Re:EBPFSnitch: An eBPF based Linux Application Firewall
by _0ffh on Sunday March 14, 2021 @11:47AM
(#26456312)
I guess one might try to check the path through the process tree to see if a blacklisted application is the parent (or gp, ggp, etc.) of the process trying to communicate with the outside world.
[ Parent
| on HN ]
Re:EBPFSnitch: An eBPF based Linux Application Firewall
by simias on Sunday March 14, 2021 @12:23PM
(#26456549)
I considered that but IIRC browsers like firefox will accept to load an URL without creating a new child process.
For instance if I type "firefox 'http://google.com'" in my terminal my already-running firefox instance loads the URL in a new tab, so I assume that some kind of IPC is used behind the scenes to ask the main instance to load the URL. Of course that's harder to exploit nefariously than spawning wget from the same process but when there's a will there's a way...