From: Tobias Geerinckx-Rice via Bug reports for GNU Guix <bug-guix@gnu.org>
To: 57222@debbugs.gnu.org
Subject: bug#57222: Guix Tor service needs a little more authority
Date: Mon, 15 Aug 2022 13:15:30 +0200 [thread overview]
Message-ID: <87sflxhg98.fsf@nckx> (raw)
[-- Attachment #1: Type: text/plain, Size: 924 bytes --]
Hi all,
I recently found my Tor nodes dead, unable to bind to their port
with a confusing ‘permission denied’ error.
This was caused by a regression in Guix's Tor service: it now uses
‘least-authority-wrapper’, meaning that it… well, hasn't the
authority to bind to all ports. Oops.
Even today, (some, well-known) low ports are firewalled/flagged
noticeably less than higher ones. Thankfully, DPI isn't the norm
yet.
Reverting commit fb868cd7794f15e21298e5bdea996fbf0dad17ca fixes
this.
Our service wasn't insecure before: Tor expects to be started as
root and drop privileges through the torrc ‘User’ directive, not
the way Guix now does it through namespaces.
Still, I'll take a stab at relaxing the service's POLA parameters
to allow this, hoping to get the best of both worlds, but this is
new territory to me. Maybe that's not possible.
Kind regards,
T G-R
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]
reply other threads:[~2022-08-15 11:57 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87sflxhg98.fsf@nckx \
--to=bug-guix@gnu.org \
--cc=57222@debbugs.gnu.org \
--cc=me@tobias.gr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.