Long Wiki Edit Thread

Website
1941

Upstream swift fix.

1942

New wiki chapter:
Generic Bug Reproduction

1943

You might be interested in this.

  1. Open Source Security Metrics

https://metrics.openssf.org/search?q=whonix

(Whonix scoring around 48-50%)

  1. ossf / scorecard

Release v2.0.0 · ossf/scorecard · GitHub
https://raw.githubusercontent.com/ossf/scorecard/main/cron/data/projects.csv

Result: github.com/Whonix/Whonix,criticality_score:0.482730

  1. google / oss-fuzz

GitHub - google/oss-fuzz: OSS-Fuzz - continuous fuzzing for open source software.

(Useful for Whonix?)

1 Like
1944

new wiki chapter:
VirtualBox Generic Bug Reproduction

1945

sure will do

Edit: fixed from them, working fine from my side.

1 Like
1946

Thanks.

@Patrick I don’t think it is risky for us to publish Host Kernel Hardening while awaiting madaidan’s website changes - we have his permission on this forum after all.

Also, Since Tor’s sandbox feature seems perpetually broken/non-functional can/should we run Tor in a chroot jail, or at least provides wiki instructions to do so as an optional configuration?

No idea if this would work in Whonix configuration. (On a side note there is a lot of the Arch wiki we could rip off for security-related matters in our own wiki. TODO)

Tor - ArchWiki

For security purposes, it may be desirable to run Tor in a chroot. The following script will create an appropriate chroot in /opt/torchroot:

~/torchroot-setup.sh

#!/bin/bash
export TORCHROOT=/opt/torchroot

mkdir -p $TORCHROOT
mkdir -p $TORCHROOT/etc/tor
mkdir -p $TORCHROOT/dev
mkdir -p $TORCHROOT/usr/bin
mkdir -p $TORCHROOT/usr/lib
mkdir -p $TORCHROOT/usr/share/tor
mkdir -p $TORCHROOT/var/lib
mkdir -p $TORCHROOT/var/log/tor/

ln -s /usr/lib $TORCHROOT/lib
cp /etc/hosts $TORCHROOT/etc/
cp /etc/host.conf $TORCHROOT/etc/
cp /etc/localtime $TORCHROOT/etc/
cp /etc/nsswitch.conf $TORCHROOT/etc/
cp /etc/resolv.conf $TORCHROOT/etc/

cp /usr/bin/tor $TORCHROOT/usr/bin/
cp /usr/share/tor/geoip* $TORCHROOT/usr/share/tor/
cp /lib/libnss* /lib/libnsl* /lib/ld-linux-.so /lib/libresolv* /lib/libgcc_s.so* $TORCHROOT/usr/lib/
cp $(ldd /usr/bin/tor | awk ‘{print $3}’|grep --color=never “^/”) $TORCHROOT/usr/lib/

/var/log/tor/notices.log is only needed if you run hidden services

cp /var/log/tor/notices.log $TORCHROOT/var/log/tor/

cp -r /var/lib/tor $TORCHROOT/var/lib/
cp /etc/tor/torrc $TORCHROOT/etc/tor/

chown tor:tor $TORCHROOT
chmod 700 $TORCHROOT
chown -R tor:tor $TORCHROOT/var/lib/tor
chown -R tor:tor $TORCHROOT/var/log/tor

sh -c “grep --color=never ^tor /etc/passwd > $TORCHROOT/etc/passwd”
sh -c “grep --color=never ^tor /etc/group > $TORCHROOT/etc/group”

mknod -m 644 $TORCHROOT/dev/random c 1 8
mknod -m 644 $TORCHROOT/dev/urandom c 1 9
mknod -m 666 $TORCHROOT/dev/null c 1 3

if [[ “$(uname -m)” == “x86_64” ]]; then
cp /usr/lib/ld-linux-x86-64.so* $TORCHROOT/usr/lib/.
ln -sr /usr/lib64 $TORCHROOT/lib64
ln -s $TORCHROOT/usr/lib ${TORCHROOT}/usr/lib64
fi

After running the script as root, Tor can be launched in the chroot with the command:

chroot --userspec=tor:tor /opt/torchroot /usr/bin/tor

or, if you use systemd, overload the service:

/etc/systemd/system/tor.service.d/chroot.conf

[Service]
User=root
ExecStart=
ExecStart=/usr/bin/sh -c “chroot --userspec=tor:tor /opt/torchroot /usr/bin/tor -f /etc/tor/torrc”
KillSignal=SIGINT

2 Likes
1947

That would be an exclusive permission (full terms and conditions unclear, perhaps revokeable…) which doesn’t extend to anyone who would want to fork that text. Would still be proprietary (copyrighed) as per copyright laws default. Proper Open Source projects, specifically bigger ones, don’t accept content/contributions without crystal clear licensing.

chroot is not a security feature.

related:

The tor package by default already comes with:

  • /lib/systemd/system/tor@default.service various systemd hardening
  • /etc/apparmor.d/system_tor an apparmor profile.

That is sandboxing. Potential enhancements should be contributed upstream.

A custom chroot solution would be weaker and more stability fragile.

1948
1949

Could you review Wiki History please? @HulaHoop

1950

Rejected. We don’t add obscure altcoins to our wiki (which implies endorsement) just because they slapped on a buzzword (in this case “quantum”) on their website.

I have no idea what the qualifications of the people behind is or what their motives are.

1 Like
1951

For reference, was about this edit:
Wiki History

1952
1953

New wiki chapter:
Onion v2 Deprecation

1954

new wiki page:

1955

made a change with the installation command and i added apparmor-utils because it doesnt come by default with debian and without it “aa-enforce” command is not there.

1 Like
1956

Great. Reminded me to update chapter AppArmor Notifications and document apparmor-notify.

1957

new wiki chapter:
Tor Generic Bug Reproduction

1958

Moved all discussion duplicated in this forum thread exclusively here:

1959

New wiki page:

(Similar to:

)

1960

Updated: