From 1f18ec9e2c94adb783b59e3a45356892f2d6bee9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=B8ren=20=C3=98stervig?= Date: Tue, 5 May 2026 11:42:53 +0200 Subject: [PATCH] fix: egress filtering when running as non-root user --- entrypoint.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 8afbba5..0f1d76d 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -152,14 +152,16 @@ if [ "${OPEN_TERMINAL_ALLOWED_DOMAINS+set}" = "set" ]; then echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf > /dev/null # iptables: allow ONLY resolved IPs (via ipset) + block everything else - sudo iptables -A OUTPUT -p udp --dport 53 -j DROP # block external DNS - sudo iptables -A OUTPUT -p tcp --dport 53 -j DROP # block external DNS + sudo iptables -A OUTPUT -p udp -d "$UPSTREAM_DNS" --dport 53 -j ACCEPT # allow dnsmasq → upstream DNS + sudo iptables -A OUTPUT -p tcp -d "$UPSTREAM_DNS" --dport 53 -j ACCEPT # allow dnsmasq → upstream DNS (TCP) + sudo iptables -A OUTPUT -p udp --dport 53 -j DROP # block all other external DNS + sudo iptables -A OUTPUT -p tcp --dport 53 -j DROP # block all other external DNS sudo iptables -A OUTPUT -m set --match-set allowed dst -j ACCEPT # allow resolved IPs sudo iptables -A OUTPUT -j DROP # drop everything else fi echo "Egress firewall active — dropping CAP_NET_ADMIN permanently" - exec capsh --drop=cap_net_admin -- -c "exec open-terminal $*" + exec sudo capsh --drop=cap_net_admin --user=user -- -c "exec open-terminal $*" fi exec open-terminal "$@"