How to deny network access to applications that are not in the whitelist?

Question

linux

Hello, I had an attack of paranoia :)
I use Ubuntu 12.04, I never really fiddled with the network and access settings, so the question arose, what is the easiest way to deny access to the network for all applications, except for those that I myself indicate? And secondly, by what means is it possible to manage rights for all applications? For example, if the rules are not specified, then by default the application does not have access to files and the network, etc. So I suspect that the second question is for AppArmor?

Answer 1

As for the network, I can only suggest that you need to dig towards iptables. At one time I tried to study its syntax, but did not master it (apparently, there were other priorities). Of course, I don’t rub it, but I advise you to immediately try graphical shells.
AppArmor has an analogue that is built into the kernel (as far as I know) - SELinux. It seems to be considered the main tool. I have seen AppArmor only in openSUSe and in Ubuntu.

Answer 2

iptables is somewhat not what the author needs, the key in the issue of “access to applications”, in the standard version, iptables operates on data from 3-4 levels of the OSI model. In order to deny access to an application, you need an application firewall, at the moment, as far as I know, there is no ready-made solution for Linux. There is an owner module for iptables, but everything is through scripts and process pid ...