mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Update Rules-examples.md

Browse source
This commit is contained in:
Gustavo Iñiguez Goia 2024-06-11 08:51:43 +00:00 • committed by GitHub
parent f31f2ce0e0
commit 6529dc28c1
Failed to generate hash of commit
1 changed files with 32 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
wiki/Rules-examples.md
View file

@ -70,14 +70,43 @@ targets ports 5551, 5552, 5553, 5554 OR 5555.
[x] From this User ID: ^(0|115|118)$
```
**Blocking connections made by executables launched from /tmp**
**Blocking connections initiated by executables launched from /tmp*, /var/tmp or /dev/shm*
---
```
Action: Deny
[x] From this executable: /tmp/.*
Action: Deny
[x] From this executable: ^(/tmp/|/var/tmp/|/dev/shm/).*
```
**Blocking connections initiated by executables with certain environment variables (LD_PRELOAD for example)*
---
Note: This feature cannot configured from the GUI yet (11/06/2024)
Block outbound connections initiated by executables with certain environment variables, like when LD_PRELOAD is used maliciously:
`~ $ LD_PRELOAD=/tmp/backdoor.so sshd 1.2.3.4 443`
```json
{
"created": "2024-05-31T23:39:28+02:00",
"updated": "2024-05-31T23:39:28+02:00",
"name": "000-block-ld-preload",
"description": "",
"action": "reject",
"duration": "always",
"enabled": true,
"precedence": true,
"nolog": false
"operator": {
"operand": "process.env.LD_PRELOAD",
"data": "^(\\.|/).*",
"type": "regexp",
"sensitive": false
}
}
```
**Filtering an executable path with regexp, for example any python binary in /usr/bin/**
---