| |||||||||||||
Namespaces in operation, part 4: more on PID namespacesNamespaces in operation, part 4: more on PID namespacesPosted Jan 31, 2013 16:26 UTC (Thu) by alex2 (guest, #73934)Parent article: Namespaces in operation, part 4: more on PID namespaces
Can the network namespace be used to restrict a program so it can't phone home? Sometimes I'd like to test some commercial demo version but I really don't want it to report an unknown amount information back to the company.
(Log in to post comments)
Namespaces in operation, part 4: more on PID namespaces Posted Feb 5, 2013 12:50 UTC (Tue) by Lennie (subscriber, #49641) [Link]
You can setup iptables inside the network namespace, if you trust the program not to change it, you'll be fine.
This is because I'm not sure how well you can control what packets can and can not be send from the network namespace from the parent namespace.
Namespaces in operation, part 4: more on PID namespaces Posted Feb 5, 2013 16:18 UTC (Tue) by bjencks (subscriber, #80303) [Link]
A fresh network namespace only has a loopback interface. If you don't add any other interfaces, it's totally isolated network-wise.
(Note that you can still connect to filesystem-namespace unix sockets if you can access them as files -- you need to chroot or use mount namespaces if you want to hide them as well. I believe abstract namespace unix sockets are isolated per-namespace.)
|
|||||||||||||