From: raid5atemyhomework via Guix-patches via <guix-patches@gnu.org>
To: Maxime Devos <maximedevos@telenet.be>
Cc: "47155@debbugs.gnu.org" <47155@debbugs.gnu.org>
Subject: [bug#47155] [PATCH] gnu: Respect DataDirectoryGroupReadable option of tor.
Date: Mon, 15 Mar 2021 23:42:41 +0000 [thread overview]
Message-ID: <F6piizM-xkOFPmiVpRTgsQ2A1lGvyuJjBkIzKQfRiM4bHKdLgX0937TDZ7yi75MDFPbQz2ypAY2PIQNrYPRr2jAdULbE2zqiU1_RaifSp-A=@protonmail.com> (raw)
In-Reply-To: <e44fda4f60e6d14124041fcf0ecf14eca3062197.camel@telenet.be>
> On Mon, 2021-03-15 at 11:15 +0000, raid5atemyhomework via Guix-patches via wrote:
>
> > Currently, if you set DataDirectoryGroupReadable 1 in your torrc,
>
> What are the reasons for setting DataDirectoryGroupReadable 1?
>
When using cookie-based authentication, the cookie file is traditionally placed in the data directory. If the directory is not accessible from group, then only the `tor` user can access the cookie and control `tor`. With this option, the cookie can be accessed by members of the `tor` group.
> > it will be respected only if tor is started up.
>
> IIUC, tor will adjust the permissions of the directory to make it
> group readable (while Guix' activation code creates the directory
> group-unreadable).
Correct. However, when doing a `guix system reconfigure`, the activation code will be called again, which changes the directory back to group unreadable, without restarting tor. `tor` itself will only set the permissions when it starts up, and will ignore the permissions while running.
>
> > If you reconfigure your OS without restarting the tor service,
> > the directory permissions are reset due to the activation code being
> > re-run and resetting the directory permissions.
> > This change simply does not chmod if the directory already exists.
>
> I believe it would be more transparent to introduce a
> (data-directory-group-readable? #t/#f), with #f as default,
> to tor-configuration (adjusting tor-configuration->torrc)
> and change the permission bits passed to chmod appropriately.
>
> (Documentation & reproducible system configuration & one integrated
> system (in the software sense) and all that)
Possibly.
Thanks
raid5atemyhomework
next prev parent reply other threads:[~2021-03-15 23:47 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-15 11:15 [bug#47155] [PATCH] gnu: Respect DataDirectoryGroupReadable option of tor raid5atemyhomework via Guix-patches via
2021-03-15 16:35 ` Maxime Devos
2021-03-15 23:42 ` raid5atemyhomework via Guix-patches via [this message]
2021-03-27 6:37 ` raid5atemyhomework via Guix-patches via
2021-03-27 9:45 ` Maxime Devos
2021-03-27 11:06 ` raid5atemyhomework via Guix-patches via
2021-03-27 12:13 ` Maxime Devos
2021-07-23 15:07 ` raid5atemyhomework via Guix-patches via
2022-12-27 11:52 ` Jean Pierre De Jesus DIAZ via Guix-patches via
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='F6piizM-xkOFPmiVpRTgsQ2A1lGvyuJjBkIzKQfRiM4bHKdLgX0937TDZ7yi75MDFPbQz2ypAY2PIQNrYPRr2jAdULbE2zqiU1_RaifSp-A=@protonmail.com' \
--to=guix-patches@gnu.org \
--cc=47155@debbugs.gnu.org \
--cc=maximedevos@telenet.be \
--cc=raid5atemyhomework@protonmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.