mirror of
https://github.com/evilsocket/opensnitch.git
synced 2025-03-04 00:24:40 +01:00
2509d21e30
Some use cases:
- Reject connections initiated by certain paths:
Deny all connections initiated by cron*:
/usr/sbin/cron
/usr/bin/curl
"action": "reject",
"operator: {
"type": "list",
"operand": "list",
"data": "",
"list": [
{
"type": "regexp",
"operand": "process.parent.path",
// /usr/bin/crond , /usr/bin/crontab, ...
"data": "^/usr/(s|)bin/cron"
}
]
}
- Reject or Allow connections of binaries launched by another app:
"action": "allow",
"operator": {
"type": "list",
"operand": "list",
"data": "",
"list": [
{
"type": "simple",
"operand": "process.parent.path",
"data": "/opt/spotify/bin/spotify"
},
{
"type": "simple",
"operand": "process.path",
"data": "/usr/bin/wget"
}
]
}
You can also combine multiple parent paths, to allow a command launched
from a specific chain of processes:
/usr/lib/systemd/systemd
/usr/sbin/cron
/bin/sh
/usr/bin/curl
The order is checked from the newest process to the oldest (curl -> sh
-> cron -> systemd)
The operand can be used with any of the existing types (simple, regexp,
etc).
Related: #406
|
||
|---|---|---|
| .. | ||
| testdata | ||
| loader.go | ||
| loader_test.go | ||
| operator.go | ||
| operator_lists.go | ||
| operator_test.go | ||
| rule.go | ||
| rule_test.go | ||