Application level firewalling

There are many application-level firewalls for other platforms, which allow you to allow or deny particular programs from making use of your network. With the standard iptables firewalling tool you can achive the same thing on Debian systems.

Although I've not seen this documented in many places I've recently been experimenting with firewalling some applications to avoid unwelcome privacy leaks, and to more tightly control the system.

If your kernel was compiled with CONFIG_IP_NF_MATCH_OWNER then you can configure your iptables firewall to allow or reject packets on a per-command basis.

The following example shows how to drop all outgoing packets from the acroread command:

iptables -A OUTPUT -m owner --cmd-owner acroread -j DROP

The owner module allows several different options to be used to match, allowing either matching against a process ID, a user ID, or a command name.

• --uid-owner userid
  • Matches if the packet was created by a process with the given effective user id
• --gid-owner userid
  • Matches if the packet was created by a process with the given effective group id
• --pid-id processid
  • Matches if the packet was created by a process with the given process id
• --cmd-owner name
  • Matches if the packet was created by a process with the given command name.

The "owner" module only allows matches on the OUTPUT chain, which lowers its usefulness a little - but if you're in a standard NAT situation it should be sufficient.