# littlesnitch-linux

A skill covering the open-source part of Little Snitch for Linux: Rust eBPF programs that intercept network connections and block hosts from lists.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 518 installs · ★ 88
- Author: reason-machines
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/trending-skills/tree/HEAD/skills/littlesnitch-linux/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/littlesnitch-linux

## What it does

The skill walks through the open-source components of Little Snitch for Linux: eBPF programs, shared types and a demo loader. The programs attach to the kernel and intercept network connections, while data moves between kernel and user space through eBPF maps. The full product from Objective Development also ships a proprietary UI and rule engine, which the open part does not include.

Four pieces live in the repo: `ebpf/` holds the kernel programs, `common/` the shared types, `demo-runner/` is the loader and event consumer, and `webroot/` carries a JavaScript web UI. The loader is built on Aya, and blocklists come from `blocked_hosts.txt` and `blocked_domains.txt` in the working directory. Building goes through `cargo build --release`; build scripts handle the eBPF compilation on their own.

You need both stable and nightly Rust toolchains, with `rust-src` on the nightly one, plus `bpf-linker` and `clang`. The kernel has to be Linux 5.15+ with BTF and CO-RE support, and loading the programs takes root or `CAP_BPF`. Skip the nightly toolchain with `rust-src` and the eBPF build fails, so check that before the first run.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill littlesnitch-linux -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/littlesnitch-linux/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/littlesnitch-linux/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill littlesnitch-linux -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/littlesnitch-linux/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill littlesnitch-linux -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/littlesnitch-linux/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/trending-skills littlesnitch-linux
```

2. **Manually: put the files in place**
- File: `.github/skills/littlesnitch-linux/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill littlesnitch-linux -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/trending-skills --path skills/littlesnitch-linux
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/littlesnitch-linux/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill littlesnitch-linux -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/trending-skills/tree/HEAD/skills/littlesnitch-linux/SKILL.md

## When to use it
- build eBPF programs that intercept network connections
- block a list of IPs and domains at the kernel level
- understand how the ebpf, common and demo-runner crates fit together
- run the demo loader for the eBPF programs
- add a shared type for kernel-to-user-space data exchange

## Example prompts
- Walk me through the `common` crate and which types both kernel and user space share
- Explain how `demo-runner` loads the eBPF programs and fills the `BLOCKED_HOSTS` map
- What do I need installed to build the eBPF part of this Rust project?

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/trending-skills](https://affpapa.org/en/nevibecode/by/reason-machines/trending-skills.md) — 139 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md