termjail

This script is for my own device(Arch Linux) to implement an environment that drop any packets before tcpdump can catch them except those from the current shell. This requirement appeared when I was testing the behavior of STUN.

This script will write the cgroup and nftables and it has NOT been tested on most other devices. If you are interested in this kind of implementation, issues are welcome.

Principle

1. Create a dedicated cgroup v2
2. nftables matches socket cgroupv2 level N path -> ACCEPT, all other traffic -> DROP
3. Put the interactive shell into this cgroup, child processes inherit automatically
4. After exit, nftables rules are fully restored, cgroup is deleted

Requirements: root, nftables (default on Arch), cgroup v2 (default mounted by systemd)

Usage

Run termjail.sh in sudo mode. If it is successful, you will enter a shell in a special environment that allows network traffic, while jailing all other traffic that is not from this shell. After that you can execute any command you want just like a normal shell.

License

This project is licensed under the GPL-3.0.

For more info, please check out this repo.