Skip to content

Instantly share code, notes, and snippets.

@danilogco

danilogco/opensnitch_install.sh

Created June 26, 2025 18:26
Show Gist options
  • Save danilogco/6be0b3422d8953c0076b3c435d75cd01 to your computer and use it in GitHub Desktop.
Save danilogco/6be0b3422d8953c0076b3c435d75cd01 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. danilogco created this gist Jun 26, 2025.
    48 changes: 48 additions & 0 deletions opensnitch_install.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,48 @@
    #!/bin/bash

    set -e

    sudo apt update
    sudo apt install opensnitch
    RULE_PATH="/etc/opensnitchd/rules"
    sudo mkdir -p "$RULE_PATH"

    sudo tee "$RULE_PATH/000-allow-system-cmds.json" > /dev/null <<'EOF'
    {
    "created": "2021-04-26T09:58:03.704090244+02:00",
    "updated": "2021-04-26T09:58:03.704216578+02:00",
    "name": "000-allow-system-cmds",
    "enabled": true,
    "precedence": true,
    "action": "allow",
    "duration": "always",
    "operator": {
    "type": "regexp",
    "operand": "process.path",
    "sensitive": false,
    "data": "^(/usr/bin/host|/usr/bin/xbrlapi|/usr/bin/dirmngr|/usr/bin/slim)",
    "list": []
    }
    }
    EOF

    sudo tee "$RULE_PATH/000-allow-localhost.json" > /dev/null <<'EOF'
    {
    "created": "2021-04-26T09:58:03.704090244+02:00",
    "updated": "2021-04-26T09:58:03.704216578+02:00",
    "name": "000-allow-localhost",
    "enabled": true,
    "precedence": true,
    "action": "allow",
    "duration": "always",
    "operator": {
    "type": "network",
    "operand": "dest.network",
    "sensitive": false,
    "data": "127.0.0.0/8",
    "list": []
    }
    }
    EOF

    sudo systemctl enable --now opensnitch