mirror of
https://github.com/evilsocket/opensnitch.git
synced 2025-03-04 00:24:40 +01:00
2509d21e30
Some use cases:
- Reject connections initiated by certain paths:
Deny all connections initiated by cron*:
/usr/sbin/cron
/usr/bin/curl
"action": "reject",
"operator: {
"type": "list",
"operand": "list",
"data": "",
"list": [
{
"type": "regexp",
"operand": "process.parent.path",
// /usr/bin/crond , /usr/bin/crontab, ...
"data": "^/usr/(s|)bin/cron"
}
]
}
- Reject or Allow connections of binaries launched by another app:
"action": "allow",
"operator": {
"type": "list",
"operand": "list",
"data": "",
"list": [
{
"type": "simple",
"operand": "process.parent.path",
"data": "/opt/spotify/bin/spotify"
},
{
"type": "simple",
"operand": "process.path",
"data": "/usr/bin/wget"
}
]
}
You can also combine multiple parent paths, to allow a command launched
from a specific chain of processes:
/usr/lib/systemd/systemd
/usr/sbin/cron
/bin/sh
/usr/bin/curl
The order is checked from the newest process to the oldest (curl -> sh
-> cron -> systemd)
The operand can be used with any of the existing types (simple, regexp,
etc).
Related: #406
|
||
|---|---|---|
| .. | ||
| conman | ||
| core | ||
| data/rules | ||
| dns | ||
| firewall | ||
| log | ||
| netfilter | ||
| netlink | ||
| netstat | ||
| procmon | ||
| rule | ||
| statistics | ||
| tasks | ||
| ui | ||
| .gitignore | ||
| default-config.json | ||
| go.mod | ||
| go.sum | ||
| Gopkg.toml | ||
| main.go | ||
| Makefile | ||
| network_aliases.json | ||
| opensnitchd-dinit | ||
| opensnitchd-openrc | ||
| opensnitchd.service | ||
| system-fw.json | ||