launches and assigns programs to cgroup-specific iptables-rules
25'ten fazla konu seçemezsiniz Konular bir harf veya rakamla başlamalı, kısa çizgiler ('-') içerebilir ve en fazla 35 karakter uzunluğunda olabilir.
Albert S. 7cd1fcfb76 update README 4 yıl önce
profiles first commit 5 yıl önce
src remove warnings about unused imports/variables 4 yıl önce
Cargo.lock retire C version 4 yıl önce
Cargo.toml retire C version 4 yıl önce update README 4 yıl önce


qsni (quite simple network isolation) allows for simple assignment of per cgroup iptables rules to programs.

While you can also achieve this (and more) using network namespaces, the setup is not as simple/easy.


You need an iptables version that supports cgroup matching (e. g. version >= 1.6) and rust/cargo to build the binary

The following kernel config parameters must be set:



$ qsni blocked ping
ping: unknown host
$ qsni lan bash
$ ping
PING ( 56(84) bytes of data.
ping: sendmsg: Operation not permitted
$ ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.127 ms
$ qsni someprofile bash
already assigned to a net class, thus you can't use this binary to change that


If cgroup_root isn't mounted to /sys/fs/cgroup, do it or change the constant in the source to the correct path.

cargo build --release 
cp target/release/qsni /usr/bin/
chmod o=rx /usr/bin/qsni
chown root:root /usr/bin/qsni
setcap 'cap_setuid=ep cap_setgid=ep' /usr/bin/qsni

mkdir /etc/qsni.d
chmod o=rx /etc/qsni.d
cp profiles/blocked /etc/qsni.d/blocked
chmod o=r /etc/qsni.d/blocked

Every profile must have its own unique CGROUP_ID value in the profile file.

Security discussion

This alone is not a satisfactory way to prevent misbehaving programs to contact destinations you don't want them to. While the restrictions also apply to the children of the launched programs, at a minimum, file system isolation is also necessary and perhaps IPC etc.

qsni however does not aim to be a complete "jailing/isolation" solution. Nevertheless, I have use cases for it, hence its existence.

¹ name is preliminary