block wine internet access

nutpantz · Post by **nutpantz** » Sat Nov 22, 2008 10:00 pm

everyone says that linux is mostly free from spyware
but i use wine a lot and i dont want the windows programs in wine
to have internet access.. i still want them to have local network access but not internet..

how do i do this?

can i stop access on a application by application basis?

i am using ubuntu 8.10 x64 and the latest wine

nutz

austin987 · Post by **austin987** » Sun Nov 23, 2008 3:22 am

On Sat, Nov 22, 2008 at 9:00 PM, nutpantz <[email protected]> wrote:

everyone says that linux is mostly free from spyware
but i use wine a lot and i dont want the windows programs in wine
to have internet access.. i still want them to have local network access but not internet..

how do i do this?

can i stop access on a application by application basis?

i am using ubuntu 8.10 x64 and the latest wine

nutz

Use native linux tools for this, i.e., iptables.

--
-Austin

nutpantz · Post by **nutpantz** » Sun Nov 23, 2008 11:21 am

there are no native tools for linux to block access to the Internet on a application by application basis. no firewall or any other gui way for noobs like myself that notifies the user that application it accessing the Internet. nothing that tells you that a port is in use or if information is being transmitted.

sure you can block the port that an application uses.
but there is no way to find out what application is using what port or when
unless you are logging everything and can find out after the fact.

for a noob this would allow untold amount of spyware to get out from wine.

nutz

Gert van den Berg · Post by **Gert van den Berg** » Sun Nov 23, 2008 11:58 am

On Sun, Nov 23, 2008 at 6:21 PM, nutpantz <[email protected]> wrote:

there are no native tools for linux to block access to the Internet on a application by application basis. no firewall or any other gui way for noobs like myself that notifies the user that application it accessing the Internet. nothing that tells you that a port is in use or if information is being transmitted.

sure you can block the port that an application uses.
but there is no way to find out what application is using what port or when
unless you are logging everything and can find out after the fact.

for a noob this would allow untold amount of spyware to get out from wine.

nutz

IPtables cvan match by uid... Using something such as shorewall and su
to run the Wine apps as a different user might at least give you some
level of control...

--cmd-owner might help as well...

http://linux.die.net/man/8/iptables - see owner extension....

Gert

Post by **dimesio** » Sun Nov 23, 2008 1:09 pm

nutpantz wrote:there are no native tools for linux to block access to the Internet on a application by application basis.

AppArmor
SELinux

vitamin · Post by **vitamin** » Sun Nov 23, 2008 6:24 pm

nutpantz wrote:can i stop access on a application by application basis?

No, you can't. It would be really easy to get around this if it's done by Wine itself.

Wine can't stop an application calling system functions because it's 100% user space.

James McKenzie · Post by **James McKenzie** » Tue Nov 25, 2008 10:53 pm

vitamin wrote:

nutpantz wrote:

can i stop access on a application by application basis?

No, you can't. It would be really easy to get around this if it's done by Wine itself.

Wine can't stop an application calling system functions because it's 100% user space.

No, he cannot block by application, and I don't know if this is possible
with Linux out-of-the-box. But he can use iptables and other programs
to block by uid and port. Thus, if a specific user is used to run Wine
(the su - <username> type script) and then block that user from all
Internet access excepting the local internet, which should be a
blackhole set (10.x.x.x, 172.16.x.x, 192.168.x.x) then this would be
possible.

However, why are you so concerned about spyware? I don't use Wine to
browse the web nor read mail. There are better programs than what will
run under Wine for this purpose. If you are testing spyware programs to
see if Wine will or will not run them, then you should not be connected
to ANY network, local or Internet.

James McKenzie

nutpantz · Post by **nutpantz** » Tue Dec 30, 2008 2:54 pm

im worried about games phoning home
im worried about various apps phoning home.

there are about 20 programs that i CANNOT replace with a linux app.

and many of them phone home or auto update and i dont want to deal with any of that.

nutz

austin987 · Post by **austin987** » Tue Dec 30, 2008 3:05 pm

On Tue, Dec 30, 2008 at 1:54 PM, nutpantz <[email protected]> wrote:

im worried about games phoning home
im worried about various apps phoning home.

there are about 20 programs that i CANNOT replace with a linux app.

and many of them phone home or auto update and i dont want to deal with any of that.

nutz

Do it as you would with any linux app, iptables, etc.

--
-Austin

James Mckenzie · Post by **James Mckenzie** » Tue Dec 30, 2008 4:28 pm

im worried about games phoning home
im worried about various apps phoning home.

there are about 20 programs that i CANNOT replace with a linux app.

and many of them phone home or auto update and i dont want to deal with any of that.

Some Windows programs also stop working if they cannot contact their 'home' server. You should be able, with Linux's facilities, to block communications from your programs to their 'home' server. The same can be done with the MacOSX firewall product.

James McKenzie