Netfilter lacks ability to filter packets via Application-origin

3 messages, 3 authors, 2012-09-19 · open the first message on its own page

Netfilter lacks ability to filter packets via Application-origin

From: Chad Gray <hidden>
Date: 2012-09-19 19:40:41

Users need the ability for Linux firewall to filter packets based on what
Application they are originating from. This ability is present in Mac and
Windows firewalls, but not Linux.

For example, users would like ability to open Port 80 for Firefox, but keep
Port 80 closed for other applications.

This ability enhances Privacy & Security of the user but also helps to better
inform the user about the comings and goings of internet traffic and what
application/s are causing the traffic.

https://bugzilla.kernel.org/show_bug.cgi?id=47531 		 	   		  

Re: Netfilter lacks ability to filter packets via Application-origin

From: Ben Hutchings <hidden>
Date: 2012-09-19 20:24:15

On Wed, 2012-09-19 at 15:40 -0400, Chad Gray wrote:
Users need the ability for Linux firewall to filter packets based on what
Application they are originating from. This ability is present in Mac and
Windows firewalls, but not Linux.

For example, users would like ability to open Port 80 for Firefox, but keep
Port 80 closed for other applications.

This ability enhances Privacy & Security of the user but also helps to better
inform the user about the comings and goings of internet traffic and what
application/s are causing the traffic.
Most of the Linux Security Modules seem to support this sort of network
policy.

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.

Re: Netfilter lacks ability to filter packets via Application-origin

From: John Fastabend <hidden>
Date: 2012-09-19 20:50:41

On 9/19/2012 1:24 PM, Ben Hutchings wrote:
On Wed, 2012-09-19 at 15:40 -0400, Chad Gray wrote:
quoted
Users need the ability for Linux firewall to filter packets based on what
Application they are originating from. This ability is present in Mac and
Windows firewalls, but not Linux.

For example, users would like ability to open Port 80 for Firefox, but keep
Port 80 closed for other applications.

This ability enhances Privacy & Security of the user but also helps to better
inform the user about the comings and goings of internet traffic and what
application/s are causing the traffic.
Most of the Linux Security Modules seem to support this sort of network
policy.

Ben.
Another approach might be to use the net_cls cgroups and set the
classid matching against it with tc or netfilters.

.John
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help