summaryrefslogtreecommitdiff
path: root/README.md
blob: 68f888484f4ab8405e3e727bb818e7c20e63c99a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
qsni¹
====
qsni (quite simple network isolation) allows for simple assignment
of per cgroup iptables rules to programs.

While you can also achieve this (and more) using network namespaces,
the setup is not as simple/easy.

Requirements
------------
You need an iptables version that supports cgroup matching (e. g. 
version >= 1.6) and rust/cargo to build the binary

The following kernel config parameters must be set:
  * CONFIG_NETFILTER_XT_MATCH_CGROUP
  * CONFIG_NET_CLS_CGROUP

Example
-------
```
$ qsni blocked ping google.com
ping: unknown host google.com
```

```
$ qsni lan bash
$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
$ ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.127 ms
$ qsni someprofile bash
already assigned to a net class, thus you can't use this binary to change that
$
```

Setup
-----
If cgroup_root isn't mounted to /sys/fs/cgroup, do it or change the 
constant in the source to the correct path.

```
cargo build --release 
cp target/release/qsni /usr/bin/
chmod o=rx /usr/bin/qsni
chown root:root /usr/bin/qsni
setcap 'cap_setuid=ep cap_setgid=ep' /usr/bin/qsni

mkdir /etc/qsni.d
chmod o=rx /etc/qsni.d
cp profiles/blocked /etc/qsni.d/blocked
chmod o=r /etc/qsni.d/blocked
```

Every profile must have its own unique CGROUP_ID value in the profile 
file.


Security discussion
--------------------
This alone is not a satisfactory way to prevent misbehaving programs
to contact destinations you don't want them to. While the restrictions
also apply to the children of the launched programs, at a minimum, file
system isolation is also necessary and perhaps IPC etc.

qsni however does not aim to be a complete "jailing/isolation" solution.
Nevertheless, I have use cases for it, hence its existence.

¹ name is preliminary