Home / ubuntu / Questions / 665777
Accepted
Daniyal Javani
Asked: 2015-08-26 11:35:38 +0800 CST

Why cannot allow/deny specific software in ufw Linux?

  • 772

Why cannot allow specific software (like Firefox) to use internet but deny other software (link Chrome) that are using same port in ufw? In windows there is the feature, why ufw don't have that?

networking

1 Answers

  1. Best Answer

    You can use apparmor to deny network traffic for some application. First you must install apparmor and apparmor-utils ..

    sudo apt-get install apparmor*

    After that you can generate profile to you application ...

    sudo aa-genprof /usr/bin/google-chrome

    Next step is to change Networking part in profile to:

    sudo nano /etc/apparmor.d/usr.bin.chromium-browser

audit deny network,
audit deny network inet stream,
deny network inet6 stream,
deny @{PROC}/[0-9]*/net/if_inet6 r,
deny @{PROC}/[0-9]*/net/ipv6_route r,
deny capability net_raw,

    Next, check config with apparmor_parser and reload config

    sudo apparmor_parser -r /etc/apparmor.d/usr.bin.chromium-browser

    Change mode from complain to enforce aka turn on apparmor for this app.

    sudo aa-complain /etc/apparmor.d/usr.bin.chromium-browser

    More manual you can find here and here and here

    Second solution is more simple but is not completly what you want

    Surfing on net I found trickle. Fine and light tool for control bandwidth on application

    Install them

      sudo apt-get install trickle

    Usage is very simple

      trickle -d 1 firefox

    this command will allow firefox to download at speed of 1 kb/s

    Or you can add trickle to luncher

    trinckle_luncher

    Also you can create permanent control in /etc/trickled.conf per service. Not for bandwidth then for traffic priority

    • 2