{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/537","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/537/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/537/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/537/events","html_url":"https://github.com/netblue30/firejail/pull/537","id":156757235,"number":537,"title":"Make `restricted-network` prevent use of netfilter","user":{"login":"KellerFuchs","id":14331571,"avatar_url":"https://avatars.githubusercontent.com/u/14331571?v=3","gravatar_id":"","url":"https://api.github.com/users/KellerFuchs","html_url":"https://github.com/KellerFuchs","followers_url":"https://api.github.com/users/KellerFuchs/followers","following_url":"https://api.github.com/users/KellerFuchs/following{/other_user}","gists_url":"https://api.github.com/users/KellerFuchs/gists{/gist_id}","starred_url":"https://api.github.com/users/KellerFuchs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KellerFuchs/subscriptions","organizations_url":"https://api.github.com/users/KellerFuchs/orgs","repos_url":"https://api.github.com/users/KellerFuchs/repos","events_url":"https://api.github.com/users/KellerFuchs/events{/privacy}","received_events_url":"https://api.github.com/users/KellerFuchs/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-05-25T13:56:21Z","updated_at":"2016-05-26T17:04:44Z","closed_at":"2016-05-26T13:07:31Z","pull_request":{"url":"https://api.github.com/repos/netblue30/firejail/pulls/537","html_url":"https://github.com/netblue30/firejail/pull/537","diff_url":"https://github.com/netblue30/firejail/pull/537.diff","patch_url":"https://github.com/netblue30/firejail/pull/537.patch"},"body":"I suggest `netfilter` to be affected by `restricted-network` because it is a traditionally-privileged interface to the kernel, and the security impact of letting untrusted users run their own netfilter scripts (even on their own network namespace) is non-obvious.\r\n\r\nIs that OK, or should I introduce a separate config flag for this?"},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/221932645","html_url":"https://github.com/netblue30/firejail/pull/537#issuecomment-221932645","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/537","id":221932645,"user":{"login":"KellerFuchs","id":14331571,"avatar_url":"https://avatars.githubusercontent.com/u/14331571?v=3","gravatar_id":"","url":"https://api.github.com/users/KellerFuchs","html_url":"https://github.com/KellerFuchs","followers_url":"https://api.github.com/users/KellerFuchs/followers","following_url":"https://api.github.com/users/KellerFuchs/following{/other_user}","gists_url":"https://api.github.com/users/KellerFuchs/gists{/gist_id}","starred_url":"https://api.github.com/users/KellerFuchs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KellerFuchs/subscriptions","organizations_url":"https://api.github.com/users/KellerFuchs/orgs","repos_url":"https://api.github.com/users/KellerFuchs/repos","events_url":"https://api.github.com/users/KellerFuchs/events{/privacy}","received_events_url":"https://api.github.com/users/KellerFuchs/received_events","type":"User","site_admin":false},"created_at":"2016-05-26T17:04:44Z","updated_at":"2016-05-26T17:04:44Z","body":"Thanks a bunch."}}
{"actor":{"display_login":"KellerFuchs"}}