> For us mortals, SELinux is a synonym for "complicated, scary thing that I don't know how to use properly".
This is true, but I was referring more to the underlying architecture of Douane: kernel module + daemon + dialog UI + configurator app. Is a kernel module less scary for mere mortals? Because the downsides of that path are stated in the banner on the main page which says about kernel panic.
> Can you link to something with minimal working "mark and block" examples?
I'm not aware of any myself, but like I said, I was mostly referring to implementation. I also don't quite get the threat/defense model here. It looks like the idea is to replicate something similar to iOS/Androind permissions ("do you allow this app to access the camera?") but for network this seems to be a bit weird. Making such decision for each application would be quite annoying, so you'd like like to have some defaults in this regard, which again is easier solved by two predefined selinux contexts (with/without networking) and some UI for the user to move apps between them.
But then again, if we decide not to ask for confirmation for each app at exactly the first moment it tries to access the network, we have access to a variety of tools to provide access control to the network. For example, we could use separate network namespaces for different processes, some of which wouldn't have access to networking. This has additional benefit of fine-grained control: "allow chrome to only access my.secure.server.com on port 433".
In fact, it goes beyond that: we can have different routing tables per app, we can setup traffic shaping between the apps ("put traffic from qBittorrent into low-priority queue"), we can bridge and mirror the traffic from an app, etc. This is for example what firejail does [1] and it has a UI as well [2]. This doesn't require any kernel modules or even selinux policies and doesn't bug the user 10 times a day.
Yeah, network namespaces are I think the best way to go. You can do so, so many things with netns, the abstraction is quite nice. BTW I think setns works on /threads/ if you wish. Not as secure but allows some interesting things.
And if you need to do real-time, specific packet validation, interface state, route change, just go full netlink. Not sure why more in-kernel code might help. There's already so much stuff available. Not often well documented but so much powerful stuff!
Recently I wanted better control over bonds, and I discovered teams. How the hell did I not find them when I was looking for ways to control bonds from userland. And when I wanted bonds in network namespaces...
Here's a short article on it by Dan "Mr. SELinux" Walsh himself [1].
To understand it, though, you need to understand at least a little bit about type enforcement, which is a somewhat steep learning curve to get over.
If you have nftables (replaces iptables, default back-end to firewalld in RHEL 8), you might consult /usr/share/doc/nftables/examples/secmark.nft but again, this requires some background on nftables (or iptables—they're both just front-ends to the kernel netfilter module) and are pretty similar.
However it's also worth noting that most one could also stand to learn a thing or two about netfilter if this is a topic they're interested in. For example, netfilter allows you to filter packets based on the user, group, or pid of the process.
I found this page [2] quite helpful, and especially the packet flow diagram contained within it.
User, group and pid of the process are available through iptables. Really a great, simple way (in addition to other stuff) to compartmentalize complex applications. Shame it doesn't cross machine boundaries :-) (I know it's stupid but I like the simple user+group abstraction.
Yeah, I'm not sure if it's clear but the iptables family and its replacement, nftables, are what I'm referring to when I say netfilter. iptables/nftables are userspace applications and netfilter is the underlying kernel module.
Sorry, of course. I meant the 'iptables' interface to netfilter can be enough for mere mortals that only use them once a year, and can filter on uid/gid/pid.
I'd like to find a real-world project to play with netfilter directly. Maybe when transitioning to 200GbE... Is it just for 'complex and numerous filtering rules' or are there other 'killer use cases' for using nftables directly?
My understanding is that nftables and iptables+ip6tables+arptables+ebtables are for exactly the same set of use cases, with the latter being deprecated in favor of the former as the new replacement.
RHEL 8 uses the nftables back end for firewalld by default.
The main difference that I have noticed is that writing configuration files for nftables is considerably more ergonomic than the iptables files which are essentially just unstructured lists of iptables commands.
Generally things like UFW or firewalld are sufficient for host firewalls, but they fall short for routing applications where it is more appropriate to use nftables (or historically, iptables) directly.
Kubernetes and docker both currently use iptables for their routing and will likely migrate to nftables. If/then those projects migrate to nftables I suspect it would also solve the issue where docker port mappings have the ability to unilaterally punch holes in host firewalls, e.g., UFW, because under nftables, tables are just namespaces for chains (with configurable priority) while on iptables the different tables meant specific things and docker made decisions in a branch off of the PREROUTING chain in the nat table, which was encountered before the FORWARD or INPUT chains on the filter table. In this way nftables makes certain expressions more ergonomic than iptables.
The underlying netfilter has not been deprecated; the userspace application for managing it is just changing from the iptables (and ip6tables, ebtables, arptables, etc.) to nftables.
This is true, but I was referring more to the underlying architecture of Douane: kernel module + daemon + dialog UI + configurator app. Is a kernel module less scary for mere mortals? Because the downsides of that path are stated in the banner on the main page which says about kernel panic.
> Can you link to something with minimal working "mark and block" examples?
I'm not aware of any myself, but like I said, I was mostly referring to implementation. I also don't quite get the threat/defense model here. It looks like the idea is to replicate something similar to iOS/Androind permissions ("do you allow this app to access the camera?") but for network this seems to be a bit weird. Making such decision for each application would be quite annoying, so you'd like like to have some defaults in this regard, which again is easier solved by two predefined selinux contexts (with/without networking) and some UI for the user to move apps between them.
But then again, if we decide not to ask for confirmation for each app at exactly the first moment it tries to access the network, we have access to a variety of tools to provide access control to the network. For example, we could use separate network namespaces for different processes, some of which wouldn't have access to networking. This has additional benefit of fine-grained control: "allow chrome to only access my.secure.server.com on port 433".
In fact, it goes beyond that: we can have different routing tables per app, we can setup traffic shaping between the apps ("put traffic from qBittorrent into low-priority queue"), we can bridge and mirror the traffic from an app, etc. This is for example what firejail does [1] and it has a UI as well [2]. This doesn't require any kernel modules or even selinux policies and doesn't bug the user 10 times a day.
[1] https://firejail.wordpress.com/documentation-2/basic-usage/#... [2] https://github.com/netblue30/firetools