Hacker News Reader

Comment by egberts | Hacker News Reader

only problem is that you can’t get the process ID for inbound packets like FreeBSD can, for that still remains Linux’s weakest feature.

— The said feature is critical to proper DEFAULT-DENY firewall configuration/modeling.

View on HN

I have not attempted it but I believe this can be accomplished with eBPF https://elixir.bootlin.com/linux/v4.0/source/include/linux/s...

I don’t see a single parameter of the process ID.

Well yes you don't get it with a parameter you get it with this helper function while in those contexts `bpf_get_current_pid_tgid`.

Edit to provide link: https://elixir.bootlin.com/linux/v4.6/source/samples/bpf/bpf...

Using same bootlin search engine using your link, function nor variable not found.

Furthermore, the process ID is not yet identified at early inbound stage of EBPD. We would be talking about being past the pre-inbound stage, post-table-lookup stage, and specifically just during the input-to-user land stage.

Could you elaborate why that's critical to have?

IRL, we are unable to force systemd NOT to use any network ports for security reason due to absence of Linux firewall ability to deal with this process ID on inbound packets.

Hence, OpenRC enters the picture instead just to ensure that network port is not being used.

Also, premise of the DEFAULT-DENY firewall modeling is to pinhole open the port(s) on a per-process (or per-parent-process group) basis.

Reply on news.ycombinator.com