From This Command Line?

[JGKle]

Question: is the 2nd line on the notification dialog meant to be the "from this command line?" i.e. as in this screenshot:

I'm trying to make a rule for a compressed executable that extracts itself to a different temporary path each time, as shown in the screenshot - I thought I could have it be identified by that second line, /usr/bin/python /usr/bin/deluge. But when I structure the rule as shown, it doesn't seem to work.

Perhaps some indicator on the notification dialog, for clarity? i.e.
xxxxx
yyyyy

->

Executable: xxxx
Command Line: yyyy

(if that's the case)

[gustavo-iniguez-goya]

Question: is the 2nd line on the notification dialog meant to be the "from this command line?" i.e. as in this screenshot:

Yes

But when I structure the rule as shown, it doesn't seem to work.

mm, I guess it should work, but I haven't tested all the scenarios. Could you also add /usr/bin/python to the "From this executable" field? Just to test if filtering by both fields work.

I know I've already talked with Ph0rk0z about this, but I can't locate the issue number.

[jonau01]

I had a similar issue here and Gustavo helped me resolve this issue.
.
My guess is you would have to define :
From this executable : /usr/bin/python
From this command line : /usr/bin/deluge$

[gustavo-iniguez-goya]

aah, sorry, it was you O:) . I didn't remember the issue, thank you!

[JGKle]

Ah, I got it working. It looks like the reason it wasn't working actually wasn't because of the commandline, but because of the comma-separated list of domains. For some reason if I have two separate rules with commandline "/usr/bin/python /usr/bin/deluge" and a single domain each, it works - but one rule with that commandline and domains .*domain1.com,.*domain2.com, that's what was breaking it. So the command-line was a red herring.

[gustavo-iniguez-goya]

mm, interesting, I'll take a look at that problem. I expected to see this kind of issues with the new rules editor, so it's good to know.

[gustavo-iniguez-goya]

one rule with that commandline and domains .*domain1.com,.*domain2.com, that's what was breaking it.

I can't reproduce this problem, could you post the log that appears in the log file (INFO level)? every time you click on Apply in the rules editor there should be a log like this:

INF [notification] change rule: %!(EXTRA rule.Rule=allow-simple-python-tmpconnection_testerpy: if(list is '[{"type": "simple", "operand": "process.command", "data": "python /tmp/connection_tester.py"}, {"type": "regexp", "operand": "dest.host", "data": "..google.com"}]'){ allow 1h }, uint64=15904408205098104)

[JGKle]

So this is interesting, & maybe a different bug? In the UI settings, it's set to level INFO (it was by default, I haven't changed it):

however, /var/log/opensnitchd.log appears to be logging at DEBUG, the most verbose level:

In any case, back to the original issue - as an example, here's a rule for domains "google.com" & "stackoverflow.com":

and when it tries to reach stackoverflow a few moments later, a notification:

Here's the rule change log:

 �[2m[2020-05-26 01:04:04]�[0m �[97m�[42m INF �[0m [notification] change rule: %!(EXTRA *rule.Rule=_ManicTimeTest: if(�[1mlist�[0m is '�[33m[{"type": "simple", "operand": "process.path", "data": "/usr/lib/manictime/ManicTime"}, {"type": "regexp", "operand": "dest.host", "data": ".*\\.google\\.com,.*stackoverflow\\.com"}]�[0m'){ allow always }, uint64=15904550447149856)
 �[2m[2020-05-26 01:04:04]�[0m �[97m�[42m INF �[0m [notification] delete rule: %!(EXTRA string=allow-list-type-regexp-operand-desthost-data-googlecom-type-simple-operand-processpath-data-usrlibmanictimemanictime, uint64=15904550447155118)

[gustavo-iniguez-goya]

{"type": "regexp", "operand": "dest.host", "data": ".*.google.com,.*stackoverflow.com"}

ok, this is what is causing the problem. On the field To this host: you can't specify several domains separated by commas. The example that appears grayed out on the textbox was just as an example of regular expressions that can be used.

If you need to specify several domains you have to use a regex like this: .*(\.google|stackoverflow)\.com

I don't know right now if we allow several dest.host in a rule, but as the "," character is not part of the DNS convention, maybe we could use it as separator to specify several domains on the same field (To this host or To this destination IP).

For now use the above regex.

[JGKle]

Aha! Yup, that works - & that explains it. The confusion was primarily that I just seemed to be following the greyed-out example :)

Related: Perhaps a good idea in the docs/faq would be just a few regexp examples or common things - such as how to do multiple domains, "not domains" (i.e. reject everything except a given domain), etc, for those who are less regexp-experienced :)

[gustavo-iniguez-goya]

I agree, the thing is that I've just added the rules editor, so I haven't had time yet to do it hehe.

[gustavo-iniguez-goya]

resolved. Added regexp examples to the docs: https://github.com/gustavo-iniguez-goya/opensnitch/wiki/Rules-editor

[JGKle]

lnk2

@gustavo-iniguez-goya sorry to bug u, could u edit this old post & remove the old lnk2 url? That domain is about to lapse & I'm afraid that registrar is known to "repurpose" old domains for unsavory uses, want to get rid of that old link to avoid associating myself with whtever they put there, if possible

[gustavo-iniguez-goya]

Sure! done.