bug#70332: Tor daemon is unable to use obfuscation

bug#70332: Tor daemon is unable to use obfuscation

[nigko]

I have found why it is not working! Tor process is simply not allowed to 
have access to the obfuscator binary because it is running inside all 
Linux namespaces except "net", in particular in "mnt" namespace. We need 
to add path/to/obfuscator/binary to the #:mappings field of the 
least-authority-wrapper call inside tor-shepard-service body in 
/gnu/service/networking.scm. I have checked, this makes obfuscation 
fully functional.


Regards,
Nigko Yerden


> Hello Guix!
> 
> I am trying to configure tor daemon to use traffic obfuscation by the following lines in my system configuration
> 
> 
> (service tor-service-type
>         (tor-configuration
>            (plain-file "torrc"
> "
> UseBridges 1
> ClientTransportPlugin obfs4 exec /path/to/obfuscator/binary
> 
> Bridge obfs4 ......
> Bridge obfs4 ......
> ")))
> 
> where /path/to/obfuscator/binary corresponds to an obfs4 obfuscator. There are a few of them in the guix repo, see e.g. go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-lyrebird or go-github-com-operatorfoundation-obfs4 packages. The obfuscator is also installed in the system profile. Bridges are gotten from the official site https://bridges.torproject.org/.
> 
> 
> This torrc configuration works perfectly on guix when tor run at user level by command '$ tor -f path/to/torrc' and '# netstat -tupan' shows obfuscator process is listening on 127.0.0.1:[some random port].
> 
> 
> However, when tor run as system daemon, there are no obfuscator process listening and tor is unusable.
> 
> 
> Perhaps this issue is related to https://issues.guix.gnu.org/57222.
> 
> I have tried to revert commit fb868cd7794f15e21298e5bdea996fbf0dad17ca on recent guix checkout and then to perform 'guix pull --url=/path/to/my/local/guix/repo --disable-authentication'. It worked fined. But when performing 'sudo guix system reconfigure /path/to/system/configuration' I got an error 'make-forkexec-constructor/container: unbound variable'
> 
> 
> 
> Regards,
> Nigko Yerden
> 
> 
> 
>