[1.6.0-1 manjaro] Allows traffic while Notification is showing

[gq2r]

Allows traffic while a notification is showing. default action is deny for everything

System:

• Kernel: 6.1.38-1-MANJARO
• KDE PLASMA Version: 5.27.6
• X11
• OpenSnitch 1.6.0-1
• Everything on latest versions via pamac-manager

Additional info:
Reports UI is not running or busy in logs during a notification
All processes waiting for notification, their traffic will be allowed
All rules work after notification has reached timeout or clicked deny/reject
All other pre-configured rules work during notification

Started after updating system with pamac:
[ALPM] upgraded opensnitch (1.5.8-2 -> 1.6.0-1)
[ALPM] warning: /etc/opensnitchd/default-config.json installed as /etc/opensnitchd/default-config.json.pacnew

ebpf is not supported by kernel after upgrade, so I'm forced to use proc

Logs & config:

�[2m[2023-07-10 23:38:00]�[0m �[97m�[41m ERR �[0m 
unable to load eBPF module (opensnitch.o). Your kernel version (6.1.38-1-MANJARO) might not be compatible.
If this error persists, change process monitor method to 'proc'
�[2m[2023-07-10 23:38:00]�[0m �[97m�[41m ERR �[0m [eBPF]: 
unable to load eBPF module (opensnitch.o). Your kernel version (6.1.38-1-MANJARO) might not be compatible.
If this error persists, change process monitor method to 'proc'
�[2m[2023-07-10 23:38:00]�[0m �[97m�[42m INF �[0m Process monitor method /proc

----
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m new connection udp => 58666:192.168.1.21 -> 9.9.9.9 ():8443 uid: 62582, mark: 0
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m [0/1] outgoing connection uid: 62582, 58666:192.168.1.21 -> 9.9.9.9:8443 || netlink response: 58666:192.168.1.21 -> 9.9.9.9:8443 inode: 48370 - loopback: false multicast: false unspecified: false linklocalunicast: false ifaceLocalMulticast: false GlobalUni: true 
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m new pid lookup took (3109): 3.53998ms
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m [0] PID found 3109 [48370]
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m new connection udp => 35058:192.168.1.21 -> 9.9.9.9 ():8443 uid: 62582, mark: 0
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m [0/1] outgoing connection uid: 62582, 35058:192.168.1.21 -> 9.9.9.9:8443 || netlink response: 35058:192.168.1.21 -> 9.9.9.9:8443 inode: 46292 - loopback: false multicast: false unspecified: false linklocalunicast: false ifaceLocalMulticast: false GlobalUni: true 
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m Socket found in known pids 116.015µs, pid: 3109, inode: 46292, pos: 0, pids in cache: 1
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m [0] PID found 3109 [46292]
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m UI is not running or busy, connected: true, running: true
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m new connection udp => 57469:192.168.1.21 -> 9.9.9.9 ():8443 uid: 62582, mark: 0
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m [0/1] outgoing connection uid: 62582, 57469:192.168.1.21 -> 9.9.9.9:8443 || netlink response: 57469:192.168.1.21 -> 9.9.9.9:8443 inode: 48372 - loopback: false multicast: false unspecified: false linklocalunicast: false ifaceLocalMulticast: false GlobalUni: true 
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m Socket found in known pids 20.9µs, pid: 3109, inode: 48372, pos: 0, pids in cache: 1
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m [0] PID found 3109 [48372]
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m UI is not running or busy, connected: true, running: true
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m new connection udp => 45180:192.168.1.21 -> 9.9.9.9 ():8443 uid: 62582, mark: 0
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m [0/1] outgoing connection uid: 62582, 45180:192.168.1.21 -> 9.9.9.9:8443 || netlink response: 45180:192.168.1.21 -> 9.9.9.9:8443 inode: 46294 - loopback: false multicast: false unspecified: false linklocalunicast: false ifaceLocalMulticast: false GlobalUni: true 
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m Socket found in known pids 158.698µs, pid: 3109, inode: 46294, pos: 0, pids in cache: 1
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m [0] PID found 3109 [46294]
�[2m[2023-07-10 23:22:55]�[0m �[2m�[30m�[100m DBG �[0m UI is not running or busy, connected: true, running: true

-------------------------------------
sudo cat /etc/opensnitchd/default-config.json
{
    "Server": {
        "Address": "unix:///tmp/osui.sock",
        "LogFile": "/var/log/opensnitchd.log"
    },
    "DefaultAction": "deny",
    "DefaultDuration": "once",
    "InterceptUnknown": true,
    "ProcMonitorMethod": "proc",
    "LogLevel": 0,
    "Firewall": "nftables",
    "Stats": {
        "MaxEvents": 150,
        "MaxStats": 25
    },
    "LogUTC": true,
    "LogMicro": false
}%  
------------------------------------
sudo cat /etc/opensnitchd/default-config.json.pacnew
{
    "Server":
    {
        "Address":"unix:///tmp/osui.sock",
        "LogFile":"/var/log/opensnitchd.log"
    },
    "DefaultAction": "allow",
    "DefaultDuration": "once",
    "InterceptUnknown": false,
    "ProcMonitorMethod": "ebpf",
    "LogLevel": 2,
    "LogUTC": true,
    "LogMicro": false,
    "Firewall": "nftables",
    "Stats": {
        "MaxEvents": 150,
        "MaxStats": 25,
        "Workers": 6
    }
}
-----------------------------------
sudo cat /etc/opensnitchd/system-fw.json
{
  "Enabled": true,
  "Version": 1,
  "SystemRules": [
    {
      "Rule": {
        "Table": "mangle",
        "Chain": "OUTPUT",
        "UUID": "",
        "Enabled": false,
        "Position": "0",
        "Description": "Allow icmp",
        "Parameters": "-p icmp",
        "Expressions": [
        ],
        "Target": "ACCEPT",
        "TargetParameters": ""
      },
      "Chains": [
      ]
    },
    {
      "Rule": null,
      "Chains": [
        {
          "Name": "forward",
          "Table": "filter",
          "Family": "inet",
          "Priority": "",
          "Type": "filter",
          "Hook": "forward",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "output",
          "Table": "filter",
          "Family": "inet",
          "Priority": "",
          "Type": "filter",
          "Hook": "output",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "input",
          "Table": "filter",
          "Family": "inet",
          "Priority": "",
          "Type": "filter",
          "Hook": "input",
          "Policy": "drop",
          "Rules": [
            {
              "Table": "",
              "Chain": "",
              "UUID": "<removed for privacy>",
              "Enabled": false,
              "Position": "0",
              "Description": "Allow SSH server connections when input policy is DROP",
              "Parameters": "",
              "Expressions": [
                {
                  "Statement": {
                    "Op": "",
                    "Name": "tcp",
                    "Values": [
                      {
                        "Key": "dport",
                        "Value": "22"
                      }
                    ]
                  }
                }
              ],
              "Target": "accept",
              "TargetParameters": ""
            },
            {
              "Table": "",
              "Chain": "",
              "UUID": "profile-drop-inbound-<removed for privacy>",
              "Enabled": true,
              "Position": "0",
              "Description": "[profile-drop-inbound] allow localhost connections",
              "Parameters": "",
              "Expressions": [
                {
                  "Statement": {
                    "Op": "",
                    "Name": "iifname",
                    "Values": [
                      {
                        "Key": "lo",
                        "Value": ""
                      }
                    ]
                  }
                }
              ],
              "Target": "accept",
              "TargetParameters": ""
            },
            {
              "Table": "",
              "Chain": "",
              "UUID": "profile-drop-inbound-<removed for privacy>",
              "Enabled": true,
              "Position": "0",
              "Description": "[profile-drop-inbound] allow established,related connections",
              "Parameters": "",
              "Expressions": [
                {
                  "Statement": {
                    "Op": "",
                    "Name": "ct",
                    "Values": [
                      {
                        "Key": "state",
                        "Value": "related"
                      },
                      {
                        "Key": "state",
                        "Value": "established"
                      }
                    ]
                  }
                }
              ],
              "Target": "accept",
              "TargetParameters": ""
            }
          ]
        },
        {
          "Name": "filter-prerouting",
          "Table": "nat",
          "Family": "inet",
          "Priority": "",
          "Type": "filter",
          "Hook": "prerouting",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "prerouting",
          "Table": "mangle",
          "Family": "inet",
          "Priority": "",
          "Type": "mangle",
          "Hook": "prerouting",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "postrouting",
          "Table": "mangle",
          "Family": "inet",
          "Priority": "",
          "Type": "mangle",
          "Hook": "postrouting",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "prerouting",
          "Table": "nat",
          "Family": "inet",
          "Priority": "",
          "Type": "natdest",
          "Hook": "prerouting",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "postrouting",
          "Table": "nat",
          "Family": "inet",
          "Priority": "",
          "Type": "natsource",
          "Hook": "postrouting",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "input",
          "Table": "nat",
          "Family": "inet",
          "Priority": "",
          "Type": "natsource",
          "Hook": "input",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "output",
          "Table": "nat",
          "Family": "inet",
          "Priority": "",
          "Type": "natdest",
          "Hook": "output",
          "Policy": "accept",
          "Rules": [
          ]
        },
        {
          "Name": "output",
          "Table": "mangle",
          "Family": "inet",
          "Priority": "",
          "Type": "mangle",
          "Hook": "output",
          "Policy": "accept",
          "Rules": [
            {
              "Table": "",
              "Chain": "",
              "UUID": "<removed for privacy>",
              "Enabled": true,
              "Position": "0",
              "Description": "Allow ICMP",
              "Parameters": "",
              "Expressions": [
                {
                  "Statement": {
                    "Op": "",
                    "Name": "icmp",
                    "Values": [
                      {
                        "Key": "type",
                        "Value": "echo-request"
                      },
                      {
                        "Key": "type",
                        "Value": "echo-reply"
                      }
                    ]
                  }
                }
              ],
              "Target": "accept",
              "TargetParameters": ""
            },
            {
              "Table": "",
              "Chain": "",
              "UUID": "<removed for privacy>",
              "Enabled": true,
              "Position": "0",
              "Description": "Allow ICMPv6",
              "Parameters": "",
              "Expressions": [
                {
                  "Statement": {
                    "Op": "",
                    "Name": "icmpv6",
                    "Values": [
                      {
                        "Key": "type",
                        "Value": "echo-request"
                      },
                      {
                        "Key": "type",
                        "Value": "echo-reply"
                      }
                    ]
                  }
                }
              ],
              "Target": "accept",
              "TargetParameters": ""
            },
            {
              "Table": "",
              "Chain": "",
              "UUID": "<removed for privacy>",
              "Enabled": false,
              "Position": "0",
              "Description": "Exclude WireGuard VPN from being intercepted",
              "Parameters": "",
              "Expressions": [
                {
                  "Statement": {
                    "Op": "",
                    "Name": "udp",
                    "Values": [
                      {
                        "Key": "dport",
                        "Value": "51820"
                      }
                    ]
                  }
                }
              ],
              "Target": "accept",
              "TargetParameters": ""
            }
          ]
        },
        {
          "Name": "forward",
          "Table": "mangle",
          "Family": "inet",
          "Priority": "",
          "Type": "mangle",
          "Hook": "forward",
          "Policy": "accept",
          "Rules": [
            {
              "Table": "",
              "Chain": "",
              "UUID": "<removed for privacy>",
              "Enabled": false,
              "Position": "0",
              "Description": "Intercept forwarded connections (docker, etc)",
              "Parameters": "",
              "Expressions": [
                {
                  "Statement": {
                    "Op": "",
                    "Name": "ct",
                    "Values": [
                      {
                        "Key": "state",
                        "Value": "new"
                      }
                    ]
                  }
                }
              ],
              "Target": "queue",
              "TargetParameters": "num 0"
            }
          ]
        }
      ]
    }
  ]
}

[gustavo-iniguez-goya]

Hi @gq2r ,

"DefaultAction": "allow",

Please, change it to "deny", restart the daemon (service opensnitch restart) and see if it blocks everything.

Could you also post the nftables rules? ~ $ sudo nft list ruleset

[gq2r]

Yes that fixed it, thankyou.

The UI says the default action is deny, so its using /etc/opensnitchd/default-config.json but the service is using
/etc/opensnitchd/default-config.json.pacnew?

The permissions are also different after upgrade and root only:

ls -l /etc/opensnitchd/system-fw.json
-rw------- 1 root root 9354 Jul 10 19:18 /etc/opensnitchd/system-fw.json

ls -l /etc/opensnitchd/default-config.json
-rw------- 1 root root 399 Jul 10 19:54 /etc/opensnitchd/default-config.json

ls -l /etc/opensnitchd/default-config.json.pacnew
-rw-r--r-- 1 root root 425 Jul 10 20:38 /etc/opensnitchd/default-config.json.pacnew

nftables rules:

sudo nft list ruleset

table inet filter {
        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }

        chain input {
                type filter hook input priority filter; policy drop;
                udp sport 53 queue flags bypass to 0
                iifname "lo" accept
                ct state established,related accept
        }
}
table inet nat {
        chain filter-prerouting {
                type filter hook prerouting priority filter; policy accept;
        }

        chain prerouting {
                type nat hook prerouting priority dstnat; policy accept;
        }

        chain postrouting {
                type nat hook postrouting priority srcnat; policy accept;
        }

        chain input {
                type nat hook input priority 100; policy accept;
        }

        chain output {
                type nat hook output priority 100; policy accept;
        }
}
table inet mangle {
        chain prerouting {
                type filter hook prerouting priority mangle; policy accept;
        }

        chain postrouting {
                type filter hook postrouting priority mangle; policy accept;
        }

        chain output {
                type filter hook output priority mangle; policy accept;
                icmp type { echo-reply, echo-request } accept
                icmpv6 type { echo-request, echo-reply } accept
                ct state related,new queue flags bypass to 0
        }

        chain forward {
                type filter hook forward priority mangle; policy accept;
        }
}

[gustavo-iniguez-goya]

thank you! rules are ok. Could you run opensnitchd -check-requirements to see what features are missing on that kernel?

or maybe you don't have the ebpf modules installed. See if you have any *.o file under /usr/lib/opensnitchd/ebpf/ or /etc/opensnitchd, and in such case post the output of objdump -h /usr/lib/opensnitchd/ebpf/opensnitch.o

The UI says the default action is deny, so its using /etc/opensnitchd/default-config.json but the service is using
/etc/opensnitchd/default-config.json.pacnew?

No, the daemon only uses /etc/opensnitchd/default-config.json. The *.pacnew file will content default config file with the new fields we added.

There're 2 default actions. When the daemon connects to the GUI, it'll use the GUI's default action (deny). If it's not connected then it uses daemon's DefaultAction (the one defined in default-config.json, by default allow).

That way we somehow ensure that the user will me prompted to allow or deny a connection. If the user doesn't answer the pop-up, they'll have a notification on the systray indicating that something happened, so they can later review it.

Otherwise if daemon's DefaultAction is deny and the GUI is not connected, we'd block everything not explicitely allowed, but the user wouldn't know what's going on. It can have some ugly side effects (#982 #965) .

Advanced users can change that option

The permissions are also different after upgrade and root only:

Yes, that's correct, they have changed on latest version.

[gq2r]

I do not have /usr/lib/opensnitchd/ directory or any *.o files in /etc/opensnitchd

I'm using this package only: https://software.manjaro.org/package/opensnitch

Sorry I thought ebpf was already installed by default (maintainer doesn't include it in dependencies)

AUR has it but its not in the official repo for manjaro: http://aur.archlinux.org/packages/opensnitch-ebpf-module

The opensnitch package for manjaro installs these files:

/etc/logrotate.d/opensnitch
/etc/opensnitchd/default-config.json
/etc/opensnitchd/system-fw.json
/usr/bin/opensnitch-ui
/usr/bin/opensnitchd
/usr/lib/python3.11/site-packages/opensnitch/__init__.py
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/__init__.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/__init__.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/config.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/config.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/desktop_parser.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/desktop_parser.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/nodes.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/nodes.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/notifications.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/notifications.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/resources_rc.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/resources_rc.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/rules.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/rules.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/service.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/service.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/ui_pb2.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/ui_pb2.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/ui_pb2_grpc.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/ui_pb2_grpc.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/version.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/__pycache__/version.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/__init__.py
/usr/lib/python3.11/site-packages/opensnitch/actions/__pycache__/__init__.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/__pycache__/__init__.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/__pycache__/default_configs.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/__pycache__/default_configs.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/__pycache__/highlight.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/__pycache__/highlight.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/__pycache__/utils.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/__pycache__/utils.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/actions/default_configs.py
/usr/lib/python3.11/site-packages/opensnitch/actions/highlight.py
/usr/lib/python3.11/site-packages/opensnitch/actions/utils.py
/usr/lib/python3.11/site-packages/opensnitch/config.py
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__init__.py
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/__init__.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/__init__.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/addresstablemodel.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/addresstablemodel.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/colorizeddelegate.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/colorizeddelegate.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/firewalltableview.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/firewalltableview.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/generictableview.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/generictableview.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/main.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/main.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/updownbtndelegate.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/__pycache__/updownbtndelegate.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/addresstablemodel.py
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/colorizeddelegate.py
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/firewalltableview.py
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/generictableview.py
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/main.py
/usr/lib/python3.11/site-packages/opensnitch/customwidgets/updownbtndelegate.py
/usr/lib/python3.11/site-packages/opensnitch/database/__init__.py
/usr/lib/python3.11/site-packages/opensnitch/database/__pycache__/__init__.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/database/__pycache__/__init__.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/database/__pycache__/enums.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/database/__pycache__/enums.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/database/enums.py
/usr/lib/python3.11/site-packages/opensnitch/desktop_parser.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__init__.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/__init__.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/__init__.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/conndetails.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/conndetails.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/firewall.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/firewall.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/firewall_rule.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/firewall_rule.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/preferences.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/preferences.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/processdetails.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/processdetails.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/prompt.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/prompt.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/ruleseditor.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/ruleseditor.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/stats.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/__pycache__/stats.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/dialogs/conndetails.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/firewall.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/firewall_rule.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/preferences.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/processdetails.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/prompt.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/ruleseditor.py
/usr/lib/python3.11/site-packages/opensnitch/dialogs/stats.py
/usr/lib/python3.11/site-packages/opensnitch/firewall/__init__.py
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/__init__.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/__init__.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/chains.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/chains.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/enums.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/enums.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/exprs.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/exprs.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/profiles.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/profiles.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/rules.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/rules.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/utils.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/__pycache__/utils.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/firewall/chains.py
/usr/lib/python3.11/site-packages/opensnitch/firewall/enums.py
/usr/lib/python3.11/site-packages/opensnitch/firewall/exprs.py
/usr/lib/python3.11/site-packages/opensnitch/firewall/profiles.py
/usr/lib/python3.11/site-packages/opensnitch/firewall/rules.py
/usr/lib/python3.11/site-packages/opensnitch/firewall/utils.py
/usr/lib/python3.11/site-packages/opensnitch/i18n/de_DE/opensnitch-de_DE.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/es_ES/opensnitch-es_ES.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/eu_ES/opensnitch-eu_ES.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/fi_FI/opensnitch-fi_FI.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/fr_FR/opensnitch-fr_FR.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/hu_HU/opensnitch-hu_HU.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/ja_JP/opensnitch-ja_JP.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/lt_LT/opensnitch-lt_LT.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/nb_NO/opensnitch-nb_NO.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/nl_NL/opensnitch-nl_NL.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/pt_BR/opensnitch-pt_BR.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/ro_RO/opensnitch-ro_RO.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/ru_RU/opensnitch-ru_RU.qm
/usr/lib/python3.11/site-packages/opensnitch/i18n/tr_TR/opensnitch-tr_TR.qm
/usr/lib/python3.11/site-packages/opensnitch/nodes.py
/usr/lib/python3.11/site-packages/opensnitch/notifications.py
/usr/lib/python3.11/site-packages/opensnitch/res/__init__.py
/usr/lib/python3.11/site-packages/opensnitch/res/__pycache__/__init__.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/res/__pycache__/__init__.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/res/firewall.ui
/usr/lib/python3.11/site-packages/opensnitch/res/firewall_rule.ui
/usr/lib/python3.11/site-packages/opensnitch/res/icon-alert.png
/usr/lib/python3.11/site-packages/opensnitch/res/icon-off.png
/usr/lib/python3.11/site-packages/opensnitch/res/icon-pause.png
/usr/lib/python3.11/site-packages/opensnitch/res/icon-pause.svg
/usr/lib/python3.11/site-packages/opensnitch/res/icon-red.png
/usr/lib/python3.11/site-packages/opensnitch/res/icon-white.png
/usr/lib/python3.11/site-packages/opensnitch/res/icon-white.svg
/usr/lib/python3.11/site-packages/opensnitch/res/icon.png
/usr/lib/python3.11/site-packages/opensnitch/res/preferences.ui
/usr/lib/python3.11/site-packages/opensnitch/res/process_details.ui
/usr/lib/python3.11/site-packages/opensnitch/res/prompt.ui
/usr/lib/python3.11/site-packages/opensnitch/res/resources.qrc
/usr/lib/python3.11/site-packages/opensnitch/res/ruleseditor.ui
/usr/lib/python3.11/site-packages/opensnitch/res/stats.ui
/usr/lib/python3.11/site-packages/opensnitch/resources_rc.py
/usr/lib/python3.11/site-packages/opensnitch/rules.py
/usr/lib/python3.11/site-packages/opensnitch/service.py
/usr/lib/python3.11/site-packages/opensnitch/ui_pb2.py
/usr/lib/python3.11/site-packages/opensnitch/ui_pb2_grpc.py
/usr/lib/python3.11/site-packages/opensnitch/utils/__init__.py
/usr/lib/python3.11/site-packages/opensnitch/utils/__pycache__/__init__.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/utils/__pycache__/__init__.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/utils/__pycache__/infowindow.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/utils/__pycache__/infowindow.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/utils/__pycache__/languages.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/utils/__pycache__/languages.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/utils/__pycache__/xdg.cpython-311.opt-1.pyc
/usr/lib/python3.11/site-packages/opensnitch/utils/__pycache__/xdg.cpython-311.pyc
/usr/lib/python3.11/site-packages/opensnitch/utils/infowindow.py
/usr/lib/python3.11/site-packages/opensnitch/utils/languages.py
/usr/lib/python3.11/site-packages/opensnitch/utils/xdg.py
/usr/lib/python3.11/site-packages/opensnitch/version.py
/usr/lib/python3.11/site-packages/opensnitch_ui-1.6.0.dist-info/LICENSE
/usr/lib/python3.11/site-packages/opensnitch_ui-1.6.0.dist-info/METADATA
/usr/lib/python3.11/site-packages/opensnitch_ui-1.6.0.dist-info/RECORD
/usr/lib/python3.11/site-packages/opensnitch_ui-1.6.0.dist-info/WHEEL
/usr/lib/python3.11/site-packages/opensnitch_ui-1.6.0.dist-info/top_level.txt
/usr/lib/systemd/system/opensnitchd.service
/usr/lib/tmpfiles.d/opensnitch.conf
/usr/share/applications/opensnitch_ui.desktop
/usr/share/icons/hicolor/scalable/apps/opensnitch-ui.svg
/usr/share/kservices5/kcm_opensnitch.desktop
/usr/share/metainfo/io.github.evilsocket.opensnitch.appdata.xml

opensnitchd -check-requirements

        Checking system requirements for kernel version 6.1.38-1-MANJARO
------------------------------------------------------------------------------

        Checking => CONFIG_KPROBES=y
        Checking => CONFIG_KPROBES_ON_FTRACE=y
        Checking => CONFIG_KPROBES_ON_FTRACE=y
        Checking => CONFIG_HAVE_KPROBES=y
        Checking => CONFIG_HAVE_KPROBES_ON_FTRACE=y
        Checking => CONFIG_KPROBE_EVENTS=y

        * kprobes        ✔

        Checking => CONFIG_UPROBES=y
        Checking => CONFIG_UPROBE_EVENTS=y

        * uprobes        ✔

        Checking => CONFIG_FTRACE=y

        * ftrace         ✔

        Checking => CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
        Checking => CONFIG_FTRACE_SYSCALLS=y

        * syscalls       ✔

        Checking => CONFIG_NETFILTER_XT_TARGET_NFQUEUE=[my]

        * nfqueue        ✔

[gq2r]

No, the daemon only uses /etc/opensnitchd/default-config.json. The *.pacnew file will content default config file with the new fields we added.

There're 2 default actions. When the daemon connects to the GUI, it'll use the GUI's default action (deny). If it's not connected then it uses daemon's DefaultAction (the one defined in default-config.json, by default allow).

I don't think you understood what I said. The GUI said Deny but everything was being allowed by default

If you check above the only value that has "DefaultAction": "allow" is default-config.json.pacnew. Once this was changed the issue was fixed

I guess you can close issue as its working as intended now, thankyou

[gustavo-iniguez-goya]

Sorry I thought ebpf was already installed by default (maintainer doesn't include it in dependencies)
AUR has it but its not in the official repo for manjaro: http://aur.archlinux.org/packages/opensnitch-ebpf-module

No problem! that AUR package is fine for v1.6.0. Also you can download our precompiled modules:
opensnitch-ebpf-modules-6.0-master - https://github.com/evilsocket/opensnitch/actions/runs/5486183961

👍

[TriMoon]

@gustavo-iniguez-goya
Maybe it's time for you guys to create a DKMS ready package just for the eBPF module?
That way people can option into auto-compiling the module for the kernel version they use.
Some people like me have multiple kernels they can boot 😉