[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-dev] what capabilities does tor need for reloading?

To: tor-dev@xxxxxxxxxxxxxxxxxxxx
Subject: [tor-dev] what capabilities does tor need for reloading?
From: Nusenu <nusenu@xxxxxxxxxxxxxxx>
Date: Wed, 18 Mar 2015 10:15:28 +0000
Delivered-to: archiver@xxxxxxxx
Delivery-date: Wed, 18 Mar 2015 06:15:52 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/simple; d=openmailbox.org; h=content-transfer-encoding:content-type:content-type:subject :subject:mime-version:from:from:date:date:message-id:received; s=openmailbox; t=1426673736; bh=VLDwzDiGZcygl1nhgpk8O9tOGh09hfB oWwhchdHsvo4=; b=LP/3EALPOIWVn+xDNIRWXj4O/GAYpwpdXkUhgBpsVFTRH5Y YK62MKtozXCqrQbii7u/xCdUY8zijmcURg4qfpDlbnQw1QD6vf1TA1COAdKCvjsH rfnLq0GA9mZh/dvb1UqbvQF0SoSKHpnWsiYuFEhj74RjUGzVn1FZ6LdSewWg=
List-archive: <http://lists.torproject.org/pipermail/tor-dev/>
List-help: <mailto:tor-dev-request@lists.torproject.org?subject=help>
List-id: discussion regarding Tor development <tor-dev.lists.torproject.org>
List-post: <mailto:tor-dev@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev>, <mailto:tor-dev-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-dev>, <mailto:tor-dev-request@lists.torproject.org?subject=unsubscribe>
Reply-to: tor-dev@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-dev" <tor-dev-bounces@xxxxxxxxxxxxxxxxxxxx>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

'systemctl reload tor'
fails due to hardening restrictions in tor's systemd service file [1]:

CapabilityBoundingSet = CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE

Removing that line "solves" the reload issue.
Reloading with that line does not generate any tor debug loglines.

What capability would one have to add to the list to make it work with
CapabilityBoundingSet?

thanks,
Nusenu

testing with: tor 0.2.6.4, jessie/systemd 215


[1]
https://gitweb.torproject.org/tor.git/tree/contrib/dist/tor.service.in#n26
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJVCVA7AAoJEFv7XvVCELh0bWIQAKfDZdhwrcWzwOHEP/o3FMoa
BTkMxjHdEDezlaHd61/XWHC1cYNOi6kqe/xGL1HRMtDwl09tbn3lq0Vty9P9hBP5
ucLaS1Izz0w7VprEd4ZK+/G4pV8Ht6Kjd7LSaV8RsjdCfK9g5WaI/IDIVGbYKUnC
NVJxY+XCxZsvMmkfCUo1un6yZ/p0eQEfksDwtDvf7EupIy3o5wYJhM1bcvVzm/3H
UenP8t8VBb7TVOBRuZUyMzS173db/SKp2tY1IOiUktzyJqzzck8gPJvQ4l8DoeqM
E2yVr+Qvex/IXRx379sJTyBJt9xthC9BS91uUJA0G3dbYVSvRoUN5XDjaqYztSN3
ctkjT3cocLDu43EslGo/Egh+xWTMdnTvcaTIoLkD5IN4FWu3IrjWnG0gOOyNyPf5
F4UfCty5xn9ztb0y7Zf2GOliR9CnkSB8PIuMt4ManvrMGOwYPZw1KsGsc49UYadn
XhEUj1uzf3FBZw2LmbiBR5lNGX2WanWt83EwkiH03MsBkouD60+D/RJ5UQ8pVEwm
JHLBqbT2GtBCda3OIPec1kdh3P5TFF+aN9aC1HkVsYRwoUJtIjxPg3wkrOVCU4VF
ZJVbqlVuJQn8/3GnphkQgt+jJqTl3b4Ttksu+omGJgYU2Wu42VNFvCFraeQ75q4J
D1NinH/G/3I3KBYP+JNu
=/eJ6
-----END PGP SIGNATURE-----
_______________________________________________
tor-dev mailing list
tor-dev@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev

Follow-Ups:
- Re: [tor-dev] what capabilities does tor need for reloading?
  - From: Nick Mathewson
- Re: [tor-dev] what capabilities does tor need for reloading?
  - From: Nusenu

Prev by Author: Re: [tor-dev] #14995: adding multi-instance support to debian packages
Next by Author: Re: [tor-dev] what capabilities does tor need for reloading?
Previous by thread: Re: [tor-dev] What's the explanation for weekly cycles in user graphs?
Next by thread: Re: [tor-dev] what capabilities does tor need for reloading?
Index(es):
- Author
- Thread