I have to harden a Linux desktop as an assignment in my college. But I got stuck at a specific problem: I have to control the outgoing traffic with iptables.It should be possible to prevent a specific application (like LibreOffice) to access the internet. My professor said look for the 'match' option. But I can't figure out how to do it. I thought of setting a rule which drops all packets of a specific group id with the -m owner --owner-gid option. But how can I configure my applications to run under this particular group? Or is this just the wrong way to do it?The OS is Debian 7.
Block specific application with iptables
iptables
owner moduleTake a look at this URL titled: Iptables Tutorial 1.2.2. This page lists several of the matching techniques one can do using owner information about a process.The owner match extension is used to match packets based on the identity of the process that created them. The owner can be specified as the process ID either of the user who issued the command in question, that of the group, the process, the session, or that of the command itself. This extension was originally written as an example of what iptables could be used for. The owner match only works within the OUTPUT chain, for obvious reasons: It is pretty much impossible to find out any information about the identity of the instance that sent a packet from the other end, or where there is an intermediate hop to the real destination. Even within the OUTPUT chain it is not very reliable, since certain packets may not have an owner. Notorious packets of that sort are (among other things) the different ICMP responses. ICMP responses will never match.Match    --uid-owner$ iptables -A OUTPUT -m owner --uid-owner 500Match    --gid-owner$ iptables -A OUTPUT -m owner --gid-owner 0CaveatThe documentation I reference is severely out dated, but is in fact still referred to on the official netfilter.org website: http://www.netfilter.org/documentation/.Consulting the built-in docsSo I would take this opportunity to teach you another skill that will carry you far and wide as you continue to use Linux/Unix and opensource software for that matter. Consult the usage and/or man pages, since they're likely the most up to date information you'll find when dealing with various tools.ExampleThe module we're dealing with within iptables is called owner. So we can query a extensive usage guide on it like so:$ iptables -m owner --helpDoing so will reveal that these are the supported owner match options:owner match options:[!] --uid-owner userid[-userid]      Match local UID[!] --gid-owner groupid[-groupid]    Match local GID[!] --socket-exists                  Match if socket existsNOTE: You can check what version you have like so:$ iptables --versioniptables v1.4.18I encourage you to read through this usage guide to gain further insights into how to use the tool and also to understand how to use the tool.