Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I try to block the user sandbox from accessing the network with this command:

$ iptables -A OUTPUT -m owner --uid-owner sandbox -j DROP

However, after that I'm still able to ping an external host:

$ sudo -u sandbox ping 206.190.36.45
PING 206.190.36.45 (206.190.36.45) 56(84) bytes of data.
64 bytes from 206.190.36.45: icmp_req=1 ttl=49 time=802 ms
64 bytes from 206.190.36.45: icmp_req=2 ttl=49 time=791 ms

What am I doing wrong?

Update

My configuration looks like this:

$ /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             owner UID match sandbox

Update

Apparently ping has setuid root set. I just had to remove it:

chmod u-s /bin/ping
share|improve this question
    
looks like it works for TCP and UDP, but ICMP gets through. –  tigran Mar 2 '13 at 20:59
    
Share your whole ruleset. Perhaps an earlier rule grants access. –  fuero Mar 2 '13 at 21:07
add comment

2 Answers

up vote 2 down vote accepted

If ping is setuid root on your system, it is root which opens the socket from which ping sends its ICMP echo requests. Thus the rule will never match.

(Note that this is true on EL6, Debian squeeze, etc. More recent distributions have removed ping's setuid bit and replaced it with a capability. In these cases, the rule might match.)

share|improve this answer
add comment

Have you made sure that you have the nessesary iptable module loaded?

Try

modprobe ipt_owner

on the console.

share|improve this answer
    
modprobe ipt_owner exits without any output –  StackedCrooked Mar 2 '13 at 23:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.