[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: Tor TransPort on OpenBSD?
- To: or-talk@xxxxxxxxxxxxx
- Subject: Re: Tor TransPort on OpenBSD?
- From: Christopher Davis <loafier@xxxxxxxxx>
- Date: Sun, 10 Aug 2008 19:30:52 -0700
- Delivered-to: archiver@xxxxxxxx
- Delivered-to: or-talk-outgoing@xxxxxxxx
- Delivered-to: or-talk@xxxxxxxx
- Delivery-date: Sun, 10 Aug 2008 22:31:02 -0400
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:subject :message-id:references:mime-version:content-type:content-disposition :in-reply-to:user-agent; bh=Ya3AdYzOXLhwUIkVXeC9yVBSutpe74JbzWI0HIU0DCg=; b=nZf1mNJGhAGxZfZnmiHQou7QcKXeODNAAWOVM0Ayh1LCdaf2JpFhq8AxTV4NzRt5QQ eVFikcMUQZf8Yfwo/5xb/RHQSLoU0lBHoMkCkOMG1Q38pbgoRSqv97Ik9P6L4i6l7PDR XLqIXOV6coQxJVfLIKb7nZ1zIZVj631bYajxA=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; b=ONndbEtEcokNDKIO8lgyumt2ugkaMRNA3YsBx56hYwGBMaSlddibG4VFtxIse4oZMZ TDfRv3l8RjAa7jyEPJpaO6par9Nz7RJDWdW8KNyAs3BUm7SjOweNQGjumaUuQhPU1qJd i53bJvf0nyV8l1lrZNHH0WhbZKLi+6mCt+v6Y=
- In-reply-to: <20080810230743.GA10094@xxxxxxxxxxxxxxxxxxx>
- References: <200808102255.m7AMtx2G011780@xxxxxxxxxxxxx> <20080810230743.GA10094@xxxxxxxxxxxxxxxxxxx>
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-talk@xxxxxxxxxxxxx
- User-agent: Mutt/1.4.2.3i
On Mon, Aug 11, 2008 at 01:07:43AM +0200, Hannah Schroeter wrote:
> Hi!
>
> On Sun, Aug 10, 2008 at 05:55:59PM -0500, Scott Bennett wrote:
>
> > Perhaps OpenBSD works differently in this regard, but in FreeBSD the
> >above will only last until the next reboot because the /dev directory is
> >cleared and repopulated during initialization according to the devices
> >found during kernel autoconfiguration. To make such changes each time
> >the system boots, IIRC, one must make the appropriate changes to
> >/boot/device.hints (see device.hints(5)).
>
> OpenBSD has classical MAKEDEV style handling of /dev. However,
> non-standard protections might be clobbered when you upgrade.
>
> A better fix would indeed be opening /dev/pf before dropping privileges.
> And the gold standard would be separating /dev/pf operations out into a
> separate process, that drops root anyway, but keeps the /dev/pf file
> descriptor and offers only those /dev/pf operations to the main process
> that are really needed instead of making *all* /dev/pf operations
> available to the main process. (Privilege separation.)
>
> Kind regards,
>
> Hannah.
On FreeBSD, you can also put Tor in a jail with a high securelevel
to disable operations on /dev/pf that would alter the rules, while
permitting read operations, like DIOCNATLOOK. FreeBSD does allow
per-jail securelevel settings, independent of the host's level.
--
Christopher Davis