https://github.com/msantos/nonetexec

nonetexec: prevent an exec(3)'ed command from opening new sockets
https://github.com/msantos/nonetexec

exec firewall seccomp

Last synced: about 1 month ago
JSON representation

nonetexec: prevent an exec(3)'ed command from opening new sockets

• Host: GitHub
• URL: https://github.com/msantos/nonetexec
• Owner: msantos
• License: isc
• Created: 2023-04-02T12:27:19.000Z (almost 2 years ago)
• Default Branch: main
• Last Pushed: 2024-12-07T13:38:23.000Z (about 2 months ago)
• Last Synced: 2024-12-07T14:25:55.137Z (about 2 months ago)
• Topics: exec, firewall, seccomp
• Language: C
• Size: 9.77 KB
• Stars: 0
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# SYNOPSIS

nonetexec *cmd* *...*

# DESCRIPTION

nonetexec: prevent an exec(3)'ed command from opening sockets

`nonetexec` removes the capability of an executed command to open network

sockets. The process can open filesystem objects or use sockets inherited

from the parent.

The process may still access the network by using:

* systemd socket activation

* a inetd or [UCSPI](https://jdebp.uk/FGA/UCSPI.html) service with

  standard input and output attached to a socket

* file descriptor passing over a socketpair(2) inherited from the parent

# EXAMPLES

## curl(1): process does not access network

```

$ nonetexec curl file:///etc/hosts

# The following lines are desirable for IPv6 capable hosts

::1 ip6-localhost ip6-loopback

fe00::0 ip6-localnet

ff00::0 ip6-mcastprefix

ff02::1 ip6-allnodes

ff02::2 ip6-allrouters

ff02::3 ip6-allhosts

```

## curl(1): process attempts to access network

```

$ nonetexec curl http://1.1.1.1

curl: (7) Couldn't connect to server

```

## Network socket attached to stdin/stdout

Uses [tcpexec](https://github.com/msantos/tcpexec):

```

$ tcpexec :8080 nonetexec cat

```

```

$ nc localhost 8080

test

test

```

# Build

```

make

#### static executable using musl

./musl-make

```

# OPTIONS

None