evilsocket / evilsocket/opensnitch

[Feature Request] Support matching by user name (not just user ID) and/or cgroup name

Open
#1,116 11 comments 2 reactions 0 assignees View on GitHub
feature
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

### Summary:
`systemd` often uses dynamically-chosen UIDs for services ([`DynamicUser=yes`](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#User/Group%20Identity)). This means that rules matching with the `uid` operand will no longer match when a service/the system is next restarted and the process gets a newly-assigned uid. As a consequence, I have to allow a binary for all users on the system, instead of just allowing a daemon user to make connections with a binary.

At process discovery, OpenSnitch should use `user.LookupId(uid)` to look up the name currently assigned to a uid, and allow the result to be matched with an operand.

In addition, or perhaps in lieu, it would be helpful to match by a process's cgroup name. systemd will assign a unique cgroup to each service, so this would ensure that even if a process happens to somehow be launched as the correct user, it will still not be able to evade rules. This information is available in `/proc/$pid/cgroup`. For example:

```
$ cat /proc/$(systemctl show -P ExecMainPID sshd)/cgroup
0::/system.slice/sshd.service
$ cat /proc/self/cgroup
0::/user.slice/user-1000.slice/user@1000.service/app.slice/app-konsole-3d42e27e456a4ce9a1ad5982ed8f6a33.scope
```

This could be especially useful for desktop apps, because you could allow `wget` to be used from Konsole without also allowing it to be used by Spotify.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.