From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47154) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dbVav-0006Bi-Jx for guix-patches@gnu.org; Sat, 29 Jul 2017 13:32:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dbVas-0004lm-FC for guix-patches@gnu.org; Sat, 29 Jul 2017 13:32:05 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:58868) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dbVas-0004lT-Aq for guix-patches@gnu.org; Sat, 29 Jul 2017 13:32:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1dbVas-0006HA-56 for guix-patches@gnu.org; Sat, 29 Jul 2017 13:32:02 -0400 Subject: [bug#27870] tor: Remove 'expensive-hardening' option. Resent-Message-ID: Received: from eggs.gnu.org ([2001:4830:134:3::10]:47093) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dbVaP-0006A7-5i for guix-patches@gnu.org; Sat, 29 Jul 2017 13:31:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dbVaL-0004Qb-Ue for guix-patches@gnu.org; Sat, 29 Jul 2017 13:31:33 -0400 Received: from aibo.runbox.com ([91.220.196.211]:44062) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dbVaL-0004Oy-Mb for guix-patches@gnu.org; Sat, 29 Jul 2017 13:31:29 -0400 Received: from [10.9.9.210] (helo=mailfront10.runbox.com) by mailtransmit03.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1dbVaJ-00077o-GG for guix-patches@gnu.org; Sat, 29 Jul 2017 19:31:27 +0200 Received: from tor-exit-4.all.de ([212.21.66.6] helo=localhost) by mailfront10.runbox.com with esmtpsa (uid:892961 ) (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) id 1dbVaD-0002eS-Rw for guix-patches@gnu.org; Sat, 29 Jul 2017 19:31:22 +0200 Date: Sat, 29 Jul 2017 17:31:19 +0000 From: ng0 Message-ID: <20170729173119.e4tq43z72l6jfy74@abyayala> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="7o47mwlnpm5qvklb" Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 27870@debbugs.gnu.org --7o47mwlnpm5qvklb Content-Type: multipart/mixed; boundary="ac3rtmvqhigzxfse" Content-Disposition: inline --ac3rtmvqhigzxfse Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Since no one has vetoed against this, here is my patch to improve tor again. I had no issues in the 9+ days since I've been using it like this (didn't expect any) and only improvement of the current situation with tor. Patch appended. > ng0 writes: >=20 > > I noticed this before the contribution entered master, so this message > > is not really a news. > > > > To quote myself from earlier today: > > > > I think we should revert one piece of the tor hardened build= =2E. 3 hours > > uptime: 684.3 MiB + 753.0 KiB =3D 685.1 MiB tor > > > > Comparison: my Chromium with 55 tabs open uses 2.2GB. > > > > Private + Shared =3D RAM used Program > > =E2=80=A6=20 > > 12.4 MiB + 1.1 MiB =3D 13.4 MiB vim > > 15.5 MiB + 959.0 KiB =3D 16.4 MiB Xorg > > 17.3 MiB + 5.6 MiB =3D 22.9 MiB guix substitute > > 22.8 MiB + 1.3 MiB =3D 24.1 MiB shepherd > > 26.7 MiB + 551.5 KiB =3D 27.3 MiB emacs-25.2 > > 131.1 MiB + 6.2 MiB =3D 137.3 MiB .guix-real > > 732.7 MiB + 932.0 KiB =3D 733.6 MiB tor > > =E2=80=A6 > > uptime: 6:24h > > > > Now I wouldn't consider tor to be problematic when this would be the > > default for tor. But it isn't, and --enable-expensive-hardening is an > > experimental function which is not enabled by default from upstream (as > > all our recently added config options for tor (not sure right now if all > > are experimental, but they are not standard). > > > > Comparison, Debian running for a very long time (months) and using the > > same config: > > > > 40.6 MiB + 486.0 KiB =3D 41.1 MiB tor > > > > > > I'm convinced that removing --enable-expensive-hardening will improve > > the situation, I have watched an VM with tor without this config switch. > > Whoever needs or wants this switch can make use of the easy way to > > create custom packages in Guix. > > > > If someone else can confirm my observations, I'll prepare an patch. >=20 > The top(1) command tells me that tor is taking up just short of a > gigabyte of RAM. I haven't tried disabling the --enable-expensive-hardeni= ng > flag, yet. --=20 ng0 GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588 GnuPG: https://n0is.noblogs.org/my-keys https://www.infotropique.org https://krosos.org --ac3rtmvqhigzxfse Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment; filename="0001-gnu-tor-Remove-enable-expensive-hardening-option.patch" Content-Transfer-Encoding: quoted-printable =46rom 4ae53518a53b668d9ac9d0f85771bb8f8645a4f6 Mon Sep 17 00:00:00 2001 =46rom: ng0 Date: Sat, 29 Jul 2017 17:26:04 +0000 Subject: [PATCH] gnu: tor: Remove '--enable-expensive-hardening' option. * gnu/packages/tor.scm (tor)[arguments]: Remove '--enable-expensive-hardeni= ng' option. --- gnu/packages/tor.scm | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/gnu/packages/tor.scm b/gnu/packages/tor.scm index 314901fa4..1d5a1f161 100644 --- a/gnu/packages/tor.scm +++ b/gnu/packages/tor.scm @@ -2,7 +2,7 @@ ;;; Copyright =C2=A9 2013, 2014, 2015 Ludovic Court=C3=A8s ;;; Copyright =C2=A9 2014, 2015 Mark H Weaver ;;; Copyright =C2=A9 2016, 2017 Efraim Flashner -;;; Copyright =C2=A9 2016, 2017 ng0 +;;; Copyright =C2=A9 2016, 2017 ng0 ;;; Copyright =C2=A9 2017 Tobias Geerinckx-Rice ;;; Copyright =C2=A9 2017 Eric Bavier ;;; Copyright =C2=A9 2017 Rutger Helling @@ -54,8 +54,7 @@ "0hhyb1wil8japynqnm07r1f67w3wdnafdg9amzlrrcfcyq5qim28")))) (build-system gnu-build-system) (arguments - `(#:configure-flags (list "--enable-expensive-hardening" - "--enable-gcc-hardening" + `(#:configure-flags (list "--enable-gcc-hardening" "--enable-linker-hardening"))) (native-inputs `(("python" ,python-2))) ; for tests --=20 2.13.3 --ac3rtmvqhigzxfse-- --7o47mwlnpm5qvklb Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEqIyK3RKYKNfqwC5S4i+bv+40hYgFAll8xmcACgkQ4i+bv+40 hYguhg//Ta8Yk97tcS7gacfCXBq7gbJpW1+M6b9fiq11OZI/4PiNkWKNtdYdsf+3 IgKYiGD7lv6sKFL2REzDs7fcGA+TT9BSUvSe5Ec4Yv+tq5Gg76gH/Gm1pnsHwS+m 7qQEZXWCvPnANjF1g5Hm0Vr4qs5SQ7ovME6O43tSzHHan+tpNOttr0erpFt8sOT1 VOZIv6I+VDFFBHOhNuF1hL3CUoGDYKT+kFPGgPz0WdJCkKpeqW4HAwUYNPqTdGJj bUYNSuLa5BtO7DWMGeaLrUDtZuoUo3GZTiG1UvHsvp7RsCHKV5i/TLyjXLz//KNo 2vZA5asDT8MNJ/GrDEptxQ8YOc9+Uh/XpjuK+pk+uOl2tPqfcWjJdWDSEWrB7oxq bsp/ufIQx8sxOm13bZ9j19PjmIBweYfg/d/eNwWKVFN3c2lkcHwepbVGpNUfDFGE UNJ+BrHI5KFAX2RKbsmDWcEHF092wlEOYA/YfJX5huVbnXKvVxFx/JfQskXYq8u5 64UA8M0XK46kJ1XvrapYzFuPfwOf5CpokI6lF1cY1w+X7RfSXHZguZoDWRasHw/e kW+V/WKUmNQ7ZyndxfoEZ8xlJl0Ypof6Tmqv1xpwyqFo/4Tfuw/KEMZjVW0Xsn32 u6jQ6iffh2wtWo1Rcl0bARZjGsgD1WgXUgoatUx4Ln+esi54cyw= =pyCH -----END PGP SIGNATURE----- --7o47mwlnpm5qvklb--