[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-dev] tor not starting with NoNewPrivileges = yes (systemd)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hello Zack,
thanks for your answer.
Zack Weinberg:
> Could you please put
>
> Log debug /tmp/tor-startup.log
I had:
>> Log debug file /var/log/tor/log
but it is not being written to.
(I disabled ExecStartPre for now).
> in your torrc, try to start the daemon with NoNewPrivileges=yes,
> and then post the contents of /tmp/tor-startup.log ? We need to
> know exactly how it's failing. (We might actually need you to run
> it under `strace`, even.)
It is a bit tricky environment to run strace, how would you go about it?
If anyone wants to try here is the unit file:
(use it with the torrc file from the initial email)
- ------------------------------------
[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target
[Service]
Type = simple
#ExecStartPre = /usr/bin/tor -f /etc/tor/torrc --verify-config
ExecStart = /usr/bin/tor -f /etc/tor/torrc --runasdaemon 0
ExecReload = /bin/kill -HUP ${MAINPID}
KillSignal = SIGINT
TimeoutSec = 30
Restart = on-failure
WatchdogSec = 1m
LimitNOFILE = 32768
# Hardening
PrivateTmp = yes
ReadOnlyDirectories = /
ReadWriteDirectories = /var/lib/tor
ReadWriteDirectories = /var/log/tor
NoNewPrivileges = yes
CapabilityBoundingSet = CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE
# not supported in wheezy-backports (systemd 204)
#PrivateDevices = yes
#ProtectHome = yes
#ProtectSystem = full
[Install]
WantedBy = multi-user.target
- ------------------------------------
-----BEGIN PGP SIGNATURE-----
iQIcBAEBCgAGBQJVCFyHAAoJEFv7XvVCELh0WlEP/RvKP1vfHfCWVikDg7Cnk3gN
h1MB7l5/blHHC25PRwXYBWaMWa2ZxZ6mjYtpEnWOXt9o83GBFIeL36a29HZb/kR+
YtVIJT4xoQDSidqRrhuwDtafIsKa4CaigPG9ugyCpRRRNPlIbGvN82KX/H39gKsv
IrL8KxNL1i4PqqGMPNZQfJjYAWBYxO6NdGAm4G86KKaTFEeFt3Zb2LDoxeGVrB/R
kudYokCuT8aIz8tQWTaVLm4KPgp967AXunaICFKxZ4yqEuIxvAz9njUTAMPuPFWN
gS30iwdJ1jX9ZQKup8HQ2i6SKo2hYrfmxZbxA9mjnHXo2viYgnLRc3qtOLGyG1ru
Sy9SlDrT496qEbD0yPVhoegrF4YMTkMAuHys1PJeTqP4CN3ZiNHSmEIkXlWHdHSr
vYM/WZV4Snxh1c5qXu0JIvVGQH0e94XvC6Fh0/TQdk11YN9ZvJCQXGuP1Nao5NCj
5rzkemaB6SHLewQ3GiOi7bbiYEOTFqp+Sd5uVsraDKfHkawmaJuhTUm9UQgs90Rq
N9ayn4U9P4N0GoY4ANDLJz3IQm48OUID4TISpuL5Kdda7sfjmu8KyRL/ydZArLuL
raMNKSN0FPuw5Dw7UxiO1rBh/6vSMdMAU1VVBnMsq/eKsVLCzITke3/niowrx4hx
4eFuD2gDTXfymaKpsW0n
=OF1X
-----END PGP SIGNATURE-----
_______________________________________________
tor-dev mailing list
tor-dev@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev