- tor-commits - lists.torproject.org

[tor/master] And add a changelog entry for the 4574 fix. (closes: #4574)
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit fcf5c92e21dc6b39aa75e6d709f76c82276d3455 Author: Peter Palfrader <peter(a)palfrader.org> Date: Fri Nov 25 14:16:57 2011 +0100 And add a changelog entry for the 4574 fix. (closes: #4574) --- changes/bug4574 | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/changes/bug4574 b/changes/bug4574 new file mode 100644 index 0000000..0a57957 --- /dev/null +++ b/changes/bug4574 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Fix a minor formatting issue in one of tor-gencert's error messages. + Fixes bug 4574. +

1 0

[tor-cloud/master] How to find the address of your bridge, solves #4571
by runa＠torproject.org 25 Nov '11

25 Nov '11

commit ff6189f011066ec277f55d53d88806a052bc6d6e Author: Runa A. Sandvik <runa.sandvik(a)gmail.com> Date: Fri Nov 25 13:39:16 2011 +0000 How to find the address of your bridge, solves #4571 --- html/index.html | 38 +++++++++++++++++++++++++------------- 1 files changed, 25 insertions(+), 13 deletions(-) diff --git a/html/index.html b/html/index.html index 20a9a44..6327488 100644 --- a/html/index.html +++ b/html/index.html @@ -263,9 +263,11 @@ 1. How much does it cost? There is no fee charged by the Tor Project, Inc for you to run a Tor Cloud image. Amazon does, however, charge instances - according to their <a href="http://aws.amazon.com/ec2/pricing/">pricing</a>. - We have <a href="https://trac.torproject.org/projects/tor/ticket/3574#comment:4">estimated</a> - that running a bridge will cost around $30 a month. + according to their <a + href="http://aws.amazon.com/ec2/pricing/">pricing</a>. See + How much does it cost? on the <a + href="https://cloud.torproject.org/">front page</a> for more + information. 2. The instance is running, what's next? You should not have to do anything once the instance is up and @@ -274,7 +276,17 @@ After that, the address for your bridge will be given out to users. - 3. How can I check if my bridge is running? + 3. How do I find the address of my bridge? + To find the address of your bridge, log on to the AWS Management + Console, find your instance, and click on it. The bottom half of the + page will show some details about the instance you have selected, + including Public DNS. If the AWS Management Console says + that the Public DNS for your instance is + ec2-012-34-56-789.compute-1.amazonaws.com, then you know that the IP + address is 012.34.56.789. All of the bridges run on port 443, so the + address of your bridge is 012.34.56.789:443. + + 4. How can I check if my bridge is running? There are two ways you can check to see if your bridge is running; you can either log on to the instance and check /var/log/tor/log, or you can use Tor and connect to your @@ -283,46 +295,46 @@ href="https://www.torproject.org/docs/bridges.html.en">Tor Project website</a>. - 4. I can't connect as user root, what's wrong? + 5. I can't connect as user root, what's wrong? When you right-click and choose connect, AWS will suggest that you use root as the username. This is wrong. You need to use ubuntu as the username if you wish to connect to your server via SSH. - 5. How do I stop or terminate the instance? + 6. How do I stop or terminate the instance? To stop or terminate the instance, log on to the AWS Management Console, find your instance, right click on it and choose either "Stop" or "Terminate". "Stop" will just shutdown the instance as normal and will allow you to start it up again later. "Terminate" will delete the instance from your AWS account. - 6. How do I change the IP address of my instance? + 7. How do I change the IP address of my instance? To change the IP address of your instance, log on to the AWS Management Console, find your instance, right click on it and choose "Stop". Once the instance has shut down completely, right click on it again and choose "Start". The instance will be assigned a new IP address when it starts up again. - 7. What's in the Tor configuration file? + 8. What's in the Tor configuration file? The Tor configuration file that the images have been configured with can be found <a href="https://cloud.torproject.org/torrc.txt">here</a>. - 8. Will the images automatically download and install package updates? + 9. Will the images automatically download and install package updates? Yes, the images have all been configured with the <a href="https://help.ubuntu.com/community/AutomaticSecurityUpdates">unattended-upgrades</a> package. This means that your system will automatically download and install updates. - 9. Will you let me know when you publish new images? + 10. Will you let me know when you publish new images? New cloud images will be announced on <a href="https://twitter.com/torproject">Twitter</a>, <a href="https://identi.ca/torproject">identi.ca</a>, <a href="https://blog.torproject.org">our blog</a> and on the <a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk">tor-talk</a> mailing list. - 10. Where do I report a bug I am encountering? + 11. Where do I report a bug I am encountering? If you think the bug you have found is specific to the Tor Cloud images we provide, please <a href="https://trac.torproject.org">file a bug</a> or send an email to help AT rt.torproject.org. - 11. Is there an IRC channel where I can ask about Tor Cloud? + 12. Is there an IRC channel where I can ask about Tor Cloud? Yes, simply join #tor on irc.oftc.net and ask your question. It may take a while before we get back to you, so please be patient. - 12. I have a question that is not answered here, what do I do? + 13. I have a question that is not answered here, what do I do? Please send an email to help AT rt.torproject.org. </div>

1 0

[tor/master] Handle build-trees better.
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit 86be8fcf0a1d979c50452d681e5090418d444987 Author: Peter Palfrader <peter(a)palfrader.org> Date: Wed Sep 7 18:04:45 2011 +0200 Handle build-trees better. Properly create git revision and source file sha1sums include files when building tor not in its source tree but in a dedicated build tree. --- src/common/Makefile.am | 4 ++-- src/or/Makefile.am | 9 +++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/common/Makefile.am b/src/common/Makefile.am index 2244fe5..2920e73 100644 --- a/src/common/Makefile.am +++ b/src/common/Makefile.am @@ -56,9 +56,9 @@ noinst_HEADERS = \ common_sha1.i: $(libor_SOURCES) $(libor_crypto_a_SOURCES) $(noinst_HEADERS) if test "@SHA1SUM@" != none; then \ - @SHA1SUM@ $(libor_SOURCES) $(libor_crypto_a_SOURCES) $(noinst_HEADERS) | @SED@ -n 's/^$.*$$$/"\1\\n"/p' > common_sha1.i; \ + (cd "$(srcdir)" && @SHA1SUM@ $(libor_SOURCES) $(libor_crypto_a_SOURCES) $(noinst_HEADERS)) | @SED@ -n 's/^$.*$$$/"\1\\n"/p' > common_sha1.i; \ elif test "@OPENSSL@" != none; then \ - @OPENSSL@ sha1 $(libor_SOURCES) $(libor_crypto_a_SOURCES) $(noinst_HEADERS) | @SED@ -n 's/SHA1($.*$)= $.*$/"\2 \1\\n"/p' > common_sha1.i; \ + (cd "$(srcdir)" && @OPENSSL@ sha1 $(libor_SOURCES) $(libor_crypto_a_SOURCES) $(noinst_HEADERS)) | @SED@ -n 's/SHA1($.*$)= $.*$/"\2 \1\\n"/p' > common_sha1.i; \ else \ rm common_sha1.i; \ touch common_sha1.i; \ diff --git a/src/or/Makefile.am b/src/or/Makefile.am index 67adf50..a568208 100644 --- a/src/or/Makefile.am +++ b/src/or/Makefile.am @@ -126,8 +126,9 @@ tor_main.o: micro-revision.i micro-revision.i: FORCE @rm -f micro-revision.tmp; \ - if test -d ../../.git && test -x "`which git 2>&1;true`"; then \ - HASH="`git rev-parse --short=16 HEAD`"; \ + if test -d "$(top_srcdir)/.git" && \ + test -x "`which git 2>&1;true`"; then \ + HASH="`cd "$(top_srcdir)" && git rev-parse --short=16 HEAD`"; \ echo \"$$HASH\" > micro-revision.tmp; \ fi; \ if test ! -f micro-revision.tmp ; then \ @@ -141,10 +142,10 @@ micro-revision.i: FORCE or_sha1.i: $(tor_SOURCES) $(libtor_a_SOURCES) if test "@SHA1SUM@" != none; then \ - @SHA1SUM@ $(tor_SOURCES) $(libtor_a_SOURCES) | \ + (cd "$(srcdir)" && @SHA1SUM@ $(tor_SOURCES) $(libtor_a_SOURCES)) | \ @SED@ -n 's/^$.*$$$/"\1\\n"/p' > or_sha1.i; \ elif test "@OPENSSL@" != none; then \ - @OPENSSL@ sha1 $(tor_SOURCES) $(libtor_a_SOURCES) | \ + (cd "$(srcdir)" && @OPENSSL@ sha1 $(tor_SOURCES) $(libtor_a_SOURCES)) | \ @SED@ -n 's/SHA1($.*$)= $.*$/"\2 \1\\n"/p' > or_sha1.i; \ else \ rm or_sha1.i; \

1 0

[tor/master] And a changes file for bug3953
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit d951e2042654bdd809ba085ec19a18a14cb8f63a Author: Peter Palfrader <peter(a)palfrader.org> Date: Wed Sep 7 18:14:03 2011 +0200 And a changes file for bug3953 --- changes/bug3953 | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/changes/bug3953 b/changes/bug3953 new file mode 100644 index 0000000..5b3919f --- /dev/null +++ b/changes/bug3953 @@ -0,0 +1,6 @@ + o Build fixes: + - Properly handle the case where the build-tree is not the same + as the source tree when generating src/common/common_sha1.i, + src/or/micro-revision.i and src/or/or_sha1.i. Fixes bug 3953; + bugfix on 0.2.0.1-alpha. +

1 0

[tor/master] Basic support for a "make version" target to declare the source version
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit 916aa8022d8bafac86966b71fb5b43f20cf91ccd Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 24 23:53:18 2011 -0500 Basic support for a "make version" target to declare the source version This is katmagic's idea. See issue 4400. --- Makefile.am | 7 +++++++ changes/make_version | 4 ++++ 2 files changed, 11 insertions(+), 0 deletions(-) diff --git a/Makefile.am b/Makefile.am index cd0d883..b8d18d4 100644 --- a/Makefile.am +++ b/Makefile.am @@ -70,3 +70,10 @@ check-logs: ./contrib/checkLogs.pl \ src/*/*.[ch] | sort -n +version: + @echo "Tor @VERSION@" + @if test -d "$(top_srcdir)/.git" && test -x "`which git 2>&1;true`"; then \ + echo -n "git: " ;\ + (cd "$(top_srcdir)" && git rev-parse --short=16 HEAD); \ + fi + diff --git a/changes/make_version b/changes/make_version new file mode 100644 index 0000000..b736a87 --- /dev/null +++ b/changes/make_version @@ -0,0 +1,4 @@ + o Minor features (build): + - Running "make version" now displays the version of Tor that + we're about to build. Idea from katmagic; resolves issue 4400. +

1 0

[tor/master] Merge remote-tracking branch 'ioerror/DisableDebuggerAttachment'
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit 68114ca52cbed0b7970a60717be4ca22ffdc5d00 Merge: f634228 f79a75f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 24 23:38:32 2011 -0500 Merge remote-tracking branch 'ioerror/DisableDebuggerAttachment' Conflicts: src/or/config.c changes/disable_debugger_attachment | 14 ++++++++ doc/tor.1.txt | 14 ++++++++ src/or/config.c | 57 +++++++++++++++++++++++++++++++++++ src/or/or.h | 2 + 4 files changed, 87 insertions(+), 0 deletions(-) diff --cc src/or/config.c index ef9e4ec,5a153b0..b8ff6e8 --- a/src/or/config.c +++ b/src/or/config.c @@@ -42,9 -40,14 +42,17 @@@ #include "procmon.h" +/* From main.c */ +extern int quiet_level; + + /* Includes for the process attaching prevention */ + #if defined(HAVE_SYS_PRCTL_H) && defined(__linux__) + #include <sys/prctl.h> + #elif defined(__APPLE__) + #include <sys/types.h> + #include <sys/ptrace.h> + #endif + /** Enumeration of types which option values can take */ typedef enum config_type_t { CONFIG_TYPE_STRING = 0, /**< An arbitrary string. */ @@@ -246,8 -246,9 +254,9 @@@ static config_var_t _option_vars[] = V(DirReqStatistics, BOOL, "1"), VAR("DirServer", LINELIST, DirServers, NULL), V(DisableAllSwap, BOOL, "0"), + V(DisableDebuggerAttachment, BOOL, "1"), V(DisableIOCP, BOOL, "1"), - V(DNSPort, PORT, "0"), + V(DNSPort, LINELIST, NULL), V(DNSListenAddress, LINELIST, NULL), V(DownloadExtraInfo, BOOL, "0"), V(EnforceDistinctSubnets, BOOL, "1"), @@@ -678,9 -658,50 +687,50 @@@ get_dirportfrontpage(void return global_dirfrontpagecontents; } + /* We only use the linux prctl for now. There is no Win32 support; this may + * also work on various BSD systems and Mac OS X - send testing feedback! + * + * On recent Gnu/Linux kernels it is possible to create a system-wide policy + * that will prevent non-root processes from attaching to other processes + * unless they are the parent process; thus gdb can attach to programs that + * they execute but they cannot attach to other processes running as the same + * user. The system wide policy may be set with the sysctl + * kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope + * and it is 1 by default on Ubuntu 11.04. + * + * This ptrace scope will be ignored on Gnu/Linux for users with + * CAP_SYS_PTRACE and so it is very likely that root will still be able to + * attach to the Tor process. + */ + /** Attempt to disable debugger attachment. */ + static int tor_disable_debugger_attach(void) { + int r; + r = -1; + log_debug(LD_CONFIG, + "Attemping to disable debugger attachment to Tor for unprivileged users."); + #if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL) + #ifdef PR_SET_DUMPABLE + r = prctl(PR_SET_DUMPABLE, 0); + #endif + #endif + #if defined(__APPLE__) && defined(PT_DENY_ATTACH) + r = ptrace(PT_DENY_ATTACH, 0, 0, 0); + #endif + + // XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here + // XXX: TODO - Windows probably has something similar - implement it here + if (r == 0) { + log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users."); + } else { + log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s", + strerror(errno)); + } + return r; + } + /** Allocate an empty configuration object of a given format type. */ static void * -config_alloc(config_format_t *fmt) +config_alloc(const config_format_t *fmt) { void *opts = tor_malloc_zero(fmt->size); *(uint32_t*)STRUCT_VAR_P(opts, fmt->magic_offset) = fmt->magic; @@@ -1277,15 -1238,20 +1327,22 @@@ get_effective_bwburst(const or_options_ * here yet. Some is still in do_hup() and other places. */ static int -options_act(or_options_t *old_options) +options_act(const or_options_t *old_options) { config_line_t *cl; - or_options_t *options = get_options(); + or_options_t *options = get_options_mutable(); int running_tor = options->command == CMD_RUN_TOR; char *msg; + const int transition_affects_workers = + old_options && options_transition_affects_workers(old_options, options); + /* disable ptrace and later, other basic debugging techniques */ + if (options->DisableDebuggerAttachment) { + tor_disable_debugger_attach(); + } else { + log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users."); + } + if (running_tor && !have_lockfile()) { if (try_locking(options, 1) < 0) return -1;

1 0

[tor/master] Move disable-debugger-attachment fn to compat where it belongs. Fix whitespace
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit eaa3a379f0ba15e488054a686b1eb838ebbf7cc5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 24 23:45:47 2011 -0500 Move disable-debugger-attachment fn to compat where it belongs. Fix whitespace --- src/common/compat.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++ src/common/compat.h | 1 + src/or/config.c | 64 +++----------------------------------------------- 3 files changed, 64 insertions(+), 60 deletions(-) diff --git a/src/common/compat.c b/src/common/compat.c index 9a2c9d7..ea95f9f 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -58,6 +58,14 @@ #endif #endif +/* Includes for the process attaching prevention */ +#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__) +#include <sys/prctl.h> +#elif defined(__APPLE__) +#include <sys/types.h> +#include <sys/ptrace.h> +#endif + #ifdef HAVE_NETDB_H #include <netdb.h> #endif @@ -1519,6 +1527,57 @@ switch_id(const char *user) #endif } +/* We only use the linux prctl for now. There is no Win32 support; this may + * also work on various BSD systems and Mac OS X - send testing feedback! + * + * On recent Gnu/Linux kernels it is possible to create a system-wide policy + * that will prevent non-root processes from attaching to other processes + * unless they are the parent process; thus gdb can attach to programs that + * they execute but they cannot attach to other processes running as the same + * user. The system wide policy may be set with the sysctl + * kernel.yama.ptrace_scope or by inspecting + * /proc/sys/kernel/yama/ptrace_scope and it is 1 by default on Ubuntu 11.04. + * + * This ptrace scope will be ignored on Gnu/Linux for users with + * CAP_SYS_PTRACE and so it is very likely that root will still be able to + * attach to the Tor process. + */ +/** Attempt to disable debugger attachment: return 0 on success, -1 on + * failure. */ +int +tor_disable_debugger_attach(void) +{ + int r, attempted; + r = -1; + attempted = 0; + log_debug(LD_CONFIG, + "Attemping to disable debugger attachment to Tor for " + "unprivileged users."); +#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL) +#ifdef PR_SET_DUMPABLE + attempted = 1; + r = prctl(PR_SET_DUMPABLE, 0); +#endif +#endif +#if defined(__APPLE__) && defined(PT_DENY_ATTACH) + if (r < 0) { + attempted = 1; + r = ptrace(PT_DENY_ATTACH, 0, 0, 0); + } +#endif + + // XXX: TODO - Mac OS X has dtrace and this may be disabled. + // XXX: TODO - Windows probably has something similar + if (r == 0) { + log_debug(LD_CONFIG,"Debugger attachment disabled for " + "unprivileged users."); + } else if (attempted) { + log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s", + strerror(errno)); + } + return r; +} + #ifdef HAVE_PWD_H /** Allocate and return a string containing the home directory for the * user username. Only works on posix-like systems. */ diff --git a/src/common/compat.h b/src/common/compat.h index b005dd2..f73e433 100644 --- a/src/common/compat.h +++ b/src/common/compat.h @@ -566,6 +566,7 @@ set_uint8(void *cp, uint8_t v) typedef unsigned long rlim_t; #endif int set_max_file_descriptors(rlim_t limit, int *max); +int tor_disable_debugger_attach(void); int switch_id(const char *user); #ifdef HAVE_PWD_H char *get_user_homedir(const char *username); diff --git a/src/or/config.c b/src/or/config.c index a424637..c0ce404 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -40,14 +40,6 @@ #include <shlobj.h> #endif -/* Includes for the process attaching prevention */ -#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__) -#include <sys/prctl.h> -#elif defined(__APPLE__) -#include <sys/types.h> -#include <sys/ptrace.h> -#endif - #include "procmon.h" /* From main.c */ @@ -687,55 +679,6 @@ get_dirportfrontpage(void) return global_dirfrontpagecontents; } -/* We only use the linux prctl for now. There is no Win32 support; this may - * also work on various BSD systems and Mac OS X - send testing feedback! - * - * On recent Gnu/Linux kernels it is possible to create a system-wide policy - * that will prevent non-root processes from attaching to other processes - * unless they are the parent process; thus gdb can attach to programs that - * they execute but they cannot attach to other processes running as the same - * user. The system wide policy may be set with the sysctl - * kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope - * and it is 1 by default on Ubuntu 11.04. - * - * This ptrace scope will be ignored on Gnu/Linux for users with - * CAP_SYS_PTRACE and so it is very likely that root will still be able to - * attach to the Tor process. -*/ -/** Attempt to disable debugger attachment. */ -static int -tor_disable_debugger_attach(void) -{ - int r, attempted; - r = -1; - attempted = 0; - log_debug(LD_CONFIG, - "Attemping to disable debugger attachment to Tor for " - "unprivileged users."); -#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL) -#ifdef PR_SET_DUMPABLE - attempted = 1; - r = prctl(PR_SET_DUMPABLE, 0); -#endif -#endif -#if defined(__APPLE__) && defined(PT_DENY_ATTACH) - if (r < 0) { - attempted = 1; - r = ptrace(PT_DENY_ATTACH, 0, 0, 0); - } -#endif - -// XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here -// XXX: TODO - Windows probably has something similar - implement it here - if (r == 0) { - log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users."); - } else if (attempted) { - log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s", - strerror(errno)); - } - return r; -} - /** Allocate an empty configuration object of a given format type. */ static void * config_alloc(const config_format_t *fmt) @@ -1346,11 +1289,12 @@ options_act(const or_options_t *old_options) /* disable ptrace and later, other basic debugging techniques */ if (options->DisableDebuggerAttachment) { - tor_disable_debugger_attach(); + tor_disable_debugger_attach(); } else { - log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users."); + log_notice(LD_CONFIG,"Debugger attachment enabled " + "for unprivileged users."); } - + if (running_tor && !have_lockfile()) { if (try_locking(options, 1) < 0) return -1;

1 0

[tor/master] Tweak disable_debugger_attachment a little
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit 3508de3cd692b8e9567fd9ab64f88ace28e91ef2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 24 23:39:44 2011 -0500 Tweak disable_debugger_attachment a little Don't warn when we have no implementation of this function (since it's on-by-default); reformat the changes entry; fix an overlong line. --- changes/disable_debugger_attachment | 24 +++++++++++++----------- src/or/config.c | 30 +++++++++++++++++++----------- 2 files changed, 32 insertions(+), 22 deletions(-) diff --git a/changes/disable_debugger_attachment b/changes/disable_debugger_attachment index 366f972..b413788 100644 --- a/changes/disable_debugger_attachment +++ b/changes/disable_debugger_attachment @@ -1,14 +1,16 @@ o Minor features: - - If set to 1, Tor will attempt to prevent basic debugging attachment - attempts by other processes. It has no impact for users who wish to - attach if they have CAP_SYS_PTRACE or if they are root. We believe that - this feature works on modern Gnu/Linux distributions, and that it may - also work on *BSD systems (untested). Some modern Gnu/Linux systems such - as Ubuntu have the kernel.yama.ptrace_scope sysctl and by default enable - it as an attempt to limit the PTRACE scope for all user processes by - default. This feature will attempt to limit the PTRACE scope for Tor - specifically - it will not attempt to alter the system wide ptrace scope - as it may not even exist. If you wish to attach to Tor with a debugger - such as gdb or strace you will want to set this to 0 for the duration of + - If set to 1, Tor will attempt to prevent basic debugging + attachment attempts by other processes. It has no impact for + users who wish to attach if they have CAP_SYS_PTRACE or if they + are root. We believe that this feature works on modern + Gnu/Linux distributions, and that it may also work on OSX and + some *BSD systems (untested). Some modern Gnu/Linux systems + such as Ubuntu have the kernel.yama.ptrace_scope sysctl and by + default enable it as an attempt to limit the PTRACE scope for + all user processes by default. This feature will attempt to + limit the PTRACE scope for Tor specifically - it will not + attempt to alter the system wide ptrace scope as it may not even + exist. If you wish to attach to Tor with a debugger such as gdb + or strace you will want to set this to 0 for the duration of your debugging. Normal users should leave it on. (Default: 1) diff --git a/src/or/config.c b/src/or/config.c index b8ff6e8..a424637 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -40,19 +40,19 @@ #include <shlobj.h> #endif -#include "procmon.h" - -/* From main.c */ -extern int quiet_level; - /* Includes for the process attaching prevention */ #if defined(HAVE_SYS_PRCTL_H) && defined(__linux__) -#include <sys/prctl.h> +#include <sys/prctl.h> #elif defined(__APPLE__) #include <sys/types.h> #include <sys/ptrace.h> #endif +#include "procmon.h" + +/* From main.c */ +extern int quiet_level; + /** Enumeration of types which option values can take */ typedef enum config_type_t { CONFIG_TYPE_STRING = 0, /**< An arbitrary string. */ @@ -703,25 +703,33 @@ get_dirportfrontpage(void) * attach to the Tor process. */ /** Attempt to disable debugger attachment. */ -static int tor_disable_debugger_attach(void) { - int r; +static int +tor_disable_debugger_attach(void) +{ + int r, attempted; r = -1; + attempted = 0; log_debug(LD_CONFIG, - "Attemping to disable debugger attachment to Tor for unprivileged users."); + "Attemping to disable debugger attachment to Tor for " + "unprivileged users."); #if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL) #ifdef PR_SET_DUMPABLE + attempted = 1; r = prctl(PR_SET_DUMPABLE, 0); #endif #endif #if defined(__APPLE__) && defined(PT_DENY_ATTACH) - r = ptrace(PT_DENY_ATTACH, 0, 0, 0); + if (r < 0) { + attempted = 1; + r = ptrace(PT_DENY_ATTACH, 0, 0, 0); + } #endif // XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here // XXX: TODO - Windows probably has something similar - implement it here if (r == 0) { log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users."); - } else { + } else if (attempted) { log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s", strerror(errno)); }

1 0

[tor/master] New configuration option: DisableDebuggerAttachment
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit f79a75f59731eab85c019c41827c0c0e89d90498 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Mon May 30 17:06:51 2011 +0200 New configuration option: DisableDebuggerAttachment If set to 1, Tor will attempt to prevent basic debugging attachment attempts by other processes. (Default: 1) Supports Mac OS X and Gnu/Linux. Sebastian provided useful feedback and refactoring suggestions. Signed-off-by: Jacob Appelbaum <jacob(a)appelbaum.net> --- changes/disable_debugger_attachment | 14 ++++++++ doc/tor.1.txt | 14 ++++++++ src/or/config.c | 57 +++++++++++++++++++++++++++++++++++ src/or/or.h | 2 + 4 files changed, 87 insertions(+), 0 deletions(-) diff --git a/changes/disable_debugger_attachment b/changes/disable_debugger_attachment new file mode 100644 index 0000000..366f972 --- /dev/null +++ b/changes/disable_debugger_attachment @@ -0,0 +1,14 @@ + o Minor features: + - If set to 1, Tor will attempt to prevent basic debugging attachment + attempts by other processes. It has no impact for users who wish to + attach if they have CAP_SYS_PTRACE or if they are root. We believe that + this feature works on modern Gnu/Linux distributions, and that it may + also work on *BSD systems (untested). Some modern Gnu/Linux systems such + as Ubuntu have the kernel.yama.ptrace_scope sysctl and by default enable + it as an attempt to limit the PTRACE scope for all user processes by + default. This feature will attempt to limit the PTRACE scope for Tor + specifically - it will not attempt to alter the system wide ptrace scope + as it may not even exist. If you wish to attach to Tor with a debugger + such as gdb or strace you will want to set this to 0 for the duration of + your debugging. Normal users should leave it on. (Default: 1) + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 7d72350..c37c44c 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -251,6 +251,20 @@ Other options can be specified either on the command-line (--option option requires that you start your Tor as root, and you should use the **User** option to properly reduce Tor's privileges. (Default: 0) +**DisableDebuggerAttachment** **0**|**1**:: + If set to 1, Tor will attempt to prevent basic debugging attachment attempts + by other processes. It has no impact for users who wish to attach if they + have CAP_SYS_PTRACE or if they are root. We believe that this feature + works on modern Gnu/Linux distributions, and that it may also work on *BSD + systems (untested). Some modern Gnu/Linux systems such as Ubuntu have the + kernel.yama.ptrace_scope sysctl and by default enable it as an attempt to + limit the PTRACE scope for all user processes by default. This feature will + attempt to limit the PTRACE scope for Tor specifically - it will not attempt + to alter the system wide ptrace scope as it may not even exist. If you wish + to attach to Tor with a debugger such as gdb or strace you will want to set + this to 0 for the duration of your debugging. Normal users should leave it + on. (Default: 1) + **FetchDirInfoEarly** **0**|**1**:: If set to 1, Tor will always fetch directory information like other directory caches, even if you don't meet the normal criteria for fetching diff --git a/src/or/config.c b/src/or/config.c index f3c6345..5a153b0 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -40,6 +40,14 @@ #include "procmon.h" +/* Includes for the process attaching prevention */ +#if defined(HAVE_SYS_PRCTL_H) && defined(__linux__) +#include <sys/prctl.h> +#elif defined(__APPLE__) +#include <sys/types.h> +#include <sys/ptrace.h> +#endif + /** Enumeration of types which option values can take */ typedef enum config_type_t { CONFIG_TYPE_STRING = 0, /**< An arbitrary string. */ @@ -238,6 +246,7 @@ static config_var_t _option_vars[] = { V(DirReqStatistics, BOOL, "1"), VAR("DirServer", LINELIST, DirServers, NULL), V(DisableAllSwap, BOOL, "0"), + V(DisableDebuggerAttachment, BOOL, "1"), V(DisableIOCP, BOOL, "1"), V(DNSPort, PORT, "0"), V(DNSListenAddress, LINELIST, NULL), @@ -649,6 +658,47 @@ get_dirportfrontpage(void) return global_dirfrontpagecontents; } +/* We only use the linux prctl for now. There is no Win32 support; this may + * also work on various BSD systems and Mac OS X - send testing feedback! + * + * On recent Gnu/Linux kernels it is possible to create a system-wide policy + * that will prevent non-root processes from attaching to other processes + * unless they are the parent process; thus gdb can attach to programs that + * they execute but they cannot attach to other processes running as the same + * user. The system wide policy may be set with the sysctl + * kernel.yama.ptrace_scope or by inspecting /proc/sys/kernel/yama/ptrace_scope + * and it is 1 by default on Ubuntu 11.04. + * + * This ptrace scope will be ignored on Gnu/Linux for users with + * CAP_SYS_PTRACE and so it is very likely that root will still be able to + * attach to the Tor process. +*/ +/** Attempt to disable debugger attachment. */ +static int tor_disable_debugger_attach(void) { + int r; + r = -1; + log_debug(LD_CONFIG, + "Attemping to disable debugger attachment to Tor for unprivileged users."); +#if defined(__linux__) && defined(HAVE_SYS_PRCTL_H) && defined(HAVE_PRCTL) +#ifdef PR_SET_DUMPABLE + r = prctl(PR_SET_DUMPABLE, 0); +#endif +#endif +#if defined(__APPLE__) && defined(PT_DENY_ATTACH) + r = ptrace(PT_DENY_ATTACH, 0, 0, 0); +#endif + +// XXX: TODO - Mac OS X has dtrace and this may be disabled - implement it here +// XXX: TODO - Windows probably has something similar - implement it here + if (r == 0) { + log_debug(LD_CONFIG,"Debugger attachment disabled for unprivileged users."); + } else { + log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s", + strerror(errno)); + } + return r; +} + /** Allocate an empty configuration object of a given format type. */ static void * config_alloc(config_format_t *fmt) @@ -1195,6 +1245,13 @@ options_act(or_options_t *old_options) int running_tor = options->command == CMD_RUN_TOR; char *msg; + /* disable ptrace and later, other basic debugging techniques */ + if (options->DisableDebuggerAttachment) { + tor_disable_debugger_attach(); + } else { + log_notice(LD_CONFIG,"Debugger attachment enabled for unprivileged users."); + } + if (running_tor && !have_lockfile()) { if (try_locking(options, 1) < 0) return -1; diff --git a/src/or/or.h b/src/or/or.h index 4b20b57..db3b171 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2900,6 +2900,8 @@ typedef struct { disclaimer. This allows a server administrator to show that they're running Tor and anyone visiting their server will know this without any specialized knowledge. */ + int DisableDebuggerAttachment; /**< Currently Linux only specific attempt to + disable ptrace; needs BSD testing. */ /** Boolean: if set, we start even if our resolv.conf file is missing * or broken. */ int ServerDNSAllowBrokenConfig;

1 0

[tor/master] Merge remote-tracking branch 'public/feature4516'
by nickm＠torproject.org 25 Nov '11

25 Nov '11

commit f634228a073965195c4088b66c1d5c4799c6eed2 Merge: 11221d0 6e6a661 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 24 22:59:37 2011 -0500 Merge remote-tracking branch 'public/feature4516' changes/UserspaceIOCPBuffers | 7 +++++++ src/or/config.c | 1 + src/or/main.c | 28 ++++++++++++++++++++++++++++ src/or/or.h | 5 +++++ 4 files changed, 41 insertions(+), 0 deletions(-)

1 0