From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH 2/2] run Tor under dedicated user
Date: Tue, 12 Mar 2019 14:57:05 +0000
Message-ID: <A47DB1B6-AE2D-495E-82D5-DCFF97E1F1AE@ipfire.org>
In-Reply-To: <3337d646-c173-ed7f-d04f-46fe92c398cd@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2057328125061131974=="
List-Id: <development.lists.ipfire.org>

--===============2057328125061131974==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi,

There is a problem in the script:

> On 11 Mar 2019, at 20:07, Peter M=C3=BCller <peter.mueller(a)ipfire.org> wr=
ote:
>=20
> This allows more-fine granular firewall rules (see first patch for
> further information). Further, it prevents other services running as
> "nobody" (Apache, ...) from reading Tor relay keys.
>=20
> Fixes #11779.
>=20
> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
> ---
> lfs/tor                 |  6 +++---
> src/paks/tor/install.sh | 15 ++++++++++++++-
> 2 files changed, 17 insertions(+), 4 deletions(-)
>=20
> diff --git a/lfs/tor b/lfs/tor
> index 384b1b213..2b0e0903a 100644
> --- a/lfs/tor
> +++ b/lfs/tor
> @@ -32,7 +32,7 @@ DL_FROM    =3D $(URL_IPFIRE)
> DIR_APP    =3D $(DIR_SRC)/$(THISAPP)
> TARGET     =3D $(DIR_INFO)/$(THISAPP)
> PROG       =3D tor
> -PAK_VER    =3D 34
> +PAK_VER    =3D 35
>=20
> DEPS       =3D ""
>=20
> @@ -82,8 +82,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
> 			--prefix=3D/usr \
> 			--sysconfdir=3D/etc \
> 			--localstatedir=3D/var \
> -			--with-tor-user=3Dnobody \
> -			--with-tor-group=3Dnobody
> +			--with-tor-user=3Dtor \
> +			--with-tor-group=3Dtor
>=20
> 	cd $(DIR_APP) && make $(MAKETUNING)
> 	cd $(DIR_APP) && make install
> diff --git a/src/paks/tor/install.sh b/src/paks/tor/install.sh
> index 31c5fecae..e1ed33331 100644
> --- a/src/paks/tor/install.sh
> +++ b/src/paks/tor/install.sh
> @@ -17,11 +17,24 @@
> # along with IPFire; if not, write to the Free Software                    #
> # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
> #                                                                          #
> -# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>.                     =
   #
> +# Copyright (C) 2007-2019 IPFire-Team <info(a)ipfire.org>.                =
   #
> #                                                                          #
> ############################################################################
> #
> . /opt/pakfire/lib/functions.sh
> +
> +# Run Tor as dedicated user and make sure user and group exist
> +if ! getent group tor &>/dev/null; then
> +       groupadd -g 119 tor
> +fi
> +
> +if ! getent passwd tor; then
> +       useradd -u 119 -g tor -d /var/empty -s /bin/false tor
> +
> +       # Adjust some folder permission for new UID/GID
> +       chown -R tor:tor /var/lib/tor /var/ipfire/tor

You are only changing these directories when the user is being created.

If the add-on is uninstalled and later installed again the files will have th=
e wrong owner because they are created as somebody else in the build process.

So the chown line should be in the build process. The user should also be put=
 into /etc/passwd and /etc/group so that it is always present on all systems =
as well as during the build process to assign correct ownership of the those =
directories.

-Michael

> +fi
> +
> extract_files
> restore_backup ${NAME}
> start_service --background ${NAME}
> --=20
> 2.16.4


--===============2057328125061131974==--