[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #23963 [Applications/Tor Browser]: Tor Browser can use a Tor that's running under another user
#23963: Tor Browser can use a Tor that's running under another user
--------------------------------------+--------------------------
Reporter: teor | Owner: tbb-team
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
--------------------------------------+--------------------------
Comment (by yawning):
Replying to [comment:2 mcs]:
> I do not know of a way to ensure that the SOCKSPort is "trusted" except
to switch to Unix domain sockets (which is possible via hidden prefs
inside Tor Browser).
Beyond what's done now (Query `net/listeners/socks` over the command
port), probably not much without patching tor.
> I am also not sure how Tor Browser can tell the difference between "I am
using a system Tor which is what the user wants" and "I am using a
leftover Tor that was possibly started by another user."
Getting Tor Browser to use a system tor requires a bunch of env vars to be
set to suppress launching the tor instance.
> I think the argument will be "If Tor Browser is configured to start tor,
it should only use the tor that it starts" (which seems reasonable but may
be difficult to implement).
`SO_PASSCRED` and `SCM_CREDENTIALS` makes this trivial on sensible
systems.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23963#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs