How to deal with interpreters?

[martin-braun]

I stopped using Little Snitch and want to use Lulu. The experience is great, so thanks for the good product.

One thing that I miss though are rules that are defined based on the host who spawned the process in question.

For instance. An application, written in Java, will spawn the Java binary in the rule setup of Lulu. If two Applications are Java applications, their rules have to be shared, since those are Java rules, not specific Application rules.

The same limitation is present with other interpreters, such as Deno, Python, node, etc.

Little Snitch allowed rules to be different based on the caller. So much so, that I could even influence curl rules for each script individually.

Can something like this be done in Lulu already? Or is it planned?

EDIT: I just see that the java rule is in fact for a binary embedded into the Application, so this might not be a problem. Still, I think this would be such a great addition.

[martin-braun]

Here is a real life example:

The Android SDK / Android Emulator will access the java version I setup properly via sdkman. This is the java in $JAVA_HOME:

I have no power to say that it should be a rule only for the emulator / Android Studio / Android SDK, instead I can only whitelist the entire java binary making it open for other apps and scripts to exploit.

[objective-see]

Yes this would be good to have!

I think the "easiest" option would be to have a rule option (for interpreters) that would allow you to create a rule for the interpreter + script (some what how now you can create a rule that is for process + endpoint).

So you could make a rule for: Python + <some script>
...but that wouldn't match for Python + <some other script>

Thoughts?