[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-dev] what capabilities does tor need for reloading?

To: tor-dev@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-dev] what capabilities does tor need for reloading?
From: Nusenu <nusenu@xxxxxxxxxxxxxxx>
Date: Wed, 18 Mar 2015 12:58:42 +0000
Delivered-to: archiver@xxxxxxxx
Delivery-date: Wed, 18 Mar 2015 09:24:01 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/simple; d=openmailbox.org; h=content-transfer-encoding:content-type:content-type :in-reply-to:references:subject:subject:mime-version:from:from :date:date:message-id:received; s=openmailbox; t=1426683532; bh= FM3Gc6ZFY+9t//zHEYdgpEY2wtbgWU+458CVCfTZt3A=; b=uosRo6JB7CQx967q wTLrXPjf7mAWCULb2i9lLhcSMObHxQeWY/amc3zoeQKTeqN+CqGCvzP4JWCZ9iqc sODWvEMglhMjX28Fu1koEecKhIbS4+1fwJR3nLUFDNUu8RcshynY8PN4T1T8H4GV kV364h9gCBwGI7f6ke6qAlQZ+QU=
In-reply-to: <55095040.1040506@xxxxxxxxxxxxxxx>
List-archive: <http://lists.torproject.org/pipermail/tor-dev/>
List-help: <mailto:tor-dev-request@lists.torproject.org?subject=help>
List-id: discussion regarding Tor development <tor-dev.lists.torproject.org>
List-post: <mailto:tor-dev@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev>, <mailto:tor-dev-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-dev>, <mailto:tor-dev-request@lists.torproject.org?subject=unsubscribe>
References: <55095040.1040506@xxxxxxxxxxxxxxx>
Reply-to: tor-dev@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-dev" <tor-dev-bounces@xxxxxxxxxxxxxxxxxxxx>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

> 'systemctl reload tor' fails due to hardening restrictions in tor's
> systemd service file [1]:
> 
> CapabilityBoundingSet = CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE

This configuration restricts not only the service (tor) but also the
ExecReload commands (kill), so the somewhat obvious fix was to add
"CAP_KILL".
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJVCXaCAAoJEFv7XvVCELh0tdQP/2EVKAnufPJ2eJa2j5LyT8oA
h0t0jsNZ19C9bbJMXsZhuzS97wtMzqWisWwKbtErdbtatoqXE2ZwL8+hnfTQ7mhQ
O4b3tUZftUpKAaKvI49/Z1VmtbtWouuQu94ucKhPmi2K3RspQDmuSQSmqQiFo9xx
wSBaak2DneRpNcMYlOLc4JN2VLLcsub/fKL8vW/cO63z5n87NmbAkGrcWCIfCyx8
YBu9VTijmWRvzEkPqcMmBa58R2yOBc5I7BSOPD8R4sTlotbE4CSipciHr/ja+G2Y
34K3yaVnCDI+lpGU0YVY3nLyTg/u/izjIG8zFodsOJh9NXBB40nDLbBm88sxjuhL
gctzuV4AvC6rkQ7aWNRLQeFaxaeHoCa2EvvAS3rM1QTC+RVB+HNiiz4DA3wHuz7s
arOu93GDhO7ix7+r9g1Uje1X2S5vKqhSNshx1pHVd/aRyDq7lCBgvBu6574FDuT/
T328b1hA0au7mU0LSOXofMEWZHSNYnYEdtAG2kRdBKmeeIa4IlawXxA+kAnx0D1/
QC4OvtE5DhLhnD7BPirHSCC8ju65d2LlpdjD4DER5+p27j83rwi0myIXM1/oD2CO
d9lBTGyyc/sHfwRU7NkcXl5RWDq8IMDcbT8LLFdbQR0PYLGrSs5yvy9HXT/A5VMb
TJKcrOXxblb3SRzlGSjr
=i8ta
-----END PGP SIGNATURE-----
_______________________________________________
tor-dev mailing list
tor-dev@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev

Follow-Ups:
- Re: [tor-dev] what capabilities does tor need for reloading?
  - From: Nusenu

References:
- [tor-dev] what capabilities does tor need for reloading?
  - From: Nusenu

Prev by Author: Re: [tor-dev] what capabilities does tor need for reloading?
Next by Author: [tor-dev] compass: new group by options: by-contact, by-OS, by-version
Previous by thread: Re: [tor-dev] what capabilities does tor need for reloading?
Next by thread: Re: [tor-dev] what capabilities does tor need for reloading?
Index(es):
- Author
- Thread