2

I know the PID of a specific process and I want to disable the Internet access for this process and only for this process, so other process can access Internet.

Is there any way to do it?


I googled some stuff and found a way to disable Internet for executable programs. But I need, for example, to have two running chrome, one having access to Internet and other not.

  • two running 'firefox' - What do you mean? Two firefox windows? And have you tried it or not? – Lucio Jan 31 '13 at 13:56
  • Sorry, didn't look into it. I tried it, and as far as I understand - firefox run in single process. But another example is Google Chrome - it's create process for each window – ShockwaveNN Jan 31 '13 at 14:08
  • Can't see how it can help me, I want to disable internet, not to kill a process. I used a command killall -e chrome and it closed all windows of chrome – ShockwaveNN Jan 31 '13 at 14:33
  • Why don't you put the procedure that you're doing or at lest link the page where it is described? – Lucio Jan 31 '13 at 14:46
2

I've just had the same question and found a really nice solution on ubuntuforums.org

Summary

  • add a group "no-internet" and add your user to it

    sudo addgroup no-internet
    sudo adduser $USER no-internet
    
  • add a iptables rule to prevent that group from accessing the network:

    iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP
    
  • run the process you don't want to have internet access like with sg (execute command as different group ID):

    sg no-internet "process command line"
    
2

I would recommend using firewall rules to lock that program out. If you can isolate the port numbers that the program is using you can block traffic on those ports. You can also set up "per process" firewall rules with SELinux or other security software.

https://help.ubuntu.com/community/Gufw

If you're looking for something a little more direct or challenging you can configure IPTables as documented here.

  • I think that if you block a port, you are blocking a specific service. So if you block the port/s that chrome is using to forbid the Internet access, then any browser will have these rules. – Lucio Jan 31 '13 at 15:37
  • You are correct. Generally speaking, "per-process" firewalls are frowned upon in the Linux community. This is because if a program with execute permission wants to do something naughty on your network it can just proxy itself through another app that is allowed. Real best practice would dictate you don't have any software that needs blocking. – user89599 Jan 31 '13 at 15:53
0

For myself i've wrote a preload which is controlling the connect system call.

Every IPv4 and IPv6 connection except to localhost (127.0.0.1 and ::) are dropped by an timeout.

I've tested them with different tools like telnet, wine, apt-get...

You can download the source here.

  • 3
    Maybe would be nice, but still 404 error :-( – 1111161171159459134 Dec 21 '15 at 19:01
  • -1 because it's essentially a link-only answer (and broken link at that): a reference to a private storage of a privately-written software with no information on alternative sources to download it from. – Ruslan Aug 9 '18 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.