Managing programs without Tor DNS Support / orjail

Patrick · August 27, 2018, 6:08am

extrarenous output by orjail on abort (CTRL + C / signal sigterm)

opened 06:08AM - 27 Aug 18 UTC

closed 08:22PM - 28 Aug 18 UTC

How to reproduce: Run `sudo orjail -y curl https://check.torproject.org`, pre…ss CTRL + C to abort. ---- Actual result: Output by orjail. ``` ^C * Received breakout signal cat: /tmp/orjail-orjail/pid: No such file or directory cat: /tmp/orjail-orjail/pid: No such file or directory rm: cannot remove '/tmp/tornJ6klJ': No such file or directory Cannot find device "in-orjail" Cannot remove namespace file "/var/run/netns/orjail": No such file or directory iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). rm: cannot remove '/tmp/resolvetxKF6i': No such file or directory ``` ---- Expected result: No extra output by orjail.

Patrick · August 27, 2018, 6:54am

github.com/orjail/orjail

support for ephemeral Tor hidden services / local listener support / onionshare

opened 06:54AM - 27 Aug 18 UTC

closed 04:04PM - 12 Feb 19 UTC

adrelanos

onionshare https://onionshare.org/ https://github.com/micahflee/onionshare…/raw/develop/screenshots/server.png * uses ephemeral Tor onion services * it creates a local listener (mini http server serving the file to be shared) ---- ephemeral Tor onion services * This basically means, that it uses the Tor ControlProtocol to create the hidden service. Not using torrc modifications. * Yes, ephemeral Tor hidden services can also persist between application starts. After creating it with add_onion new, you get the hidden service private key, can store it, and restore it later. * This can be done using python-stem. - https://packages.debian.org/stretch/python3-stem ---- `sudo orjail -y onionshare COPYING ` ``` Onionshare 1.3 | https://onionshare.org/ Traceback (most recent call last): File "/usr/lib/python3/dist-packages/onionshare/common.py", line 208, in get_available_port tmpsock.bind(("127.0.0.1", random.randint(min_port, max_port))) OSError: [Errno 99] Cannot assign requested address During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/onionshare/onion.py", line 193, in connect self.tor_socks_port = common.get_available_port(1000, 65535) File "/usr/lib/python3/dist-packages/onionshare/common.py", line 211, in get_available_port raise OSError(e) OSError: [Errno 99] Cannot assign requested address During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/bin/onionshare", line 22, in <module> onionshare.main() File "/usr/lib/python3/dist-packages/onionshare/__init__.py", line 86, in main onion.connect(settings=False, config=config) File "/usr/lib/python3/dist-packages/onionshare/onion.py", line 195, in connect raise OSError(strings._('no_available_port')) OSError: Could not start the Onion service as there was no available port ```

Patrick · August 28, 2018, 8:52pm

github.com/orjail/orjail

--yes should be default?

opened 08:48PM - 28 Aug 18 UTC

closed 11:14PM - 28 Aug 18 UTC

adrelanos

Without -y / --yes orjail interactively asks "Do you want to create it? [y/n]" I… don't see if I am using orjail and running "sudo orjail program-name" why I would want "no"? What's the use case for that? Could you please kindly consider dropping "-y" and making that the default? orjail is already very good. Besides the open issues, there is little until it's perfect. Requiring to type the `-y` is such an imperfection. I am coming form a perspective of orjail being a torsocks on steroids drop-in alternative.

Patrick · August 28, 2018, 9:08pm

github.com/orjail/orjail

allow running orjail without sudo by having orjail run sudo internally

opened 09:08PM - 28 Aug 18 UTC

adrelanos

The flowing is a bit strange. sudo orjail -y touch a Will the file be …owned by `root` or `user`? -> `user` But why since the whole command runs under `sudo`? A bit unexpected. vs sudo orjail -y sudo touch a Will the file be owned by `root` or `user`? -> `root` That syntax is a bit long though. ---- So I was wondering why not run `orjail` without `sudo`, and then `orjail` would internally use `sudo` whenever required? Maybe `orjail` could be running under user `orjail` and user `orjail` would have `/etc/sudoers.d/orjail` exceptions to run the required commands (`ip`, `iptables`, ...) under `root` using `sudo`. The end result could be: * `sudo orjail -y touch a` -> owned by `root` * `orjail -y touch a` -> owned by `user` If you're interested in this, I could try to come up with a pull request since I have some experiences running applications under user `something` and then having `/etc/sudoers.d/` exceptions to allow user `something` do run required commands as root.

Patrick · August 31, 2018, 8:32am

github.com/orjail/orjail

why do we need all those checks (on iptables)? - use ERR trap

opened 08:14AM - 31 Aug 18 UTC

closed 01:01PM - 04 Sep 18 UTC

adrelanos

Instead of individual error handling per command.... ``` iptables -I FORWARD… -i in-"$NAME" -j DROP || \ die "Failed to disable forwarding on in-$NAME interface" ``` May I suggest please using a general ERR trap? ``` error_handler() { local last_failed_exit_code="$?" local last_failed_bash_command="$BASH_COMMAND" die "$last_failed_bash_command failed with exit_code $last_failed_exit_code" } trap error_handler ERR ``` (Perfection would be reached by additionally using `set -e` (for the unlikely cases for the ERR trap not working or for cases of errors during ERR trap).)

github.com/orjail/orjail

use and reconfigure the host's Tor / circumvention/bridges support / keep existing Tor config

opened 08:27AM - 31 Aug 18 UTC

closed 04:06PM - 12 Feb 19 UTC

adrelanos

https://github.com/orjail/orjail/issues/45 made me wonder. Would it be sane t…o use the host's Tor? That would have several advantages: * user could maintain Tor's `Seccomp 1` security setting * (user could maintain Tor's AppArmor profile (already the case?)) * circumvention / Bridges settings would be preserved * Tor already running, and connected (responsibility of the user / sysadmin) * preserving any other user settings ([many](https://www.torproject.org/docs/tor-manual.html.en)) To make things more leak proof, would it be an option to use Tor unix domain socket files rather than listening ports? (#47) A new Tor `TransPort` / `DnsPort` could be dynamically added to the running Tor by using [Tor control protocol](https://gitweb.torproject.org/torspec.git/tree/control-spec.txt) using Tor's `ControlPort` or `ControlSocket`. If that is not sane, what about preserving Tor's config? (Simply copying /etc/tor/torrc would be imperfect due to Tor feature:) > Configuration options can be imported from files or folders using the `%include` option with the value being a path.