Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I had a couple of instances of programs sending data (copies of some of my config files) out over the net. I consider this very bad form on behalf of the writers, and I want to prevent it happening in future.

One example was a program that had a command line diagnostic utility. When I ran it, it immediately gathered up a bunch of info, not only the program's own config, but the system as well, and uploaded them to a server. Some of those files might have contained data like usernames and passwords.

So, like in Windows, I would like a program that warns me when another program tries to send data, or even initiate communication over the net, without my knowledge. Ideally then I can whitelist only the programs I want to allow to do this, and the rest will be prevented by default.

Edit: I found a web page from 2007 that talks about this here

They mention three programs (Systrace, Tuxguardian and Program Guard) that used to exist, but I suspect cannot be used with the new kernels and distributions like Ubuntu any more.

share|improve this question
up vote 3 down vote accepted

I don't believe there's a simple, non-technical solution. That said, if you're willing to get your hands dirty, read on.

Ubuntu uses a permissions framework called AppArmor, in which each application has a "profile" that defines what it is allowed to do. If you have administrator privileges, you can edit AppArmor profiles to allow applications on your system to do less. You can also create restrictive profiles for binaries that don't have them. Profiles are stored in /etc/apparmor.d/.

You'll want to read the AppArmor Profile Language Guide and Ubuntu Community Documentation. In essence, however, you want to remove all network permissions, and then put all profiles into "complain" mode so you know when they're trying to do networking with:

sudo aa-complain /etc/apparmor.d/*
share|improve this answer
That is good news. I was led to believe that AppArmour would need a profile for each app, and that new apps would have full access by default. What you describe sounds like it might work. I will try it out. – Jazz Jul 31 '12 at 6:20
On second reading, it still seems like new programs will have full access until a profile exists. I would have to create a new profile for each and every binary, and I may not even know or understand what comes with a package and what it might do. Worse, some packages come with profiles of their own which will allow them to do whatever they were programmed to do. – Jazz Jul 31 '12 at 6:31
You can glob match (eg write a profile for /usr/bin/*) for deny`ing. – Jjed Jul 31 '12 at 6:34
OK, I need to read further. Thanks – Jazz Jul 31 '12 at 6:40
I have read up on profiles and have found that "deny rules are evaluated before allow rules and cannot be overridden by an allow rule". So doesn't this mean that a /usr/bin/* rule denying network access will stop ALL my apps, even those with profiles allowing it, from using the network? – Jazz Jul 31 '12 at 22:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.