Match by full command by default for high-risk executables

ui/opensnitch/config.py

@@ -111,6 +111,7 @@ class Config:
     DEFAULT_POPUP_ADVANCED_CHECKSUM = "global/default_popup_advanced_checksum"
     DEFAULT_FW_INTERCEPTION_ENABLED = "global/interception_enabled"
     DEFAULT_PERSIST_INTERCEPTION_STATE = "global/persist_interception_state"
+    DEFAULT_POPUP_ADVANCED_FULL_COMMAND = "global/default_popup_advanced_full_command"
     DEFAULT_SERVER_ADDR  = "global/server_address"
     DEFAULT_SERVER_MAX_MESSAGE_LENGTH  = "global/server_max_message_length"
     DEFAULT_SERVER_MAX_WORKERS = "global/max_workers"

ui/opensnitch/dialogs/preferences/settings.py

@@ -9,6 +9,7 @@
 from opensnitch.config import Config
 from opensnitch.utils import languages
 from opensnitch.database import Database
+from opensnitch.dialogs.prompt import constants as prompt_constants
 from opensnitch.dialogs.preferences import (
     utils,
 )
@@ -59,6 +60,15 @@ def load(win):
     win.uidCheck.setChecked(win.cfgMgr.getBool(win.cfgMgr.DEFAULT_POPUP_ADVANCED_UID))
     win.checkSum.setChecked(win.cfgMgr.getBool(win.cfgMgr.DEFAULT_POPUP_ADVANCED_CHECKSUM))
 
+    default_full_cmds = ",".join(prompt_constants.FULL_COMMAND_BIN)
+    if win.cfgMgr.hasKey(win.cfgMgr.DEFAULT_POPUP_ADVANCED_FULL_COMMAND):
+        full_cmds = win.cfgMgr.getSettings(win.cfgMgr.DEFAULT_POPUP_ADVANCED_FULL_COMMAND)
+        if full_cmds is None:
+            full_cmds = ""
+    else:
+        full_cmds = default_full_cmds
+    win.fullCommandBin.setText(str(full_cmds))
+
     ## rules
     win.comboUIRules.blockSignals(True)
     win.comboUIRules.setCurrentIndex(win.cfgMgr.getInt(win.cfgMgr.DEFAULT_IGNORE_TEMPORARY_RULES))
@@ -211,6 +221,7 @@ def save_ui_config(win):
         win.cfgMgr.setSettings(win.cfgMgr.DEFAULT_POPUP_ADVANCED_DSTPORT, bool(win.dstPortCheck.isChecked()))
         win.cfgMgr.setSettings(win.cfgMgr.DEFAULT_POPUP_ADVANCED_UID, bool(win.uidCheck.isChecked()))
         win.cfgMgr.setSettings(win.cfgMgr.DEFAULT_POPUP_ADVANCED_CHECKSUM, bool(win.checkSum.isChecked()))
+        win.cfgMgr.setSettings(win.cfgMgr.DEFAULT_POPUP_ADVANCED_FULL_COMMAND, win.fullCommandBin.text())
 
         win.cfgMgr.setSettings(win.cfgMgr.NOTIFICATIONS_ENABLED, bool(win.groupNotifs.isChecked()))
         win.cfgMgr.setSettings(win.cfgMgr.NOTIFICATIONS_TYPE,

ui/opensnitch/dialogs/prompt/constants.py

@@ -39,6 +39,7 @@
 
 APPIMAGE_PREFIX = "/tmp/.mount_"
 SNAP_PREFIX = "/snap"
+FULL_COMMAND_BIN = ["python", "curl", "wget", "node", "java", "ssh"]
 
 # label displayed in the pop-up combo
 DURATION_session = QC.translate("popups", "until reboot")

ui/opensnitch/dialogs/prompt/utils.py

@@ -1,6 +1,7 @@
 from slugify import slugify
 import os
 import ipaddress
+from pathlib import Path
 
 from PyQt6.QtCore import QCoreApplication as QC
 
@@ -227,9 +228,18 @@ def set_default_duration(cfg, durationCombo):
     else:
         durationCombo.setCurrentIndex(Config.DEFAULT_DURATION_IDX)
 
+def _get_full_command_bins(cfg):
+    if cfg.hasKey(cfg.DEFAULT_POPUP_ADVANCED_FULL_COMMAND):
+        full_cmds = cfg.getSettings(cfg.DEFAULT_POPUP_ADVANCED_FULL_COMMAND)
+        if full_cmds is not None:
+            return [x.strip() for x in full_cmds.split(",") if x.strip()]
+        return []
+    return constants.FULL_COMMAND_BIN
+
 def set_default_target(combo, con, cfg, app_name, app_args):
     # set appimage as default target if the process path starts with
     # /tmp/._mount
+    connection_path = Path(con.process_path)
     if con.process_path.startswith(constants.APPIMAGE_PREFIX):
         idx = combo.findData(constants.FIELD_APPIMAGE)
         if idx != -1:
@@ -240,6 +250,11 @@ def set_default_target(combo, con, cfg, app_name, app_args):
         if idx != -1:
             combo.setCurrentIndex(idx)
             return
+    # entire command as default target for "dangerous" commands
+    # (e.g. curl, wget, node)
+    elif any(connection_path.name.startswith(bin) for bin in _get_full_command_bins(cfg)):
+        combo.setCurrentIndex(1)
+        return
 
     saved_target = int(cfg.getSettings(cfg.DEFAULT_TARGET_KEY))
     # In order to respect user selection, the app_name and app_args must be

ui/opensnitch/res/preferences.ui

@@ -546,6 +546,29 @@
               </property>
              </widget>
             </item>
+            <item row="3" column="0">
+             <widget class="QLabel" name="label_full_command">
+              <property name="sizePolicy">
+               <sizepolicy hsizetype="Preferred" vsizetype="Preferred">
+                <horstretch>0</horstretch>
+                <verstretch>0</verstretch>
+               </sizepolicy>
+              </property>
+              <property name="text">
+               <string>Filter by full command by default</string>
+              </property>
+              <property name="toolTip">
+               <string>List of commands that will be selected to filter as "from this command line" by default in the pop-up dialog.&#10;The list should be comma-separated without spaces.&#10;It would match all commands that starts with a word in the list.</string>
+              </property>
+             </widget>
+            </item>
+            <item row="3" column="1">
+             <widget class="QLineEdit" name="fullCommandBin">
+              <property name="placeholderText">
+               <string>e.g. python,curl (leave empty to disable)</string>
+              </property>
+             </widget>
+            </item>
            </layout>
           </widget>
          </widget>