opensnitch
linux
Our great sponsors
opensnitch | linux | |
---|---|---|
213 | 222 | |
9,663 | 853 | |
- | - | |
9.1 | 10.0 | |
1 day ago | 8 days ago | |
Python | C | |
GNU General Public License v3.0 only | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
opensnitch
- Is Linux worth it for the average non-tech user?
-
Safari share menu now violates privacy
opensnitch has existed for a while now. I've never used it, so I can't comment on how well it works.
https://github.com/evilsocket/opensnitch
-
Plasmashell making network pings/sending data from boot?
If you prefer a GUI try https://github.com/evilsocket/opensnitch
- Why do devs refuse to let their games run on Linux?
-
eBPF Verification Is Untenable
The whole BPF verifier and development process is so botched, it's ridiculous. It's like maintainers decided to make this as hard as possible out of pettiness and "they have to use C APIs instead" or something.
- Loading an eBPF module without the CAP_BPF (and in some cases without the CAP_NET_ADMIN which you need for XDP) capabilities will generate a "unknown/invalid memory access" error which is super useless as an error message.
- In my personal opinion a bytecode format for both little endian (bpfel) and big endian (bpfeb) machines is kinda unnecessary. I mean, it's a virtual bytecode format for a reason, right!?
- Compiling eBPF via clang to the bpf bytecode format without debug symbols will make every following error message down the line utterly useless. Took me a while to figure out what "unknown scalar" really means. If you forget that "-g" flag you're totally fucked.
- Anything pointer related that eBPF verifier itself doesn't support will lead to "unknown scalar" errors which are actually out of bounds errors most of the time (e.g. have to use if pointer < size(packet) around it), which only happen in the verification process and can only be shown using the bpftool. If you miss them, good luck getting a better error message out of the kernel while loading the module.
- The bpftool maintainer is kind of unfriendly, he's telling you to read a book about the bytecode format if your code doesn't compile and you're asking about examples on how to use pointers inside a BPF codebase because it seems to enforce specific rules in terms of what kind of method (__always_static) are allowed to modify or allocate memory. There's a lot of limitations that are documented _nowhere_ on the internet, and seemingly all developers are supposed to know them by reading the bpftool codebase itself!? Who's the audience for using the bpftool then? Developers of the bpftool itself?
- The BCC tools (bpf compiler collection) are still using examples that can't compile on an up-to-date kernel. [1] If you don't have the old headers, you'll find a lot of issues that show you the specific git hash where the "bpf-helpers.h" file was still inside the kernel codebase.
- The libbpf repo contain also examples that won't compile. Especially the xdp related ones [2]
- There's also an ongoing migration of all projects (?) to xdp-tools, which seems to be redundant in terms of bpf related topics, but also has only a couple examples that somehow work [3]
- Literally the only userspace eBPF generation framework that worked outside a super outdated enterprise linux environment is the cilium ebpf project [4], but only because they're using the old "bpf-helpers.h" file that are meanwhile removed from the kernel itself. [5] They're also incomplete for things like the new "__u128" and "__bpf_helper_methods" syntax which are sometimes missing.
- The only working examples that can also be used for reference on "what's available" in terms of eBPF and kernel userspace APIs is a forked repo of the bootlin project [6] which literally taught me how to use eBPF in practice.
- All other (official?) examples show you how to make a bpf_printk call, but _none_ of them show you how to even interact with bpf maps (whose syntax changed like 5 times over the course of the last years, and 4 of them don't run through the verifier, obviously). They're also somewhat documented in the wiki of the libbpf project, without further explanation on why or what [7]. Without that bootlin repo I still would have no idea other than how to make a print inside a "kretprobe". Anything more advanced is totally undocumented.
- OpenSnitch even has a workflow that copies their own codebase inside the kernel codebase, just to make it compile - because all other ways are too redundant or too broken. Not kidding you. [8]
Note that none of any BPF related projects uses any kind of reliable version scheme, and none of those project uses anything "modern" like conan (or whatever) as a package manager. Because that would have been too easy to use, and too easy on documenting on what breaks when. /s
Overall I have to say, BPF was the worst development experience I ever had. Writing a kernel module is _easier_ than writing a BPF module, because then you have at least reliable tooling. In the BPF world, anything will and can break at any unpredictable moment. If you compare that to the experience of other development environments like say, JVM or even the JS world, where debuggers that interact with JIT compilers are the norm, well ... then you've successfully been transferred back to the PTSD moments of the 90s.
Honestly I don't know how people can use BPF and say "yeah this has been a great experience and I love it" and not realize how broken the tooling is on every damn level.
I totally recommend reading the book [9] and watching the YouTube videos of Liz Rice [10]. They're awesome, and they show you how to tackle some of the problems I mentioned. I think that without her work, BPF would have had zero chance of success.
What's missing in the BPF world is definitely better tooling, better error messages (e.g. "did you forget to do this?" or even "unexpected statement" would be sooooo much better than the current state), and an easier way to debug an eBPF program. Documentation on what's available and what is not is also necessary, because it's impossible to find out right now. If I am not allowed to use pointers or whatever, then say so in the beginning.
[1] https://github.com/iovisor/bcc
[2] https://github.com/libbpf/libbpf
[3] https://github.com/xdp-project/xdp-tools
[4] https://github.com/cilium/ebpf/
[5] https://github.com/cilium/ebpf/tree/master/examples/headers
[6] https://elixir.bootlin.com/linux/latest/source/tools/testing...
[7] https://github.com/libbpf/libbpf/wiki/Libbpf-1.0-migration-g...
[8] https://github.com/evilsocket/opensnitch/blob/master/ebpf_pr...
[9] https://isovalent.com/learning-ebpf/
[10] (e.g.) https://www.youtube.com/watch?v=L3_AOFSNKK8
-
I didn't realize firewalls aren't turned on by default in linux and I've had it off for months, how screwed am I?
Close to zero most probably. If you want something different, to block/monitor what applications access the internet, block ads, etc, try https://github.com/evilsocket/opensnitch
-
Installing Opensnitch on Gentoo: A classic tale of not knowing what I'm doing
The last thing I built from source was a suckless utility which was nothing but a treat to play with and hack on, so I felt confident I could manage this even though the project's wiki page on compilation warned that it might fail on distro's other then debain and ubuntu. First order of business was translating the apt-get command for the dependencies into an emerge command that would install the same packages. Once that was done, I went on to the go dependencies which all seemed to install without a hitch except for the first one which gave this "build constraints eliminates all Go files" message but didn't tell me that the installation had failed otherwise. I spent a good amount of time trying to decipher this message which eventually turned into just familiarizing myself with go since I hadn't really touched it before before deciding it was fine. Then I tried to build it. It didn't work.
- Am I doing enough?
-
PSA: New cross-platform "Fractureiser" Minecraft modpack malware being exploited in the wild
OpenSnitch is a clone of the popular 'LittleSnitch' firewall for Mac. The main feature is that it will tell you about every single connection your computer is doing. A bit annoying for the first few days, but not too bad once you've already allowed the apps you use regularly. I think this would have been the perfect tool for the job.
-
Identifying PID generating DNS requests
take a look at opensnitch or picosnitch
linux
- A Linux Optimizer Script
-
The Linux Scheduler: A Decade of Wasted Cores (2016) [pdf]
Interesting! I've used Linux Mint for the last 5+ years (and am using the Xanmod kernel, which is on 6.6), but have always been Pop OS curious. This increases my curiosity, I may have to give it a go on my laptop.
https://xanmod.org/
-
Is Linux Mint good for gaming?
For those on Linux mint you can install the xanmod kernel for improved performance, specifically tailored for gaming on Debian based distros.
-
Been thinking of switching to linux but I am a noob
Generally, Arch is the better platform for getting various kernel versions, but there's always stuff like Xanmod which is easy to do in any distro. Worst case, could always use linux-tkg script to build your own kernel - with that kind of hardware it shouldn't take long for the kernel to be built.
-
Have any Linux users trialed other distros or do you only stick to Fedora/Arch?
Still a bit of a noob. I haven't heard of that one. Do you mean this: https://xanmod.org/? Is there any stability or compatibility issues that come with it?
-
Bottles – Easily run Windows software on Linux
The ArchWiki has some tips that can help tuning your system to squeeze more performance: https://wiki.archlinux.org/title/gaming
This launcher does help too: https://github.com/FeralInteractive/gamemode
On top of that, you can use a patched kernel like: https://xanmod.org/
You can check support status for games here: https://www.protondb.com/
If you run games via Proton with DXVK, you can use the environment variable DXVK_HUD=1 to show a HUD with an FPS meter. Some others prefer mangohud.
Setting your CPU frequency scaling governor and GPU to performance mode also helps.
-
535.54 driver breaks kernel
Xanmod Kernel
-
Help installing driver of RTL8188GU USB wifi adapter
There are different drivers available but the best way is to install linux kernel 6.3 which has built in support for rtl wifi. I also have similar adapter and had the problem. I recommend xanmod kernel because it is newer and has the needed driver and it is focussed on desktop performance.
-
Debian 12 on 13th gen intel laptop?
For Debian : https://xanmod.org
-
Downloading AMD driver problem
Alternatively, try the xanmod kernel https://xanmod.org/
What are some alternatives?
portmaster - 🏔 Love Freedom - ❌ Block Mass Surveillance
zen-kernel - Zen Patched Kernel Sources
ufw-stats - ufw-stats: Show ufw actions since boot, with ip address information from RIPE database.
linux-tkg - linux-tkg custom kernels
flathub - Pull requests for new applications to be added
cacule-cpu-scheduler - The CacULE CPU scheduler is based on interactivity score mechanism. The interactivity score is inspired by the ULE scheduler (FreeBSD scheduler).
rustsec - RustSec API & Tooling
easyeffects - Limiter, compressor, convolver, equalizer and auto volume and many other plugins for PipeWire applications
firejail - Linux namespaces and seccomp-bpf sandbox
AutoEq - Automatic headphone equalization from frequency responses
picosnitch - Monitor Network Traffic Per Executable, Beautifully Visualized
Ananicy - Ananicy - is Another auto nice daemon, with community rules support (Use pull request please)