试图禁用用户的networking访问权限：
[root@notebook ~]# iptables -I OUTPUT -m owner --uid-owner tempuser -j DROP [root@notebook ~]# ip6tables -I OUTPUT -m owner --uid-owner tempuser -j DROP Could not open socket to kernel: Address family not supported by protocol [root@notebook ~]# [root@notebook ~]# iptables -I INPUT -m owner --uid-owner tempuser -j DROP iptables: Invalid argument. Run `dmesg' for more information. [root@notebook ~]# ip6tables -I INPUT -m owner --uid-owner tempuser -j DROP Could not open socket to kernel: Address family not supported by protocol [root@notebook ~]# testing它：
[root@notebook ~]# su - tempuser [tempuser@notebook ~]$ ping google.com ping: unknown host google.com [tempuser@notebook ~]$ [tempuser@notebook ~]$ ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=4.80 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=4.07 ms ^C --- 8.8.8.8 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1057ms rtt min/avg/max/mdev = 4.071/4.439/4.807/0.368 ms [tempuser@notebook ~]$ [tempuser@notebook ~]$ exit logout [root@notebook ~]# ping google.com PING google.com (216.58.209.174) 56(84) bytes of data. 64 bytes from bud02s21-in-f14.1e100.net (216.58.209.174): icmp_seq=1 ttl=55 time=5.05 ms ^C --- google.com ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 572ms rtt min/avg/max/mdev = 5.059/5.059/5.059/0.000 ms [root@notebook ~]#
问题：如何在Linux下禁用给定用户的networking访问？ （INPUT / OUTPUT / IPv4 / IPv6？） – 为什么我仍然可以ping用户的IPv4地址？
在某些系统上， ping是SUID二进制文件，因为发送ICMP数据包需要root权限（在其他系统上我相信这是通过function来处理的）。
[me@lory ~]$ ls -al /bin/ping -rwsr-xr-x. 1 root root 40760 Sep 26 2013 /bin/ping
如果你使用的是前一类系统，那么发送这些PING数据包的不是tempuser; 它的根源。 没有完成SUID的DNS查找，tempuser（ unknown host google.com ）失败，所以您可以确认您的阻止正在工作。