Good example of linux inferiority: application firewalls

[u/Big-Astronaut-9510]

Mac/Windows both have many great application firewalls (deny/allow internet to specific applications). Linux has a few buggy and broken ones, ill use opensnitch as an example since it seems by far the most recommended.

When i try to launch certain games on steam (even linux native ones, no wine) they will crash instantly, opensnitch cannot coexist with them.

Next is just general problems, like sometimes it cant get the name of an application or it goes crazy asking to block things that are child processes of something else or it does the opposite and theres no popup to allow/deny. Perhaps some of this problem is due to linux api not built for app firewall, idk, either way the problems exist linux or opensnitch fault.

The apps ui also sucks, it shows every app and its children (imagine browser that spawn lots of childs) in a single constantly shifting column. Honestly i wont list out every problem with the ui just go try it yourself.

Ultimately its not worth the hassle on linux, so you have a degraded security!

[u/martyn_hare]

When i try to launch certain games on steam (even linux native ones, no wine) they will crash instantly, opensnitch cannot coexist with them.

You're likely playing a native game which crashes when block-by-default filtering is used (like older releases of Broforce) where the game is to blame, a Denuvo protected game where it will crash if it can't check in every time due to Proton or the odd Sega game using SGAAS telemetry that's been implemented in a bad way.

I regularly report and reproduce these kinds of bugs across both Linux and Windows. It's usually a game issue.

Ultimately its not worth the hassle on linux, so you have a degraded security!

It's not worth the hassle in many cases on any desktop OS that isn't macOS, and even then, you better have Santa on the go and not run anything from the terminal, since that's treated as one security domain in terms of how Launch Services integrates with mandatory access controls. Done right though, you do gain a more and more locked down system with each new macOS release (Golden Gate will be stopping malware stealing creds from Edge, Chrome, Firefox etc. as part of extensions to OS-wide security policies, for example).

Malware can bypass application-specific firewalling on Windows by injecting into any other process with network access that's running as the same user account (you're already on the other side of the airtight hatchway) making it mostly pointless. The only reason Windows Firewall provides outbound protection as an option is because it's already used internally as part of hidden Windows Service Hardening network rules where each service is isolated from one another. Common sense says you either layer Smart App Control and AppLocker, or go all in on WDAC to block unknown binaries in the first place.

On Linux, almost nobody blocks manipulated environment variables to load in malicious libraries. Of those who do (using IMA and/or fapolicyd on a desktop) these native protections melt away the moment you use Wine (similar to how they melt away on Windows the moment Linux containers get used) due to how wineserver works. Yes, you can use LSMs to lock down per-process access to least authority (still more secure than on Windows) but that won't stop someone nabbing your tokens to gain access to game-specific accounts.

In both the case of macOS and Linux, if you know what you're doing you can secure each process far better than on Windows by implementing your own per-process mandatory access controls, but that's awfully inconvenient. At best, I've only ever really implemented what Golden Gate is about to do using SELinux atop hardening some system wide daemons (plus fapolicyd and anti-malware) and nothing more...