Re:How to steal a developer's local database
by bahjoite on Friday September 02, 2016 @07:08PM
(#12416882)
> limit what ports a browser can access
After briefly looking into this:-
- there doesn't seem to be a way to configure firefox with a whitelist of ports it may connect to
- AppArmor doesn't appear to yet be capable of constraining network access at the level of IP address or port number
- The good news is that it should be possible to use linux network namespaces along with iptables - I've not attempted it
That is of course correct. I should have worded it a bit more technical, I guess :-)
Support of unix domain sockets depends on the program, so not all support that, but Redis and memcache do. At least for those you can prevent the browser from connecting to them using TCP.
I guess another option would be to just limit what ports a browser can access. Some ports a blocked by default, but I feel like a whitelist instead of a blacklist makes more sense and I'm fairly certain that most of my daily browser usage would still work if only 80, 443 and maybe 8080 would be whitelisted. Is there a way to archive this (in chrome/Firefox) without reverting to some outside sandbox?