[tbb-bugs] #23963 [Applications/Tor Browser]: Tor Browser can use a Tor that's running under another user

[Tor Bug Tracker & Wiki]

#23963: Tor Browser can use a Tor that's running under another user
--------------------------------------+--------------------------
 Reporter:  teor                      |          Owner:  tbb-team
     Type:  defect                    |         Status:  new
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:                            |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------

Comment (by yawning):

 Replying to [comment:2 mcs]:
 > I do not know of a way to ensure that the SOCKSPort is "trusted" except
 to switch to Unix domain sockets (which is possible via hidden prefs
 inside Tor Browser).

 Beyond what's done now (Query `net/listeners/socks` over the command
 port), probably not much without patching tor.

 > I am also not sure how Tor Browser can tell the difference between "I am
 using a system Tor which is what the user wants" and "I am using a
 leftover Tor that was possibly started by another user."

 Getting Tor Browser to use a system tor requires a bunch of env vars to be
 set to suppress launching the tor instance.

 > I think the argument will be "If Tor Browser is configured to start tor,
 it should only use the tor that it starts" (which seems reasonable but may
 be difficult to implement).

 `SO_PASSCRED` and `SCM_CREDENTIALS` makes this trivial on sensible
 systems.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23963#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online