Hacker News Reader

Comment by vagab0nd | Hacker News Reader

> You could completely trust this app if you could ban it from accessing the internet.

Yes. I have a "no-internet" user group on my linux system. Whenever I want to run an untrusted app I run it under that group.

That's interesting, care to share some details?

Basically create a group and add an iptables rule to it. Something like:

  iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP

And then when you launch the program:

  sg no-internet ./something_fishy

Is there anyway this can be done automatically with apparmor or something similar?