What's the best way to set rules for Electron apps?

[K4LCIFER]

It seems that electron apps are always recognized ass a process called "electron" or a command line that calls "electron" and don't seem to use the name of the actual application itself. I have seen this, for example, with Element Desktop. What's the best way to create rules for something like that?

[gustavo-iniguez-goya]

Hi @K4LCIFER ,

mmh, I haven't seen that behaviour. Could you post the opensnitch, kernel and distro versions? Also paste the output of opensnitchd -check-requirements

By the way, what package are you using of the Element Desktop? the .deb package from their repository or a flatpak/appimage?

[gustavo-iniguez-goya]

On my system, with ebpf working as expected, it's recognized as /opt/Element/element-desktop, so I think ebpf is not working on your system for some reason, or you're using proc as the MonitorMethod.

The output of -check-requirements will tell us if something is not right.

[K4LCIFER]

• Opensnitch version (opensnitchd --version): 1.6.5
• ArchLinux Kernel version: 6.6.42-1-lts

Output of opensnitchd -check-requirements:

        Checking system requirements for kernel version 6.6.42-1-lts
------------------------------------------------------------------------------

        Checking => CONFIG_KPROBES=y
        Checking => CONFIG_KPROBES_ON_FTRACE=y
        Checking => CONFIG_KPROBES_ON_FTRACE=y
        Checking => CONFIG_HAVE_KPROBES=y
        Checking => CONFIG_HAVE_KPROBES_ON_FTRACE=y
        Checking => CONFIG_KPROBE_EVENTS=y

        * kprobes        ✔

        Checking => CONFIG_UPROBES=y
        Checking => CONFIG_UPROBE_EVENTS=y

        * uprobes        ✔

        Checking => CONFIG_FTRACE=y

        * ftrace         ✔

        Checking => CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
        Checking => CONFIG_FTRACE_SYSCALLS=y

        * syscalls       ✔

        Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]
        Checking => CONFIG_NFT_QUEUE=[my]
        Checking => CONFIG_NETFILTER_XT_TARGET_NFQUEUE=[my]

        * nfqueue        ✔

        Checking => CONFIG_NETFILTER_NETLINK=[my]
        Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]
        Checking => CONFIG_NETFILTER_NETLINK_ACCT=[my]

        * netlink        ✔

        Checking => CONFIG_INET_DIAG=[my]
        Checking => CONFIG_INET_TCP_DIAG=[my]
        Checking => CONFIG_INET_UDP_DIAG=[my]
        Checking => CONFIG_INET_DIAG_DESTROY=[my]

        * net diagnostics        ✔

I also have the ebpf module installed as opensnitch-ebpf-module v1.6.5-3

I am using the Element Desktop package that is in the Archlinux Repos: element-desktop v1.11.72-1

The UI shows that I am using the ebpf module as well:

[gustavo-iniguez-goya]

ok, could you set LogLevel to DEBUG, empty the log file (truncate -s /var/log/opensnitchd.log) , launch ElementDesktop and post the logs?
If the process name you're seeing is just "electron" , it probably means that we're failing to obtain the full path to the binary for some reason. Let's see if there's any errors in the logs.