cleanup

3 files changed, 14 insertions, 11 deletions

diff --git a/etc/nolocal.net b/etc/nolocal.net
index 9fa785450..8955f740d 100644
--- a/etc/nolocal.net
+++ b/etc/nolocal.net
@@ -12,15 +12,25 @@
 #
 ###################################################################
 
-
+#allow all loopback traffic
 -A INPUT -i lo -j ACCEPT
+
+# no incoming connections
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# allow ping etc.
 -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
 -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
 -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
 
+# accept dns requests going out to a server on the local network
 -A OUTPUT -p udp --dport 53 -j ACCEPT
+
+# drop all local network traffic
 -A OUTPUT -d 192.168.0.0/16 -j DROP
 -A OUTPUT -d 10.0.0.0/8 -j DROP
 -A OUTPUT -d 172.16.0.0/12 -j DROP
+
+# drop multicast traffic
+-A OUTPUT -d 244.0.0.0/4 -j DROP
 COMMIT
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index cb0d9d7af..7246be8cf 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -98,7 +98,7 @@ void netfilter(const char *fname) {
 
         // first run of iptables on this platform installs a number of kernel modules such as ip_tables, x_tables, iptable_filter
         // we run this command with caps and seccomp disabled in order to allow the loading of these modules
-        sbox_run(SBOX_ROOT /* | SBOX_CAPS_NETWORK | SBOX_SECCOMP*/ | SBOX_STDIN_FROM_FILE, 1, iptables_restore);
+        sbox_run(SBOX_ROOT | SBOX_STDIN_FROM_FILE, 1, iptables_restore);
         unlink(SBOX_STDIN_FILE);
 
         // debug
@@ -147,7 +147,7 @@ void netfilter6(const char *fname) {
 
         // first run of iptables on this platform installs a number of kernel modules such as ip_tables, x_tables, iptable_filter
         // we run this command with caps and seccomp disabled in order to allow the loading of these modules
-        sbox_run(SBOX_ROOT | /* SBOX_CAPS_NETWORK | SBOX_SECCOMP | */ SBOX_STDIN_FROM_FILE, 1, ip6tables_restore);
+        sbox_run(SBOX_ROOT | SBOX_STDIN_FROM_FILE, 1, ip6tables_restore);
         unlink(SBOX_STDIN_FILE);
 
         // debug
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index 1d6cc2353..274a4353f 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -104,13 +104,6 @@ static struct sock_fprog prog = {
         .filter = filter,
 };
 
-typedef struct sbox_config {
-        char *name;
-        char *path;
-        unsigned filters;
-} SboxConfig;
-
-
 int sbox_run(unsigned filter, int num, ...) {
         EUID_ROOT();
 
@@ -142,7 +135,7 @@ int sbox_run(unsigned filter, int num, ...) {
                 if (filter & SBOX_STDIN_FROM_FILE) {
                         int fd;
                         if((fd = open(SBOX_STDIN_FILE, O_RDONLY)) == -1) {
-                                fprintf(stderr,"Error: cannot open /tmp/netfilter\n");
+                                fprintf(stderr,"Error: cannot open %s\n", SBOX_STDIN_FILE);
                                 exit(1);
                         }
                         dup2(fd,STDIN_FILENO);