Users need the ability for Linux firewall to filter packets based on what
Application they are originating from. This ability is present in Mac and
Windows firewalls, but not Linux.
For example, users would like ability to open Port 80 for Firefox, but keep
Port 80 closed for other applications.
This ability enhances Privacy & Security of the user but also helps to better
inform the user about the comings and goings of internet traffic and what
application/s are causing the traffic.
https://bugzilla.kernel.org/show_bug.cgi?id=47531
On Wed, 2012-09-19 at 15:40 -0400, Chad Gray wrote:
Users need the ability for Linux firewall to filter packets based on what
Application they are originating from. This ability is present in Mac and
Windows firewalls, but not Linux.
For example, users would like ability to open Port 80 for Firefox, but keep
Port 80 closed for other applications.
This ability enhances Privacy & Security of the user but also helps to better
inform the user about the comings and goings of internet traffic and what
application/s are causing the traffic.
Most of the Linux Security Modules seem to support this sort of network
policy.
Ben.
--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
On 9/19/2012 1:24 PM, Ben Hutchings wrote:
On Wed, 2012-09-19 at 15:40 -0400, Chad Gray wrote:
quoted
Users need the ability for Linux firewall to filter packets based on what
Application they are originating from. This ability is present in Mac and
Windows firewalls, but not Linux.
For example, users would like ability to open Port 80 for Firefox, but keep
Port 80 closed for other applications.
This ability enhances Privacy & Security of the user but also helps to better
inform the user about the comings and goings of internet traffic and what
application/s are causing the traffic.
Most of the Linux Security Modules seem to support this sort of network
policy.
Ben.
Another approach might be to use the net_cls cgroups and set the
classid matching against it with tc or netfilters.
.John