From patchwork Mon Mar 15 11:15:36 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: raid5atemyhomework X-Patchwork-Id: 27700 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id E14E127BC54; Mon, 15 Mar 2021 11:16:15 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, SPF_HELO_PASS,T_DKIM_INVALID,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id A24E227BC52 for ; Mon, 15 Mar 2021 11:16:15 +0000 (GMT) Received: from localhost ([::1]:35686 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lLlCo-0004Jz-R0 for patchwork@mira.cbaines.net; Mon, 15 Mar 2021 07:16:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:34398) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lLlCd-0004Iy-3Y for guix-patches@gnu.org; Mon, 15 Mar 2021 07:16:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:51645) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lLlCc-00052H-Rg for guix-patches@gnu.org; Mon, 15 Mar 2021 07:16:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1lLlCc-0001E2-Nj for guix-patches@gnu.org; Mon, 15 Mar 2021 07:16:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#47155] [PATCH] gnu: Respect DataDirectoryGroupReadable option of tor. Resent-From: raid5atemyhomework Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 15 Mar 2021 11:16:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 47155 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 47155@debbugs.gnu.org X-Debbugs-Original-To: Guix Patches Received: via spool by submit@debbugs.gnu.org id=B.16158069534691 (code B ref -1); Mon, 15 Mar 2021 11:16:02 +0000 Received: (at submit) by debbugs.gnu.org; 15 Mar 2021 11:15:53 +0000 Received: from localhost ([127.0.0.1]:34958 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lLlCT-0001Da-1O for submit@debbugs.gnu.org; Mon, 15 Mar 2021 07:15:53 -0400 Received: from lists.gnu.org ([209.51.188.17]:36822) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lLlCQ-0001DR-W6 for submit@debbugs.gnu.org; Mon, 15 Mar 2021 07:15:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:34350) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lLlCQ-00046s-OX for guix-patches@gnu.org; Mon, 15 Mar 2021 07:15:50 -0400 Received: from mail-40138.protonmail.ch ([185.70.40.138]:26729) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lLlCO-0004r6-In for guix-patches@gnu.org; Mon, 15 Mar 2021 07:15:50 -0400 Date: Mon, 15 Mar 2021 11:15:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail; t=1615806944; bh=O7QFE32VxVWAhPys/8DlwmSwWUZ7QJD1DdoFdoAJ/vU=; h=Date:To:From:Reply-To:Subject:From; b=oa+UWsBaBrn4zGjmRJ63o1z7EK47llWugOl8YB2r1x1cByz/xolXJwKuEeAe5jwgt Wp2OGuAlgqxZoPbZjAdFeme6cAouBYmo9n/XttLFZw3CeBYLdlWBsXmtUtp52JRok3 P9c7tEPbWmv5ZynjVyWy0yngGNOM/A8CI38myqBA= Message-ID: MIME-Version: 1.0 Received-SPF: pass client-ip=185.70.40.138; envelope-from=raid5atemyhomework@protonmail.com; helo=mail-40138.protonmail.ch X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" Reply-to: raid5atemyhomework X-ACL-Warn: , raid5atemyhomework via Guix-patches X-Patchwork-Original-From: raid5atemyhomework via Guix-patches via From: raid5atemyhomework X-getmail-retrieved-from-mailbox: Patches Currently, if you set DataDirectoryGroupReadable 1 in your torrc, it will be respected only if tor is started up. If you reconfigure your OS without restarting the tor service, the directory permissions are reset due to the activation code being re-run and resetting the directory permissions. This change simply does not chmod if the directory already exists. Thanks raid5atemyhomework From d6037c59e642eaafebe43996e7419e1b58fee616 Mon Sep 17 00:00:00 2001 From: raid5atemyhomework Date: Mon, 15 Mar 2021 19:10:01 +0800 Subject: [PATCH] gnu: Respect DataDirectoryGroupReadable option of tor. * gnu/services/networking.scm (tor-activation): Do not change permissions of tor data directory if it already exists. --- gnu/services/networking.scm | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index 231a9f66c7..65d2d39f0b 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -881,10 +881,16 @@ HiddenServicePort ~a ~a~%" ;; of the "tor" group will be able to use the SOCKS socket. (chmod "/var/run/tor" #o750) - ;; Allow Tor to access the hidden services' directories. - (mkdir-p "/var/lib/tor") + ;; If the directory already exists, do not chmod it again; the user + ;; might have set "DataDirectoryGroupReadable 1" in the torrc. + ;; Without this check, a `guix system reconfigure` will cause the + ;; directory to lose group permissions until Tor is restarted, even + ;; if changes to the operating-system were unrelated to Tor. + (unless (file-exists? "/var/lib/tor") + (mkdir-p "/var/lib/tor") + ;; Allow only Tor and root to access the hidden services' directories. + (chmod "/var/lib/tor" #o700)) (chown "/var/lib/tor" (passwd:uid %user) (passwd:gid %user)) - (chmod "/var/lib/tor" #o700) ;; Make sure /var/lib is accessible to the 'tor' user. (chmod "/var/lib" #o755)