From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 2/2] run Tor under dedicated user
Date: Mon, 11 Mar 2019 20:07:00 +0000
Message-ID: <3337d646-c173-ed7f-d04f-46fe92c398cd@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5596442305241482970=="
List-Id: <development.lists.ipfire.org>

--===============5596442305241482970==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

This allows more-fine granular firewall rules (see first patch for
further information). Further, it prevents other services running as
"nobody" (Apache, ...) from reading Tor relay keys.

Fixes #11779.

Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
---
 lfs/tor                 |  6 +++---
 src/paks/tor/install.sh | 15 ++++++++++++++-
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/lfs/tor b/lfs/tor
index 384b1b213..2b0e0903a 100644
--- a/lfs/tor
+++ b/lfs/tor
@@ -32,7 +32,7 @@ DL_FROM    =3D $(URL_IPFIRE)
 DIR_APP    =3D $(DIR_SRC)/$(THISAPP)
 TARGET     =3D $(DIR_INFO)/$(THISAPP)
 PROG       =3D tor
-PAK_VER    =3D 34
+PAK_VER    =3D 35
=20
 DEPS       =3D ""
=20
@@ -82,8 +82,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 			--prefix=3D/usr \
 			--sysconfdir=3D/etc \
 			--localstatedir=3D/var \
-			--with-tor-user=3Dnobody \
-			--with-tor-group=3Dnobody
+			--with-tor-user=3Dtor \
+			--with-tor-group=3Dtor
=20
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
diff --git a/src/paks/tor/install.sh b/src/paks/tor/install.sh
index 31c5fecae..e1ed33331 100644
--- a/src/paks/tor/install.sh
+++ b/src/paks/tor/install.sh
@@ -17,11 +17,24 @@
 # along with IPFire; if not, write to the Free Software                    #
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
 #                                                                          #
-# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>.                       =
 #
+# Copyright (C) 2007-2019 IPFire-Team <info(a)ipfire.org>.                  =
 #
 #                                                                          #
 ############################################################################
 #
 . /opt/pakfire/lib/functions.sh
+
+# Run Tor as dedicated user and make sure user and group exist
+if ! getent group tor &>/dev/null; then
+       groupadd -g 119 tor
+fi
+
+if ! getent passwd tor; then
+       useradd -u 119 -g tor -d /var/empty -s /bin/false tor
+
+       # Adjust some folder permission for new UID/GID
+       chown -R tor:tor /var/lib/tor /var/ipfire/tor
+fi
+
 extract_files
 restore_backup ${NAME}
 start_service --background ${NAME}
--=20
2.16.4

--===============5596442305241482970==--