iptables - Opening a port for a certain application only

[xadian]

Hi

iptables-problem:
How can I open a certain port (say 80) for a certain program only (say Mozilla Firefox)? So that other programs (e.g. Konqueror) are not able to use this port.

sth like:
iptables -A OUTPUT -program ! "Mozilla Firefox" --sport 80 -j DROP

thx xadian

[borromini]

I don't think that is possible...

[GOLDEN_key]

You have to add to OUTPUT

-m owner --cmd-owner "/path/to/application"


man iptables

owner
This module attempts to match various characteristics of the packet
creator, for locally-generated packets. It is only valid in the OUTPUT
chain, and even this some packets (such as ICMP ping responses) may
have no owner, and hence never match.

--uid-owner userid
Matches if the packet was created by a process with the given
effective user id.

--gid-owner groupid
Matches if the packet was created by a process with the given
effective group id.

--pid-owner processid
Matches if the packet was created by a process with the given
process id.

--sid-owner sessionid
Matches if the packet was created by a process in the given ses-
sion group.

--cmd-owner name
Matches if the packet was created by a process with the given
command name. (this option is present only if iptables was com-
piled under a kernel supporting this feature)

[anomie]

This is missing an important point. The outgoing web browser (i.e. client which attaches to web servers all over the world) does not even use port 80. It uses high-numbered ports. Many web servers use port 80, not clients.

Blocking outgoing port 80 does you no good.

[GOLDEN_key]

This is missing an important point. The outgoing web browser (i.e. client which attaches to web servers all over the world) does not even use port 80. It uses high-numbered ports. Many web servers use port 80, not clients.

Blocking outgoing port 80 does you no good.

Yes, shure. Only

-m owner --cmd-owner "appname"

flags useful in this case.

[anomie]

(I wasn't making the point to you.)

[Roxoff]

Wouldn't it be easier to just uninstall the applications you dont want people to use?