Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall even if it was able to get higher privileges.
Hope in deep explaination for both Windows (consider a generic firewall) and Linux machines.
Thanks and have a nice day.

share|improve this question

closed as unclear what you're asking by Adi, TildalWave, Lucas Kauffman, Steve, AviD Jan 8 '14 at 9:36

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 5 down vote accepted

iptables is a user-mode program that acts as an interface to the Netfilter hooks that the Linux kernel provides. By it's very definition, it cannot run in kernel mode as it is a user-mode program designed to interface with a set of kernel hooks.

iptables can only be modified by the root user anyway. If a piece of malware manages to elevate privileges that high, you are screwed anyway. It's impossible (or at least close to impossible) to defend against a malicious root user.

share|improve this answer
True. We've also to consider though, that if you run an untrusted and unknown application as root, then you are going to expect/deserve anything. – black Dec 28 '13 at 14:10

Terry's answer is correct, protecting against a malicious root user is just not possible.

Some further information:

iptables is the userspace command line program used to configure the Linux and later packet filtering ruleset (used to interface onto netfilter which is the kernel side of the firewall). Netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

On windows this is the WFP (Windows Filtering Platform). Windows Filtering Platform (WFP) is a set of API and system services that provide a platform for creating network filtering applications. The WFP API allows developers to write code that interacts with the packet processing that takes place at several layers in the networking stack of the operating system. Network data can be filtered and also modified before it reaches its destination. The WFP API consists of a user-mode API and a kernel-mode API. This section provides an overview of the entire WFP and describes in detail only the user-mode portion of the WFP API.

share|improve this answer
It is possible to protect against a malicious root user using MAC (SELinux, Grsecurity) or dropping capabilities. However, the MAC policy has to be configured for your use case. – Matrix Dec 29 '13 at 8:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.