On Windows, rules can be added to the firewall to allow/deny network traffic based on which binary is sending/receiving the data. Can this be done on a Linux box, and if not, why not? Is it a bad idea per se, or is it just not something that the makers of Linux thought of?
It is a bad idea to discriminate on process image and expect to gain some sort of security from that, if you do not protect these processes.
Executable image whitelist
For example, say you only allow wget and curl and block all other network accesses. You might think that this security setting allows arbitrary HTTP/s, FTP, etc. requests, but not sending arbitrary data via TCP, or starting arbitrary TCP servers sockets, or using UDP. But because wget and curl are ordinary dynamically linked non Set-something programs, they can be :
If you want to associate any specific rights to specific images (f.ex.
Of course you can only protect a process if it is designed to be protected from its user, and most programs are not. In particular most browsers allow the installation of arbitrary extensions which are allowed to access the network, all from the browser process, with the process's rights, sometimes with no specific security restriction whatsoever, so you would also have to prevent installation of extensions in whitelisted programs.
Executable image blacklist
OTOH, you may use the firewall to prevent specific daemons from accessing the network, or opening any unexpected connections.
To enforce these restriction, you need at least to :
Starting arbitrary executable images is done with
But an executable image can also be indirectly done by adding
These restriction have to be integrated OS-wide, not just kernel-wide. This goes against Unix tradition where any process with a user-ID is expected allowed to start any process with its user-ID, and the
See the pattern? Enforcement of a blacklist of specific processes preventing specific system calls (network access) leads to more backlists not only on other system calls (
The "kernel" of the kernel (the micro-kernel part of a monolithic kernel) must know about process rights, not just a specific subsystem (network subsystem, file-system, etc.). The "right to network" is an essential property of a process, just like user-IDs or the capability set.
Or you can say that all you need is a protection from non-adaptive threats: you are afraid of standard worms/viruses, not targeted attacks.
This is a general problem in any retrofitted security feature.
This is why I think that capabilities is fundamentally a terribly broken idea. Unix is based on user-ID: if you want security isolation, use a different UID. This resource is cheap.