Cannot use Seccomp in sys-whonix after update

Hello, today after updating my whonix-15 template and restarting my sys-whonix, I got the following error:

ERROR: Tor Pid Check Result: Tor not running. (tor_pid_message: Pid file /run/tor/tor.pid does not exist.) You have to fix this error, before you can use Tor. Please restart Tor after fixing this error. dom0 -> Start Menu -> ServiceVM: sys-whonix-xmr -> Restart Tor or in Terminal: sudo service tor@default restart Restart whonixcheck after fixing this error. dom0 -> Start Menu -> ServiceVM: sys-whonix-xmr -> Whonix Check or in Terminal: whonixcheck

I checked /var/run/tor/log and found these lines:

Sep 14 01:02:15.000 [warn] sandbox_intern_string(): Bug: No interned sandbox parameter found for /var/lib/tor/authdir (on Tor 0.4.3.6 ) Sep 14 01:02:15.000 [warn] Directory /var/lib/tor/authdir cannot be read: Operation not permitted Sep 14 01:02:15.000 [warn] Failed to parse/validate config: Failed to configure client authorization for hidden services. See logs for details. Sep 14 01:02:15.000 [err] Reading config failed--see warnings above. For usage, try -h. Sep 14 01:02:15.000 [warn] Restart failed (config error?). Exiting.

I tried to comment out “sandbox 1” in /usr/local/etc/torrc.d/50_user.conf and restarted tor. This time everything worked normally. But I would like Seccomp to stay for security reasons. Is there any way to fix this? Thank you!

Probably remove

ClientOnionAuthDir /var/lib/tor/authdir

from file

/etc/torrc.d/65_gateway.conf

Also most helpful if you could help with this:
Try reproduce this on non-Whonix. I.e. reproduce this for example in a Debian VM. I.e. /etc/tor/torrc with ClientOnionAuthDir /var/lib/tor/authdir and Sandbox 1. Then report at the Tor Project bug tracker.

Removing “ClientOnionAuthDir /var/lib/tor/authdir” from 65_gateway.conf did solve the problem. Will try to reproduce it in Debian VM and report to Tor bug tracker. Thanks for the help!

1 Like

Same here. What impact does this solution have on system security/stability/privacy? Is it temporary?

Impact:

  • privacy: none
  • security: you’re missing out on Seccomp
  • stability: none

Temporary? 1) until the bug is reported upstream against Tor Project (see my previous post) + 2) until fixed upstream

See: [tor-dev] [tor-relays] Did 'Sandbox 1' break Tor for anyone else on 0.4.5.6?

Did ‘Sandbox 1’ break Tor for anyone else on 0.4.5.6?

1 Like