I try to block the user sandbox
from accessing the network with this command:
$ iptables -A OUTPUT -m owner --uid-owner sandbox -j DROP
However, after that I'm still able to ping an external host:
$ sudo -u sandbox ping 206.190.36.45
PING 206.190.36.45 (206.190.36.45) 56(84) bytes of data.
64 bytes from 206.190.36.45: icmp_req=1 ttl=49 time=802 ms
64 bytes from 206.190.36.45: icmp_req=2 ttl=49 time=791 ms
What am I doing wrong?
Update
My configuration looks like this:
$ /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere owner UID match sandbox
Update
Apparently ping
has setuid root
set. I just had to remove it:
chmod u-s /bin/ping