Question

is it possible to give a user an account on a linux machine while blocking his access to network services (say, don’t let him open tcp connections to port 80 on the internet).

I know a firewall can do this, but I would like something in the unix philosohpy (everything is a file). perhaps there is somewhere a file that represents port 80 or something like that?

Answer 1

No, this specific scenario requires a packet filter (namely iptables) on the local machine, using the --uid-owner or --gid-owner conditions.

Untested:

iptables -t filter -A OUTPUT --uid-owner 100 --dport 80 -j REJECT