Re: iptables & programs

[Andrew Cady <d@jerkface.net>]

On Tue, Mar 14, 2006 at 03:13:41PM +0100, Dennis Stosberg wrote:
> Pol Hallen wrote:
> 
> > i'd like block the internet connection on these programs ;-)
> >
> > which better solution of this problem?
>
> Create an additional user account and run those programs with that
> user's rights only.  Then use the iptables "owner" module to restrict
> outgoing connections made by that user.
>
> See "-m owner" and "--uid-owner" in the iptables manual page for
> details.

This works fine, but if you want your wine apps to run with your user's
rights, or you want wine to be used by multiple users, another solution
is to add a group called, say, 'nonet', and use dpkg-statoverride to set
wine to group nonet and mode setgid.