[tor-bugs] #28410 [Core Tor]: systemd restart loop when tor at default.service::Type=notify

[Tor Bug Tracker & Wiki]

#28410: systemd restart loop when tor at default.service::Type=notify
--------------------------------+--------------------------
 Reporter:  jchevali            |          Owner:  (none)
     Type:  defect              |         Status:  new
 Priority:  Medium              |      Component:  Core Tor
  Version:  Tor: 0.3.5.4-alpha  |       Severity:  Normal
 Keywords:  systemd             |  Actual Points:
Parent ID:                      |         Points:
 Reviewer:                      |        Sponsor:
--------------------------------+--------------------------
 I'm experiencing a 300sec restart loop when Tor is run as a service. This
 is Debian stretch using systemd.

 This is a system in which tor-0.3.4.8 was installed and running OK. Then I
 overrode the tor executable with a 0.3.5.4-alpha build (with configure
 {{{--prefix=}}}), and it started showing this problem.

 I tried some workarounds found on the Net, such as changing the /var/run
 symlink from /run to ../run (which shouldn't need to be done), tweaking
 values of ReadWriteDirectories in {{{tor at default.service}}}, and changing
 TimeoutStartSec to 0. None of that worked.

 What does work is setting Type=simple instead of notify, but then I came
 across ticket #11016 and really, notify should work. So if it doesn't, I
 wonder if this version of tor 0.3.5 alpha could have a fault? How can I
 look into that more closely to verify?

 This is the log in syslog prior to restart:

 {{{
 systemd[1]: tor at default.service: Start operation timed out. Terminating.
 systemd[1]: Failed to start Anonymizing overlay network for TCP.
 systemd[1]: tor at default.service: Unit entered failed state.
 systemd[1]: tor at default.service: Failed with result 'timeout'.
 systemd[1]: tor at default.service: Service hold-off time over, scheduling
 restart.
 systemd[1]: Stopped Anonymizing overlay network for TCP.
 systemd[1]: Starting Anonymizing overlay network for TCP...
 }}}

 And here is my current {{{tor at default.service}}}:

 {{{
 [Unit]
 Description=Anonymizing overlay network for TCP
 After=network.target nss-lookup.target
 PartOf=tor.service
 ReloadPropagatedFrom=tor.service

 [Service]
 #Type=notify
 Type=simple
 NotifyAccess=all
 PIDFile=/var/run/tor/tor.pid
 PermissionsStartOnly=yes
 ExecStartPre=/usr/bin/install -Z -m 02755 -o debian-tor -g debian-tor -d
 /var/run/tor
 ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-
 defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config
 ExecStart=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-
 defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0
 ExecReload=/bin/kill -HUP ${MAINPID}
 KillSignal=SIGINT
 TimeoutStartSec=300
 TimeoutStopSec=60
 Restart=on-failure
 LimitNOFILE=65536

 # Hardening
 AppArmorProfile=-system_tor
 NoNewPrivileges=yes
 PrivateTmp=yes
 PrivateDevices=yes
 ProtectHome=yes
 ProtectSystem=full
 ReadOnlyDirectories=/
 ReadWriteDirectories=-/proc
 ReadWriteDirectories=-/var/lib/tor
 ReadWriteDirectories=-/var/log/tor
 ReadWriteDirectories=-/var/run
 CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE
 CAP_DAC_READ_SEARCH
 }}}

 Advice?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/28410>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online