On 14/07/18 10:56 AM, Patrick Shanahan wrote:

you will/should get an error when something tries to access the disconnected network.

YES! And that is significant. Dave's message was very unspecific. This method will tell you exactly what program is trying to access the net. You can then tweak apparmor, for example, to specifically block it. Examples: https://forums.opensuse.org/showthread.php/498827-AppArmor-Profile-Deny-inte... -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

* Dave Howorth [07-14-18 11:39]:

On Sat, 14 Jul 2018 11:17:59 -0400 Anton Aylward wrote:

...

On 14/07/18 10:56 AM, Patrick Shanahan wrote:

...

you will/should get an error when something tries to access the disconnected network.

Thanks for the idea. I guess that is simple but I was hoping for something a little less drastic. I'd really like to still be able to access the internet whilst the program is running.

I've read of a program called firejail for example and I believe iptables can do it but I've no experience of either (or of AppArmor if that can do it, or the firewall) so I was hoping somebody could recommend something.

...

YES! And that is significant. Dave's message was very unspecific.

I'm not sure what else you want me to tell you?

...

This method will tell you exactly what program is trying to access the net. You can then tweak apparmor, for example, to specifically block it. Examples: https://forums.opensuse.org/showthread.php/498827-AppArmor-Profile-Deny-inte...

kiss is the BEST principle! it appears from following this thread and related that you specifically look for exotic approaches/solutions rather than simple ones. you will never achieve what you seek in a short, managable timeframe unless you try smaller steps and simpler approaches. it is very simple and easy to re-enable network access. does the checks you are trying to make take so much time that you cannot do w/o network access for a short time? -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Registered Linux User #207535 @ http://linuxcounter.net Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet freenode -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

* Carlos E. R. [07-14-18 17:55]:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Content-ID:

El 2018-07-14 a las 14:17 -0400, Patrick Shanahan escribió:

...

* Dave Howorth <> [07-14-18 11:39]:

...

On Sat, 14 Jul 2018 11:17:59 -0400 Anton Aylward wrote:

...

On 14/07/18 10:56 AM, Patrick Shanahan wrote:

...

you will/should get an error when something tries to access the disconnected network.

Thanks for the idea. I guess that is simple but I was hoping for something a little less drastic. I'd really like to still be able to access the internet whilst the program is running.

I've read of a program called firejail for example and I believe iptables can do it but I've no experience of either (or of AppArmor if that can do it, or the firewall) so I was hoping somebody could recommend something.

...

YES! And that is significant. Dave's message was very unspecific.

I'm not sure what else you want me to tell you?

...

This method will tell you exactly what program is trying to access the net. You can then tweak apparmor, for example, to specifically block it. Examples: https://forums.opensuse.org/showthread.php/498827-AppArmor-Profile-Deny-inte...

kiss is the BEST principle!

it appears from following this thread and related that you specifically look for exotic approaches/solutions rather than simple ones. you will never achieve what you seek in a short, managable timeframe unless you try smaller steps and simpler approaches. it is very simple and easy to re-enable network access. does the checks you are trying to make take so much time that you cannot do w/o network access for a short time?

Your approach blocks all programs and all users. He wants to block one.

- -- Cheers Carlos E. R.

(from openSUSE 42.3 x86_64 "Malachite" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2

iF4EAREIAAYFAltKcO0ACgkQja8UbcUWM1zcJAD+Pcx51LgxlVsnN0XBSFDMaU3h vgHJm/2YAxAjP8Rk04EBAI0ZlqisE4mkY3LBnRY0gocNIwgwXZxDkE1qbUtdPZ// =g30r -----END PGP SIGNATURE-----

yes, for testing over a short period, wtf. -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Registered Linux User #207535 @ http://linuxcounter.net Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet freenode -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Sat, 14 Jul 2018 21:29:45 +0200 Adam Mizerski wrote:

W dniu 14.07.2018 o 14:49, Dave Howorth pisze:

...

What's the best/easiest way to stop a program accessing the net?

I want to run a program (actually 'make') that may in turn run other programs and some of which might try to access the net. I'd like the access to be stopped and me given a meaningful error message (i.e. what part of what program tried to access what net resource). Ideally, I'd then have the choice of aborting or allowing it to continue.

Searching throws up various possibilities, some of which are not in the standard repositories, and I'm not sure what the best approach is.

You may try network namespaces: https://lmddgtfy.net/?q=linux%20netns

You can create a new network namespace, without attaching any interfaces to it, and run your application in it.

Example:

sudo ip netns add isolated sudo ip netns exec sudo -u my_username -i

This will start new shell session running as your user, but without any access to network.

If you want to start graphical application in it, you need to execute

export DISPLAY=unix:0

Excellent! Many thanks, that's exactly the kind of thing I was looking for. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org