Netfilter lacks ability to filter packets via Application-origin

Netfilter lacks ability to filter packets via Application-origin

[Chad Gray]

Users need the ability for Linux firewall to filter packets based on what
Application they are originating from. This ability is present in Mac and
Windows firewalls, but not Linux.

For example, users would like ability to open Port 80 for Firefox, but keep
Port 80 closed for other applications.

This ability enhances Privacy & Security of the user but also helps to better
inform the user about the comings and goings of internet traffic and what
application/s are causing the traffic.

https://bugzilla.kernel.org/show_bug.cgi?id=47531 		 	   		  

Re: Netfilter lacks ability to filter packets via Application-origin

[Ben Hutchings]

On Wed, 2012-09-19 at 15:40 -0400, Chad Gray wrote:
> Users need the ability for Linux firewall to filter packets based on what
> Application they are originating from. This ability is present in Mac and
> Windows firewalls, but not Linux.
> 
> For example, users would like ability to open Port 80 for Firefox, but keep
> Port 80 closed for other applications.
> 
> This ability enhances Privacy & Security of the user but also helps to better
> inform the user about the comings and goings of internet traffic and what
> application/s are causing the traffic.

Most of the Linux Security Modules seem to support this sort of network
policy.

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.

Re: Netfilter lacks ability to filter packets via Application-origin

[John Fastabend]

On 9/19/2012 1:24 PM, Ben Hutchings wrote:
> On Wed, 2012-09-19 at 15:40 -0400, Chad Gray wrote:
>> Users need the ability for Linux firewall to filter packets based on what
>> Application they are originating from. This ability is present in Mac and
>> Windows firewalls, but not Linux.
>>
>> For example, users would like ability to open Port 80 for Firefox, but keep
>> Port 80 closed for other applications.
>>
>> This ability enhances Privacy & Security of the user but also helps to better
>> inform the user about the comings and goings of internet traffic and what
>> application/s are causing the traffic.
>
> Most of the Linux Security Modules seem to support this sort of network
> policy.
>
> Ben.
>

Another approach might be to use the net_cls cgroups and set the
classid matching against it with tc or netfilters.

.John

RE: Netfilter lacks ability to filter packets via Application-origin

[Chad Gray]

No firewall appears to exist for Linux that can filter packets based on application. Mac and Windows both offer these firewalls. Why can't Linux add this capability to its firewalls? It is a very powerful privacy & security & awareness tool for the user. 

Every attempt I've made to get this capability added to Distributions, firewall makers, etc has resulted in their telling me the Kernel does not support this capability and that is why Linux can't do this and won't be able to do this until the Kernel supports it. 		 	   		  

Netfilter lacks ability to filter packets via Application-origin

[Chad Gray]

Users need the ability for Linux firewall to filter packets based on what 
Application they are originating from. This ability is present in Mac and 
Windows firewalls, but not Linux. 
 
For example, users would like ability to open Port 80 for Firefox, but keep 
Port 80 closed for other applications. 
 
This ability enhances Privacy & Security of the user but also helps to better 
inform the user about the comings and goings of internet traffic and what 
application/s are causing the traffic. 

https://bugzilla.kernel.org/show_bug.cgi?id=47531 		 	   		  

Re: Netfilter lacks ability to filter packets via Application-origin

[richard -rw- weinberger]

On Thu, Sep 27, 2012 at 11:04 PM, Chad Gray <chad938@hotmail.com> wrote:
> Users need the ability for Linux firewall to filter packets based on what
> Application they are originating from. This ability is present in Mac and
> Windows firewalls, but not Linux.
>
> For example, users would like ability to open Port 80 for Firefox, but keep
> Port 80 closed for other applications.

You can implement such filters using LSM like SELinux.

> This ability enhances Privacy & Security of the user but also helps to better
> inform the user about the comings and goings of internet traffic and what
> application/s are causing the traffic.

I seriously doubt that.

-- 
Thanks,
//richard

Re: Netfilter lacks ability to filter packets via Application-origin

[Ben Hutchings]

On Thu, 2012-09-27 at 17:04 -0400, Chad Gray wrote:
> Users need the ability for Linux firewall to filter packets based on what 
> Application they are originating from. This ability is present in Mac and 
> Windows firewalls, but not Linux. 
[...]

So you have said before.  But you have been given some suggestions of
facilities that are available to do this, so you should either go ahead
and use them or else explain why they are insufficient or unsuitable.
In any case, please stop repeating yourself.

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.