- tor-commits - lists.torproject.org

[tor/master] Introduce DataDirectoryGroupReadable boolean
by nickm＠torproject.org 11 Dec '15

11 Dec '15

commit ec4ef68271ab65b4ec643088153211e861cdc7b3 Author: Jamie Nguyen <j(a)jamielinux.com> Date: Fri Nov 13 14:18:26 2015 +0000 Introduce DataDirectoryGroupReadable boolean --- changes/bug17562-DataDirectoryGroupReadable | 3 +++ doc/tor.1.txt | 5 +++++ src/or/config.c | 17 ++++++++++++++++- src/or/or.h | 1 + 4 files changed, 25 insertions(+), 1 deletion(-) diff --git a/changes/bug17562-DataDirectoryGroupReadable b/changes/bug17562-DataDirectoryGroupReadable new file mode 100644 index 0000000..524e5ef --- /dev/null +++ b/changes/bug17562-DataDirectoryGroupReadable @@ -0,0 +1,3 @@ + o Minor bug fixes: + - Introduce DataDirectoryGroupReadable boolean. If set to 1, the + DataDirectory will be made readable by the default GID. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index c5ef054..041b000 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -353,6 +353,11 @@ GENERAL OPTIONS [[DataDirectory]] **DataDirectory** __DIR__:: Store working data in DIR (Default: @LOCALSTATEDIR@/lib/tor) +[[DataDirectoryGroupReadable]] **DataDirectoryGroupReadable** **0**|**1**:: + If this option is set to 0, don't allow the filesystem group to read the + DataDirectory. If the option is set to 1, make the DataDirectory readable + by the default GID. (Default: 0) + [[FallbackDir]] **FallbackDir** __address__:__port__ orport=__port__ id=__fingerprint__ [weight=__num__]:: When we're unable to connect to any directory cache for directory info (usually because we don't know about any yet) we try a FallbackDir. diff --git a/src/or/config.c b/src/or/config.c index 8d8c186..d9ba774 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -212,6 +212,7 @@ static config_var_t option_vars_[] = { V(CookieAuthFile, STRING, NULL), V(CountPrivateBandwidth, BOOL, "0"), V(DataDirectory, FILENAME, NULL), + V(DataDirectoryGroupReadable, BOOL, "0"), V(DisableNetwork, BOOL, "0"), V(DirAllowPrivateAddresses, BOOL, "0"), V(TestingAuthDirTimeToLearnReachability, INTERVAL, "30 minutes"), @@ -1186,16 +1187,30 @@ options_act_reversible(const or_options_t *old_options, char **msg) } /* Ensure data directory is private; create if possible. */ + cpd_check_t cpd_group_opts = CPD_NONE; + if (options->DataDirectoryGroupReadable) + cpd_group_opts = CPD_GROUP_READ; if (check_private_dir(options->DataDirectory, - running_tor ? CPD_CREATE : CPD_CHECK, + running_tor ? + CPD_CREATE|cpd_group_opts : CPD_CHECK|cpd_group_opts, options->User)<0) { tor_asprintf(msg, "Couldn't access/create private data directory \"%s\"", options->DataDirectory); + goto done; /* No need to roll back, since you can't change the value. */ } +#ifndef _WIN32 + if (options->DataDirectoryGroupReadable) { + /* Only new dirs created get new opts, also enforce group read. */ + if (chmod(options->DataDirectory, 0750)) { + log_warn(LD_FS,"Unable to make %s group-readable.", options->DataDirectory); + } + } +#endif + /* Bail out at this point if we're not going to be a client or server: * we don't run Tor itself. */ if (!running_tor) diff --git a/src/or/or.h b/src/or/or.h index 5d02ed7..945934e 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3436,6 +3436,7 @@ typedef struct { char *DebugLogFile; /**< Where to send verbose log messages. */ char *DataDirectory; /**< OR only: where to store long-term data. */ + int DataDirectoryGroupReadable; /**< Boolean: Is the DataDirectory g+r? */ char *Nickname; /**< OR only: nickname of this onion router. */ char *Address; /**< OR only: configured address for this onion router. */ char *PidFile; /**< Where to store PID of Tor process. */

1 0

[tor/master] Permit filesystem group to be root
by nickm＠torproject.org 11 Dec '15

11 Dec '15

commit 08c7ceb5dff3db5ba28de8370bae23f4bf6ec444 Author: Jamie Nguyen <j(a)jamielinux.com> Date: Fri Nov 13 14:17:02 2015 +0000 Permit filesystem group to be root --- changes/bug17562-allow-root-group-read | 6 ++++++ src/common/util.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug17562-allow-root-group-read b/changes/bug17562-allow-root-group-read new file mode 100644 index 0000000..7a0903c --- /dev/null +++ b/changes/bug17562-allow-root-group-read @@ -0,0 +1,6 @@ + o Minor bug fixes: + - If any directory created by Tor is marked as group readable, the + filesystem group is allowed to be either the default GID or the root + user. Allowing root to read the DataDirectory prevents the need for + CAP_READ_SEARCH when using systemd's CapabilityBoundingSet, or + dac_read_search when using SELinux. diff --git a/src/common/util.c b/src/common/util.c index ce3646c..6d522de 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -2143,7 +2143,7 @@ check_private_dir(const char *dirname, cpd_check_t check, return -1; } if ( (check & (CPD_GROUP_OK|CPD_GROUP_READ)) - && (st.st_gid != running_gid) ) { + && (st.st_gid != running_gid) && (st.st_gid != 0)) { struct group *gr; char *process_groupname = NULL; gr = getgrgid(running_gid);

1 0

[tor/master] Defer creation of Unix socket until after setuid
by nickm＠torproject.org 11 Dec '15

11 Dec '15

commit dcbfe46cd63e041a5bfc4f1de008a7f9025dffce Author: Jamie Nguyen <j(a)jamielinux.com> Date: Fri Nov 13 13:57:11 2015 +0000 Defer creation of Unix socket until after setuid --- changes/bug17562-defer-unix-socket-creation | 4 ++++ src/or/connection.c | 8 ++++++++ 2 files changed, 12 insertions(+) diff --git a/changes/bug17562-defer-unix-socket-creation b/changes/bug17562-defer-unix-socket-creation new file mode 100644 index 0000000..f1896c0 --- /dev/null +++ b/changes/bug17562-defer-unix-socket-creation @@ -0,0 +1,4 @@ + o Minor bug fixes: + - Defer creation of Unix sockets until after setuid. This avoids needing + CAP_CHOWN and CAP_FOWNER when using systemd's CapabilityBoundingSet, or + chown and fowner when using SELinux. diff --git a/src/or/connection.c b/src/or/connection.c index 7b8cc6b..575bbf1 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -2386,6 +2386,14 @@ retry_listener_ports(smartlist_t *old_conns, if (port->server_cfg.no_listen) continue; +#ifndef _WIN32 + /* We don't need to be root to create a UNIX socket, so defer until after + * setuid. */ + const or_options_t *options = get_options(); + if (port->is_unix_addr && !geteuid() && strcmp(options->User, "root")) + continue; +#endif + if (port->is_unix_addr) { listensockaddr = (struct sockaddr *) create_unix_sockaddr(port->unix_addr,

1 0

[tor/master] Simplify cpd_opts usage.
by nickm＠torproject.org 11 Dec '15

11 Dec '15

commit 01334589f1eae801b4ed8fb72fe3816ad5b0fe78 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 10 20:02:22 2015 -0500 Simplify cpd_opts usage. --- src/or/config.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index d9ba774..c6d4de3 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1187,12 +1187,11 @@ options_act_reversible(const or_options_t *old_options, char **msg) } /* Ensure data directory is private; create if possible. */ - cpd_check_t cpd_group_opts = CPD_NONE; + cpd_check_t cpd_opts = running_tor ? CPD_CREATE : CPD_CHECK; if (options->DataDirectoryGroupReadable) - cpd_group_opts = CPD_GROUP_READ; + cpd_opts |= CPD_GROUP_READ; if (check_private_dir(options->DataDirectory, - running_tor ? - CPD_CREATE|cpd_group_opts : CPD_CHECK|cpd_group_opts, + cpd_opts, options->User)<0) { tor_asprintf(msg, "Couldn't access/create private data directory \"%s\"",

1 0

[tor/master] Fix wide line; log why chmod failed.
by nickm＠torproject.org 11 Dec '15

11 Dec '15

commit 4b0e9fff27acec544615810138e678869fcdd280 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 10 20:03:37 2015 -0500 Fix wide line; log why chmod failed. --- src/or/config.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/or/config.c b/src/or/config.c index c6d4de3..7b42c9f 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1205,7 +1205,8 @@ options_act_reversible(const or_options_t *old_options, char **msg) if (options->DataDirectoryGroupReadable) { /* Only new dirs created get new opts, also enforce group read. */ if (chmod(options->DataDirectory, 0750)) { - log_warn(LD_FS,"Unable to make %s group-readable.", options->DataDirectory); + log_warn(LD_FS,"Unable to make %s group-readable: %s", + options->DataDirectory, strerror(errno)); } } #endif

1 0

[tor/master] Whitespace fix
by nickm＠torproject.org 11 Dec '15

11 Dec '15

commit a807bb781b2be26881d80350d04aadab9ceaa482 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 10 20:04:04 2015 -0500 Whitespace fix --- src/or/connection.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/connection.c b/src/or/connection.c index 575bbf1..bff994d 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -5056,3 +5056,4 @@ clock_skew_warning(const connection_t *conn, long apparent_skew, int trusted, apparent_skew, ext_source); tor_free(ext_source); } +

1 0

[tor/master] Refactor clock skew warning code to avoid duplication
by nickm＠torproject.org 11 Dec '15

11 Dec '15

commit d68b7fd4422f6ea1cad18a26b6a46b61bc182285 Author: Arlo Breault <arlolra(a)gmail.com> Date: Tue Dec 8 11:32:29 2015 -0800 Refactor clock skew warning code to avoid duplication --- src/or/channeltls.c | 27 +++------------------------ src/or/connection.c | 30 ++++++++++++++++++++++++++++++ src/or/connection.h | 4 ++++ src/or/directory.c | 25 ++++++------------------- src/or/statefile.c | 16 +++++----------- 5 files changed, 48 insertions(+), 54 deletions(-) diff --git a/src/or/channeltls.c b/src/or/channeltls.c index c90f569..f0333e8 100644 --- a/src/or/channeltls.c +++ b/src/or/channeltls.c @@ -1663,30 +1663,9 @@ channel_tls_process_netinfo_cell(cell_t *cell, channel_tls_t *chan) #define NETINFO_NOTICE_SKEW 3600 if (labs(apparent_skew) > NETINFO_NOTICE_SKEW && router_get_by_id_digest(chan->conn->identity_digest)) { - char dbuf[64]; - int severity; - /*XXXX be smarter about when everybody says we are skewed. */ - if (router_digest_is_trusted_dir(chan->conn->identity_digest)) - severity = LOG_WARN; - else - severity = LOG_INFO; - format_time_interval(dbuf, sizeof(dbuf), apparent_skew); - log_fn(severity, LD_GENERAL, - "Received NETINFO cell with skewed time from " - "server at %s:%d. It seems that our clock is %s by %s, or " - "that theirs is %s. Tor requires an accurate clock to work: " - "please check your time and date settings.", - chan->conn->base_.address, - (int)(chan->conn->base_.port), - apparent_skew > 0 ? "ahead" : "behind", - dbuf, - apparent_skew > 0 ? "behind" : "ahead"); - if (severity == LOG_WARN) /* only tell the controller if an authority */ - control_event_general_status(LOG_WARN, - "CLOCK_SKEW SKEW=%ld SOURCE=OR:%s:%d", - apparent_skew, - chan->conn->base_.address, - chan->conn->base_.port); + int trusted = router_digest_is_trusted_dir(chan->conn->identity_digest); + clock_skew_warning(TO_CONN(chan->conn), apparent_skew, trusted, LD_GENERAL, + "NETINFO cell", "OR"); } /* XXX maybe act on my_apparent_addr, if the source is sufficiently diff --git a/src/or/connection.c b/src/or/connection.c index 4e39832..7b8cc6b 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -5018,3 +5018,33 @@ connection_free_all(void) #endif } +/** Log a warning, and possibly emit a control event, that received came + * at a skewed time. trusted indicates that the source was one + * that we had more faith in and therefore the warning level should have higher + * severity. + */ +void +clock_skew_warning(const connection_t *conn, long apparent_skew, int trusted, + log_domain_mask_t domain, const char *received, + const char *source) +{ + char dbuf[64]; + char *ext_source = NULL; + format_time_interval(dbuf, sizeof(dbuf), apparent_skew); + if (conn) + tor_asprintf(&ext_source, "%s:%s:%d", source, conn->address, conn->port); + else + ext_source = tor_strdup(source); + log_fn(trusted ? LOG_WARN : LOG_INFO, domain, + "Received %s with skewed time (%s): " + "It seems that our clock is %s by %s, or that theirs is %s%s. " + "Tor requires an accurate clock to work: please check your time, " + "timezone, and date settings.", received, ext_source, + apparent_skew > 0 ? "ahead" : "behind", dbuf, + apparent_skew > 0 ? "behind" : "ahead", + (!conn || trusted) ? "" : ", or they are sending us the wrong time"); + if (trusted) + control_event_general_status(LOG_WARN, "CLOCK_SKEW SKEW=%ld SOURCE=%s", + apparent_skew, ext_source); + tor_free(ext_source); +} diff --git a/src/or/connection.h b/src/or/connection.h index b6ff3d7..48929c3 100644 --- a/src/or/connection.h +++ b/src/or/connection.h @@ -210,6 +210,10 @@ int connection_or_nonopen_was_started_here(or_connection_t *conn); void connection_dump_buffer_mem_stats(int severity); void remove_file_if_very_old(const char *fname, time_t now); +void clock_skew_warning(const connection_t *conn, long apparent_skew, + int trusted, log_domain_mask_t domain, + const char *received, const char *source); + #ifdef USE_BUFFEREVENTS int connection_type_uses_bufferevent(connection_t *conn); void connection_configure_bufferevent_callbacks(connection_t *conn); diff --git a/src/or/directory.c b/src/or/directory.c index 0a09e83..4e5644b 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -1595,7 +1595,7 @@ connection_dir_client_reached_eof(dir_connection_t *conn) size_t body_len = 0, orig_len = 0; int status_code; time_t date_header = 0; - long delta; + long apparent_skew; compress_method_t compression; int plausible; int skewed = 0; @@ -1654,28 +1654,15 @@ connection_dir_client_reached_eof(dir_connection_t *conn) * and the date header. (We used to check now-date_header, but that's * inaccurate if we spend a lot of time downloading.) */ - delta = conn->base_.timestamp_lastwritten - date_header; - if (labs(delta)>ALLOW_DIRECTORY_TIME_SKEW) { - char dbuf[64]; + apparent_skew = conn->base_.timestamp_lastwritten - date_header; + if (labs(apparent_skew)>ALLOW_DIRECTORY_TIME_SKEW) { int trusted = router_digest_is_trusted_dir(conn->identity_digest); - format_time_interval(dbuf, sizeof(dbuf), delta); - log_fn(trusted ? LOG_WARN : LOG_INFO, - LD_HTTP, - "Received directory with skewed time (server '%s:%d'): " - "It seems that our clock is %s by %s, or that theirs is %s. " - "Tor requires an accurate clock to work: please check your time, " - "timezone, and date settings.", - conn->base_.address, conn->base_.port, - delta>0 ? "ahead" : "behind", dbuf, - delta>0 ? "behind" : "ahead"); + clock_skew_warning(TO_CONN(conn), apparent_skew, trusted, LD_HTTP, + "directory", "DIRSERV"); skewed = 1; /* don't check the recommended-versions line */ - if (trusted) - control_event_general_status(LOG_WARN, - "CLOCK_SKEW SKEW=%ld SOURCE=DIRSERV:%s:%d", - delta, conn->base_.address, conn->base_.port); } else { log_debug(LD_HTTP, "Time on received directory is within tolerance; " - "we are %ld seconds skewed. (That's okay.)", delta); + "we are %ld seconds skewed. (That's okay.)", apparent_skew); } } (void) skewed; /* skewed isn't used yet. */ diff --git a/src/or/statefile.c b/src/or/statefile.c index 7481cd7..7fe8dc5 100644 --- a/src/or/statefile.c +++ b/src/or/statefile.c @@ -9,6 +9,7 @@ #include "circuitstats.h" #include "config.h" #include "confparse.h" +#include "connection.h" #include "entrynodes.h" #include "hibernate.h" #include "rephist.h" @@ -374,17 +375,10 @@ or_state_load(void) log_info(LD_GENERAL, "Loaded state from \"%s\"", fname); /* Warn the user if their clock has been set backwards, * they could be tricked into using old consensuses */ - if (new_state->LastWritten > time(NULL)) { - char last_written_str[ISO_TIME_LEN+1]; - char now_str[ISO_TIME_LEN+1]; - format_iso_time(last_written_str, new_state->LastWritten), - format_iso_time(now_str, time(NULL)); - log_warn(LD_GENERAL, "Your system clock has been set back in time. " - "Tor needs an accurate clock to know when the consensus " - "expires. You might have an empty clock battery or bad NTP " - "server. Clock time is %s, state file time is %s.", - now_str, last_written_str); - } + time_t apparent_skew = new_state->LastWritten - time(NULL); + if (apparent_skew > 0) + clock_skew_warning(NULL, (long)apparent_skew, 1, LD_GENERAL, + "local state file", fname); } else { log_info(LD_GENERAL, "Initialized state"); }

1 0

[webwml/master] bump stable version to 0.2.7.6
by nickm＠torproject.org 11 Dec '15

11 Dec '15

commit 22f13c93a878f2c7c7b9db102b26403b9f25b991 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 10 19:27:15 2015 -0500 bump stable version to 0.2.7.6 --- Makefile | 2 +- include/versions.wmi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 7897228..2b681f0 100644 --- a/Makefile +++ b/Makefile @@ -15,7 +15,7 @@ # website component, and set it to needs_review. export STABLETAG=tor-0.2.6.10 -export DEVTAG=tor-0.2.7.5 +export DEVTAG=tor-0.2.7.6 WMLBASE=. diff --git a/include/versions.wmi b/include/versions.wmi index e05d00c..3832e40 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -1,5 +1,5 @@ <define-tag version-stable whitespace=delete>0.2.6.10</define-tag> -<define-tag version-alpha whitespace=delete>0.2.7.5</define-tag> +<define-tag version-alpha whitespace=delete>0.2.7.6</define-tag> <define-tag version-win32-stable whitespace=delete>0.2.6.10</define-tag>

1 0

[tor/maint-0.2.7] bump to 0.2.7.6-dev
by nickm＠torproject.org 10 Dec '15

10 Dec '15

commit aa40f289624c74bcd43b91f15cc43e7f17e9df25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 10 14:24:55 2015 -0500 bump to 0.2.7.6-dev --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 6c72971..d37c34d 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information -AC_INIT([tor],[0.2.7.6]) +AC_INIT([tor],[0.2.7.6-dev]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 07cc315..08cef8d 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.7.6" +!define VERSION "0.2.7.6-dev" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 822e261..8b687c8 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -232,7 +232,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.7.6" +#define VERSION "0.2.7.6-dev"

1 0

[tor/master] bump to 0.2.7.6-dev
by nickm＠torproject.org 10 Dec '15

10 Dec '15

commit aa40f289624c74bcd43b91f15cc43e7f17e9df25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 10 14:24:55 2015 -0500 bump to 0.2.7.6-dev --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 6c72971..d37c34d 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information -AC_INIT([tor],[0.2.7.6]) +AC_INIT([tor],[0.2.7.6-dev]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 07cc315..08cef8d 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.7.6" +!define VERSION "0.2.7.6-dev" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 822e261..8b687c8 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -232,7 +232,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.7.6" +#define VERSION "0.2.7.6-dev"

1 0