Simulate a network disconnect during testing

0
votes

I am user bob and I launch process script.sh. I'd like to block outbound requests made by script.sh to IP X.X.X.X.

bob is not root. bot is unable to get root.

I've tried with iptables using

iptables -A INPUT -s X.X.X.X -j DROP && service iptables save

But I get:

iptables v1.4.21: can't initialize iptables table `filter': Permission denied (you must be root)

More context:

I'm working on a development env with multiple databases and systems. I'm writing some tests to try and simulate when connection between one of the systems is severed (and then reconnected). I'd prefer not to have to have my test run as root if they don't have to...

1
linuxiptables
What do you want? An answer that's telling you how to circumvent your system's security? - Charles Duffy
iptables is built very intentionally not to allow configuration by unprivileged users, and for very good reasons. If you wanted a weaker approach -- ie. shadowing the relevant C library calls with an LD_PRELOADable library -- that's doable, but also circumventable. - Charles Duffy
And how's this a programming question? Looks like basic Linux admin to me... - tink
Hmm. You could run your program in something like a user-mode linux container, a qemu virtual machine, &c., and enable iptables rules at the root level inside said "guest". - Charles Duffy
Tables are global -- there is no user-specific table you can configure for only your own processes. - Charles Duffy

1 Answers

1
votes

I would suggest setting up a very limited privilege escalation mechanism to allow tcpkill to be invoked by the user running your tests.

For instance in /etc/sudoers, you might have something like the following:

# allow tcpkill to be run under sudo by scripts
Defaults!/usr/sbin/tcpkill !requiretty

# allow testuser to invoke /usr/sbin/tcpkill for IP address 1.2.3.4
testuser: ALL = (root) NOPASSWD: /usr/sbin/tcpkill host 1.2.3.4