[HN Gopher] Host Firewalls
       ___________________________________________________________________
        
       Host Firewalls
        
       Author : srijan4
       Score  : 16 points
       Date   : 2022-02-22 18:32 UTC (4 hours ago)
        
 (HTM) web link (computer.rip)
 (TXT) w3m dump (computer.rip)
        
       | egberts1 wrote:
       | Nftables and Linux still hasn't been able to filter ---> INBOUND
       | <---packets by Process ID, by Process group ID, by process name,
       | and possibly by process namespace.
        
         | process_me wrote:
         | Can you explain how this would work?
         | 
         | An ingress packet doesn't come with a process ID.
         | 
         | How can the wanted functionality not be implemented by applying
         | filters to the port bound by the process?
        
           | egberts1 wrote:
           | If a process opens a socket, OS has sufficient info to tag
           | the packet with a process ID.
           | 
           | Perfect for alerting while under the Default-Deny Firewall.
           | 
           | Somehow, FreeBSD has those.
        
         | emj wrote:
         | It is said in the article says you have to get your hands
         | dirty, but yeah I can not see any easy way. Researching the
         | naive way I got stuck in eBPF filters, and that will also fail
         | with doing process/socket lookups since several applications
         | can listen on a port. I guess you can filter on delivery to the
         | application in some way..
        
           | egberts1 wrote:
           | But you can get your process ID associated with a network
           | packet ... just in FreeBSD bind to socket (single process)
        
       | sliken wrote:
       | Not sure if it was selinux, or apparmor. But I really appreciated
       | when I opened a PDF I got a popup saying "The PDF reader is
       | trying to open an outgoing connection to foo.adobe.com". Turns
       | out some PDFs have tracking magic in them and report to home
       | base, I would have never known. This kind of thing seems like a
       | common security restriction for android apps, but much less so
       | for desktop apps.
        
       | dSebastien wrote:
       | I've used those forever on my machines and couldn't live without
       | one.
        
       | softwarebeware wrote:
       | > Really, what we are talking about is this: what if, when Zoom
       | sent telemetry to Facebook without your authorization or
       | knowledge apparently because they used some library and didn't
       | realize it did that, your host firewall told you that this random
       | application was shipping your most personal secrets directly to
       | Mark Zuckerburg and, even better, prevented it doing so until you
       | considered the question?
       | 
       | Yes, please! That would be amazing
        
         | gruez wrote:
         | Those already exist, eg. littlesnitch on mac. As it relates to
         | this problem though (ie. zoom), such program would get annoying
         | pretty quick, because they'll be connecting to random IPs every
         | time (different relay servers/peers), so you eventually get
         | tired of the alerts and whitelist everything.
        
       ___________________________________________________________________
       (page generated 2022-02-22 23:02 UTC)