1. Reverting to the pre 600 build
2. Preventing an application getting access to the network
3. Preventing auto update from the already downloaded copy of Build 600
1.a. I already previously renamed terminal.exe to terminal-xxx... and that has not changed.
1.b. rename the new terminal to something else.
2.
sudo useradd nonet
# make a group and become a member of it
sudo groupadd netless
sudo adduser brian netless
sudo adduser nonet netless
# now enter an iptables rule to block that group from using the internet you can type this on the terminal and hit enter
sudo iptables -A OUTPUT -m owner --gid-owner netless -j DROP
# to make this rule run after each reboot you can put it in
gksu gedit /etc/rc.local (make sure the last line in that text file says exit 0)
# usage examples:
sg netless ping 127.0.0.1
sg netless "wine MetaCrap.exe"
//////////////////////////////
#Now see if access open to group brian
sg brian "ping google.com"
PING google.com (173.194.34.128) 56(84) bytes of data.
64 bytes from lhr14s21-in-f0.1e100.net (173.194.34.128): icmp_req=1 ttl=56 time=23.3 ms
#Now see if access is blocked to group netless
sg netless "ping google.com"
PING google.com (173.194.34.128) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
## So far so good
//////////////////////
3. Stopping an automatic upgrade from the harddisk download:
Renaming the m/q folder seems to work /////////////////////
We should now have the monster locked in a containment field
This is not enough:
We might forget run it from containment
and the monster will run riot all over our harddisk again
That is why I created a separate user nonet who will always run netless
and in separate protected user space.
That is a bit inconvenient
So I need to be able access nonet login from my normal login using the remote desktop viewer.
Meaning I can see into the blackbox put MetaCrap can not see out.
Don't forget to copy the original history files aswell.
In this snapshot I double check that MetaCrap cannot access the outside world: