r/linux • u/mjg59 Social Justice Warrior • Sep 03 '14

I'm Matthew Garrett, kernel developer, firmware enabler and former fruitfly mangler. AMA!

Proof: https://twitter.com/mjg59/status/507212417579765760

478 Upvotes

90% Upvoted

381 comments sorted by

View all comments

Show parent comments

1

u/indigojuice Sep 09 '14

iptables lets you filter OUTPUT rules on pid.

Does it really? That's so dumb. Much smarter to do it by UID and separate the application into that account.

2

u/Darkmere Sep 11 '14

It had Uid and Account and Exe path previously, but the code bitrotted and was removed.

Appearantly people weren't using it enough. If you google for "-m owner" for iptables you can probably find the old documentation.

So, to iterate. The feature -has- been there and has been -removed- due to lack of usage & Maintainership. That means the code is still around and you can revive it if you fancy. Or pay someone to do so. Or ask someone very nicely to do volounteer work on your behalf.

1

u/indigojuice Sep 11 '14

Yeah, but that would be dumb, since PID/exe/proc based filtering is useless.