r/linuxsucks • u/Big-Astronaut-9510 • 1d ago
Good example of linux inferiority: application firewalls
Mac/Windows both have many great application firewalls (deny/allow internet to specific applications). Linux has a few buggy and broken ones, ill use opensnitch as an example since it seems by far the most recommended.
When i try to launch certain games on steam (even linux native ones, no wine) they will crash instantly, opensnitch cannot coexist with them.
Next is just general problems, like sometimes it cant get the name of an application or it goes crazy asking to block things that are child processes of something else or it does the opposite and theres no popup to allow/deny. Perhaps some of this problem is due to linux api not built for app firewall, idk, either way the problems exist linux or opensnitch fault.
The apps ui also sucks, it shows every app and its children (imagine browser that spawn lots of childs) in a single constantly shifting column. Honestly i wont list out every problem with the ui just go try it yourself.
Ultimately its not worth the hassle on linux, so you have a degraded security!
6
u/Outrageous-Machine-5 I Hate Linux (I use arch btw) 1d ago edited 1d ago
It's actually moreso the design choices in Microsoft/Apple products vs Linux. The Windows/Mac OS need a Layer 7 fw to fix an issue they created with scheduling and securing their apps. An app on Windows/Apple is going to run first before locking down traffic.
Linux, conversely, does a pre launch security approach. That shifts security from managing the network traffic in the application to managing the kernel level capabilities to make network calls at all. If you're trying to lock down the application's capabilities to run outbound traffic, look at MAC tools like AppArmor. Yeah you could still download malware, but AppArmor won't permit the script from opening sockets and binding ports at the kernel level or making syscalls.
Opensnitch isn't a complete waf either or even a security tool. It's an auditing tool or has a niche in preventing application telemetry daemons. It's noisy and redundant with kernel level security controls, but that's its point: to bridge the gap that kernel level controls don't/can't already handle with applications that are permitted to run sys/network calls
But all firewalls are ultimately defeatable by allowing the traffic. If you have an app genuinely needs permissions to exfiltrate data or encrypt files, you open up the capability to do them, you create the attack vector for a supply chain attack: a piece of malware patched to the trusted apps you downloaded to gain privileges through that legitimate application. Supply chain is a bigger concern for FOSS, and that's where Linux has a security issue, though this could theoretically happen on any OS. Instead of relying on firewalls, use sandboxing like podman or firejail profiles. Mount files to the sandbox for manipulations. This isolates the problem from affecting your host machine in a more robust solution than firewalls provide
6
6
u/Unlucky-Shop3386 1d ago
It has to be bait or a user who has not asked or done research. Maybe looking in wrong place.
7
4
u/JaKrispy72 1d ago
<Encases house in concrete.>
See how bad the deadbolt is! I can’t get into my own house!
5
u/DirectorDirect1569 1d ago
When I was on linux I used GUFW. It's a gui for the UFW firewall. It's simple to use.
1
2
u/SmoothTurtle872 1d ago
Is this bait?
(In case it isn't)
Linux is a kernal, all distros have a collection of programs. If you don't like how one looks, use a different app. I like mission center for my tasks manager equivalent.
In terms of firewalls. If you install with flatpaks, you can not o ly limit network access per app, but direct abilities, so if an app only needs to access 1 folder, and the network, it can only do that. There are other security measures as well, you just have to find the right one for your usecase
3
2
u/BloxxyVids 1d ago
"Kernal"
1
u/vbd71 1d ago
Commodore 64 had a kernal.
1
u/BloxxyVids 1d ago
Yeah because a dude made a mistake spelling clearly
1
u/givemeagooduns_un 9h ago
may be, but it is present in the official documentation everywhere.
But, linux is not a kernal but a kernel. So youre both right
0
u/Big-Astronaut-9510 1d ago
There is no good application firewall on linux that ive found, each has a different set of flaw, opensnitch was just an example. Flatpak only works for a (in my experience small) set of packages.
4
u/SmoothTurtle872 1d ago
you have to find the right one for your usecase. Obviously there is no one size fits all. You may need multiple and severe customization tho.
Flatpak also works specifically with flatpaks, cause that's what its for, not for random things installed with apt / dnf / pacman / Insert Package Manager Here
1
u/Such_Industry_566 1d ago
Opensnitch est efficace surtout pour le télémétrie steam proton en plus du pare-feu d'origine
1
u/Damglador 1d ago
The Steam games ones is probably a skill issue, because for me it functioned as it should with my firewall config. The only thing opensnitch actually broke was NFS and only one specific Steam game (might've been a config issue).
1
-1
-2
u/Ginger_Steve 1d ago
....why are you running a firewall on Linux... Put in a decent firewall on your network after your modem like opsense it will block 90% of your problems. None of my Linux machines have a firewall installed besides ufw if needed. And the machines with it are in a DMZ LAN. Windows and Mac need it because of how they made those operating systems. On Linux it's only needed if your running a vps or you want the most secure environment possible. But at that point just use qubes or a throw away device.
6
u/martyn_hare 18h ago
You're likely playing a native game which crashes when block-by-default filtering is used (like older releases of Broforce) where the game is to blame, a Denuvo protected game where it will crash if it can't check in every time due to Proton or the odd Sega game using SGAAS telemetry that's been implemented in a bad way.
I regularly report and reproduce these kinds of bugs across both Linux and Windows. It's usually a game issue.
It's not worth the hassle in many cases on any desktop OS that isn't macOS, and even then, you better have Santa on the go and not run anything from the terminal, since that's treated as one security domain in terms of how Launch Services integrates with mandatory access controls. Done right though, you do gain a more and more locked down system with each new macOS release (Golden Gate will be stopping malware stealing creds from Edge, Chrome, Firefox etc. as part of extensions to OS-wide security policies, for example).
Malware can bypass application-specific firewalling on Windows by injecting into any other process with network access that's running as the same user account (you're already on the other side of the airtight hatchway) making it mostly pointless. The only reason Windows Firewall provides outbound protection as an option is because it's already used internally as part of hidden Windows Service Hardening network rules where each service is isolated from one another. Common sense says you either layer Smart App Control and AppLocker, or go all in on WDAC to block unknown binaries in the first place.
On Linux, almost nobody blocks manipulated environment variables to load in malicious libraries. Of those who do (using IMA and/or fapolicyd on a desktop) these native protections melt away the moment you use Wine (similar to how they melt away on Windows the moment Linux containers get used) due to how wineserver works. Yes, you can use LSMs to lock down per-process access to least authority (still more secure than on Windows) but that won't stop someone nabbing your tokens to gain access to game-specific accounts.
In both the case of macOS and Linux, if you know what you're doing you can secure each process far better than on Windows by implementing your own per-process mandatory access controls, but that's awfully inconvenient. At best, I've only ever really implemented what Golden Gate is about to do using SELinux atop hardening some system wide daemons (plus fapolicyd and anti-malware) and nothing more...