C[omp]ute

From: andrew cooke <andrew@...>

Date: Sat, 11 Jun 2011 19:46:58 -0400

I am running some untrusted code and so wanted a quick + dirty sandbox.  All I
am really concerned with is network access, so I decided to use iptables (via
OpenSuse's firewall) to block access.

It's quite easy:

1 - Edit /etc/sysconfig/SuSEfirewall2 to allow for custom rules (search for
    "custom" in that file and enable the suggested alternative)

2 - Edit /etc/sysconfig/scripts/SuSEfirewall2-custom so that the final
    function fw_custom_before_denyall() contains

      iptables -t raw -I OUTPUT -m owner --uid-owner dumb -j DROP

That's assuming that you've created a user called "dumb", of course.

If you're doing this on a headless machine over ssh then be careful that you
don't change to that user.  One way to test is to do:

  sudo -u dumb telnet www.google.com 80

which should fail to get anywhere.

Andrew