I had a conversation about this on OFTC #tor:
<ketyn> Is it intended that tor doesn't set supplementary groups when starting
as root and then doing setgid? This describes my issue:
https://tor.stackexchange.com/questions/23225/tor-cant-read-hiddenserviceport-unix-socket-through-group-permissions-when-star
<ketyn> I see many threads on the internet of people claiming that tor unix
socket permissions aren't working for them and while sometimes it turns out to
be apparmor/SELinux, I think this might be biting other people too
<ketyn> I think significant numbers of people might just be giving up and
making their unix socket globally readable, or switching to numbered port based
sockets rather than unix domain sockets.
<arma> ketyn: we had a series of security surprises in the past with how we did
groups and dropping privs,
<arma> and we settled on what we do now as the safest option
<ketyn> Alright, I guess I'll need to either make the sockets tor listens to
owned by the tor user, or use socat to forward. Maybe there's a documentation
fix to apply here though.
<ketyn> tor forwards to*
<bentham> ketyn: What are you doing that would make that necessary?
<bentham> Is the default not working for you for some reason?
<bentham> Also, which socket(s) is(are) causing issues for you? Is it
something in /run/tor?
<ketyn> I want to make a tor hidden service listening to port 25, connected to
a socket at /var/spool/postfix-test/public/smtpd owned by the user postfix-queue
<ketyn> According to postfix, I'm then supposed to add whatever user I want to
read to that socket to the group postfix-queue
<arma> ketyn: hmmm
<arma> for the control socket see the GroupWritable flags
<arma> ControlSocket /run/tor/control GroupWritable RelaxDirModeCheck
<arma> ControlSocketsGroupWritable 1
<arma> this is how you can add your username to the tor group and then have
permissions to connect with a controller
<ketyn> This is not a control socket. This is a hidden service. e.g.
HiddenServicePort 25 unix:/var/spool/postfix-test/public/smtpd
<arma> i don't think anybody has built something similar for the onion service
lines
<arma> but i think that tor is not dropping the groups, it simply is not
letting you use the group permission there
<ketyn> I want to be able to receive email over a hidden service. Like in
https://github.com/ehloonion/onionmx
<ketyn> > <arma> but i think that tor is not dropping the groups, it simply is
not letting you use the group permission there
<ketyn> Huh, ok.
<arma> i say that because being in the group, for the control port, does work
<arma> so it's not like the group got dropped
<arma> check out the UnixSocksGroupWritable config option
<arma> maybe it will help what you want
<bentham> ketyn: Out of curiosity, why is your smtpd listening on a socket
rather than, say, 127.0.0.1:25?
<arma> looks like no, it won't do what you want, because UnixSocksGroupWritable
doesn't apply to hiddenservice lines
<ketyn> bentham: Because it seems more secure and means I don't have to worry
about port conflicts or firewalls, and deploy this setup to computers I don't
have full control over.
<ketyn> Here's another good reason I saw:
https://github.com/freedomofpress/securedrop/issues/1261
<ketyn> "because applications sometimes (fairly) assume that localhost has a
different threat model than an externally exposed service. Most recently, this
common configuration lead to some hidden services exposing sensitive
information through the Apache mod_status module"
...
<arma> actually arma said "just barely possible that the network team would
take a good patch"
<arma> not quite the same as "probably not take"
<arma> but yes, more generally, there is vast confusion about what permissions
are *supposed* to be, what groups happen by default in debian/ubuntu, what the
SELinux and Apparmor policies do, etc
<arma> i think most people are probably doing it wrong but i don't even know
what right is
<arma> i end up putting all my onion service directories in /tmp/ so they work,
and that cannot at all be right
I also asked on stackexchange:
https://tor.stackexchange.com/questions/23225/tor-cant-read-hiddenserviceport-unix-socket-through-group-permissions-when-star/23226
------- Original Message -------
On Tuesday, July 5th, 2022 at 5:30 AM, keyandthegate via tor-dev
<tor-dev@lists.torproject.org> wrote:
> Permissions are set so tor should be able to access through the
> `postfix-test-queue` user:
>
>> $ sudo ls -l /var/spool/postfix-test/public/smtpd
>> srw-rw-rw- 1 postfix-test postfix-test 0 █████
>> /var/spool/postfix-test/public/smtpd
>> $ sudo ls -l /var/spool/postfix-test
>> # ...
>> drwx--x--- 2 postfix-test postfix-test-queue 4096 █████ public
>> $ sudo -u _tor-test id
>> uid=130(_tor-test) gid=141(_tor-test)
>> groups=141(_tor-test),1006(postfix-test-queue)
>> $ cat /etc/tor/instances/test/torrc | grep HiddenServicePort
>> HiddenServicePort 25 unix:/var/spool/postfix-test/public/smtpd
>> $ cat /run/tor-instances/test.defaults | grep User
>> User _tor-test
>
> Running `tor@test` via the default systemctl config shows:
>
>> $ ps -ax -o uid,gid,supgid,command | grep /usr/bin/tor
>> 130 141 141 /usr/bin/tor --defaults-torrc /run/tor-instances/test.defaults
>> -f /etc/tor/instances/test/torrc
>
> Which is missing the `postfix-test-queue` `1006` user which, for example
> shows up if I do:
>
>> $ sudo -u _tor-test sleep 1000 & ps -ax -o uid,gid,supgid,command | grep
>> sleep
>> [1] 132314
>> 0 141 141,1006 sudo -u _tor-test sleep 1000
>
> Connecting using `sudo -u` works (the message indicates successful
> connection):
>
>> $ sudo -u _tor-test curl --unix-socket /var/spool/postfix-test/public/smtpd
>> http://localhost
>> curl: (1) Received HTTP/0.9 when not allowed
>
> But connecting via tor does not:
>
>> $ torsocks --ipv6 curl http://█████.onion:25
>> █████ ERROR torsocks[134873]: Host unreachable (in
>> socks5_recv_connect_reply() at socks5.c:539)
>> curl: (7) Couldn't connect to server
>
> But does if I allow access to the socket to everyone:
>
>> $ sudo chmod "o+x" /var/spool/postfix-test/public/
>> $ torsocks --ipv6 curl http://█████.onion:25
>> curl: (1) Received HTTP/0.9 when not allowed
>
> Tor's relevant source code: [Tor: lib/process/setuid.c Source
> File](https://tpo.pages.torproject.net/core/doc/tor/setuid_8c_source.html)
_______________________________________________
tor-dev mailing list
tor-dev@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
