> For example, I want to allow the below binaries access to the internet:
>>
>> /usr/lib64/firefox/firefox
>> /usr/lib/virtualbox/VirtualBox
>> /bin/yum (it seems to be done via python like /usr/bin/python /bin/yum
>> update -- so here obviously python is allowed network access only for
>> yum ('the binary'). This rule should not give python network access
>> for any other binaries/.py scripts etc.)
>>
>> I want no other binary to be able to access the network.
> It's not implementable, because you have no way to know that the
> binary trying to access the network is what it says it is.
>
> For now, at least. We'll certainly get something like that when
> application sandboxing is implemented and deployed.