sdwdate and sdwdate-gui development thread

[Patrick]

madaidan via Whonix Forum:

Cx is for child profiles which are profiles within a profile. e.g.

profile example /usr/bin/example {
  
  ...

  /usr/bin/example2 rCx,


  profile example2 /usr/bin/example2 {
    ...
  }

}

You’re looking for the Px rule which makes the program transition to a profile that’s the same name of the program, not specifically a child profile.

Unfortunately does not work either.

Dec 23 07:26:59 work kernel: audit: type=1400
audit(1577104019.726:961): apparmor=“DENIED” operation=“exec” info=“no
new privs” error=-1 profile=“/usr/bin/sdwdate”
name=“/usr/lib/sdwdate/url_to_unixtime” pid=13236 comm=“sdwdate”
requested_mask=“x” denied_mask=“x” fsuid=107 ouid=0
target=“/usr/lib/sdwdate/url_to_unixtime”

[madaidan]

I think that might be an issue with sdwdate’s sandboxing (Systemd sandboxing fails when using a full system apparmor policy · Issue #14277 · systemd/systemd · GitHub). Try disabling it and see if it works.

[Patrick]

Could you fix these please?

Happening on sudo /usr/lib/sdwdate/restart_fresh.

Jan 14 20:51:41 host audit[22474]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/mktemp” pid=22474 comm=“sdwdate” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/mktemp”
Jan 14 20:51:41 host audit[22474]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/mktemp” pid=22474 comm=“sdwdate” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/mktemp”
Jan 14 20:51:41 host sdwdate[22472]: 2020-01-14 20:51:41 - sdwdate - INFO - create temp_dir: /tmp/tmp.mJZmHLnAca
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.575:168): apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/mktemp” pid=22474 comm=“sdwdate” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/mktemp”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.575:169): apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/mktemp” pid=22474 comm=“sdwdate” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/mktemp”
Jan 14 20:51:41 host sdwdate[22472]: 2020-01-14 20:51:41 - sdwdate - INFO - Tor socks host: 127.0.0.1 Tor socks port: 9050
Jan 14 20:51:41 host sdwdate[22472]: 2020-01-14 20:51:41 - sdwdate - INFO - Running sdwdate main loop. iteration: 1 / 10000
Jan 14 20:51:41 host audit[22476]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22476 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22476]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22476 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.587:170): apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22476 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.587:171): apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22476 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22477]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22477 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22477]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22477 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22478]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22478 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22478]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22478 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.591:172): apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22477 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.591:173): apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22477 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.591:174): apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22478 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.591:175): apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22478 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22479]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22479 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22479]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22479 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22480]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22480 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22480]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22480 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.595:176): apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22479 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host kernel: audit: type=1400 audit(1579035101.595:177): apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22479 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22481]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/rm” pid=22481 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/rm”
Jan 14 20:51:41 host audit[22481]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/rm” pid=22481 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/rm”
Jan 14 20:51:41 host Tor[876]: New control connection opened.
Jan 14 20:51:41 host audit[22486]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/cat” pid=22486 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/cat”
Jan 14 20:51:41 host audit[22486]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/cat” pid=22486 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/cat”
Jan 14 20:51:41 host audit[22487]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/rm” pid=22487 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/rm”
Jan 14 20:51:41 host audit[22487]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/rm” pid=22487 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/rm”
Jan 14 20:51:41 host Tor[876]: New control connection opened.
Jan 14 20:51:41 host audit[22492]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/cat” pid=22492 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/cat”
Jan 14 20:51:41 host audit[22492]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/cat” pid=22492 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/cat”
Jan 14 20:51:41 host audit[22493]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22493 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22493]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22493 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22494]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/rm” pid=22494 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/rm”
Jan 14 20:51:41 host audit[22494]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/rm” pid=22494 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/rm”
Jan 14 20:51:41 host Tor[876]: New control connection opened.
Jan 14 20:51:41 host audit[22499]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/cat” pid=22499 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/cat”
Jan 14 20:51:41 host audit[22499]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/cat” pid=22499 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/cat”
Jan 14 20:51:41 host audit[22500]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22500 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22500]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22500 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22501]: AVC apparmor=“ALLOWED” operation=“exec” profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22501 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”
Jan 14 20:51:41 host audit[22501]: AVC apparmor=“ALLOWED” operation=“exec” info=“no new privs” error=-1 profile=“/usr/bin/sdwdate” name=“/usr/bin/date” pid=22501 comm=“te_pe_tb_check” requested_mask=“x” denied_mask=“x” fsuid=116 ouid=0 target=“/usr/bin/sdwdate//null-/usr/bin/date”

[madaidan]

https://github.com/Whonix/sdwdate/pull/23

[Patrick]

Awesome. No more denied messages for now.

[Patrick]

Suggest Trustworthy Tor Hidden Services as Time Sources for sdwdate

(Curl --head also Not OK) That is a bug. ctemplarpizuduxk3fkwrieizstx33kg5chlvrh37nz73pv5smsvl6ad.onion: b’Parsing HTTP header date failed. I am not sure. That might be happening because url_to_unixtime uses http 1.0. ctemplar might require at least http 1.1. The following code is related: s.send('HEAD / HTTP/1.0\r\n\r\n'.encode()) I didn’t manage to update that to http 1.1. (No, it’s not just about changing the string 1.0 to 1.1. That would be easy. By doing that, many webservers repo…

[Patrick]

sdwdate/usr/bin/url_to_unixtime at master · Kicksecure/sdwdate · GitHub wants lots of apparmor permissions. How can this be avoided? @madaidan

AVC apparmor=“DENIED” operation=“exec” profile=“/usr/bin/url_to_unixtime” name=“/usr/bin/x86_64-linux-gnu-gcc-8” comm=“url_to_unixtime” requested_mask=“x” denied_mask=“x”
AVC apparmor=“DENIED” operation=“exec” profile=“/usr/bin/url_to_unixtime” name=“/usr/bin/x86_64-linux-gnu-ld.bfd” comm=“url_to_unixtime” requested_mask=“x” denied_mask=“x”
AVC apparmor=“DENIED” operation=“exec” profile=“/usr/bin/url_to_unixtime” name=“/usr/lib/gcc/x86_64-linux-gnu/8/collect2” comm=“gcc” requested_mask=“x” denied_mask=“x”
AVC apparmor=“DENIED” operation=“open” profile=“/usr/bin/url_to_unixtime//null-/sbin/ldconfig” name=“/etc/ld.so.cache” comm=“ldconfig” requested_mask=“r” denied_mask=“r”

This is probably from python attempting to compile ,pyc files for optimization. That script however doesn’t need any performance optimization whatsoever. It is fine and more than fast enough even without compilation.

Attempted to disable ,pyc file creation:

• python -B
• environment variable PYTHONDONTWRITEBYTECODE=1
• sys.dont_write_bytecode = True

But none of that worked.

Is there some way to add in an apparmor profile “good enough - stop reporting further denials”? I guess not as per:

Turn off logging (#72) · Issues · AppArmor / apparmor · GitLab

[nurmagoz]

sdwdate need to have new design of getting its time corrected, because sdwdate can be turned off through turning off all onion connection from the Tor network itself:

v3 onion services require a "live" consensus to publish or fetch (#40237) ·...

And today the issue is fixed (connecting to onion v3) without a single update or manual configuration to Tor client, This shows clear instability when relying on Tor network to do always the job.

I believe I2P support should be added to the development of sdwdate either when Tor fail to connect to then switch to it or as a replacement to Tor entirely (but we dont need to go to the extreme version now as there are no signs showing the need to do that yet).

[Patrick]

Most Onions Down due to a Denial of Service Attack on the Tor Network

Since yesterday due to a denial of service (DOS) on the Tor network most onions where down. Most sdwdate onion time sources and SecureDrop onions didn’t work for me. The following references mention onion v3 only but most onions either v2 or v3 where inaccessible for me. https://gitlab.torproject.org/tpo/core/tor/-/issues/40237 https://lists.torproject.org/pipermail/network-health/2021-January/000659.html Quote Roger: Hi folks, The overload bugs on the directory authorities are continuing…

@Patrick

Since sdwdate relies on Tor consensus (Tor Consensus Time Sanity Check) and fetches time from onions it can no longer fetch and update the system time.

@nurmagoz

I believe I2P support should be added to the development of sdwdate

Not sure that is possible. I2P also needs a (somewhat?) correct clock to be able to connect to the I2P network. Maybe it’s even less tolerant to skewed clock than Tor? Therefore we have a similar bootstrap problem. System clock too slow or too fast for I2P being able to connect → sdwdate cannot cannot use I2P to fetch time from I2P eepsites.

[Patrick]

System-wide sandboxing framework - sandbox-app-launcher

Should file /etc/sandbox-app-launcher/url_to_unixtime.conf ## Copyright (C) 2020 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net> ## See the file COPYING for copying conditions. allow_net=yes allow_webcam=no allow_mic=no shared_storage=read-only allow_dynamic_native_code_exec=yes be added to package sdwdate or sandbox-app-launcher? Also a setting shared_storage=no would be good?

System-wide sandboxing framework - sandbox-app-launcher

Cannot manage to run /usr/bin/url_to_unixtime. (Currently in sdwdate git master and developers repository only.) sudo bash -x sandbox-app-launcher run url_to_unixtime /usr/bin/url_to_unixtime /var/cache/sandbox-app-launcher-autogenerated/wrappers-wx/url_to_unixtime: /usr/bin/url_to_unixtime: /usr/bin/python3: bad interpreter: Operation not permitted AVC apparmor="DENIED" operation="ptrace" profile="sandbox-app-launcher-wx" pid=29770 comm="systemd-detect-" requested_mask="read" denied_mask…

[Patrick]

sdwdate improvements have been implemented in git master and Whonix developers repository:

• sdwdate can now recover, successfully set the system clock even if system clock is so slow (year 2000) or fast (year 2050) so that Tor is unable to connect.
  • Based on Fixing Time based on Tor Consensus.
• The time fetching part of sdwdate (abstracted as separate script url_to_unixtime so it can be more easily confined) is now a python3 requests based implementation with the following features:
  • HTTP header fetching
  • HTTP header parsing (we need the Date: field)
  • HTTP 1.0 and HTTP 1.1 compatibility
  • TLS support
  • socks support (for Tor configuration and stream isolation)

Issue of Most Onions Down due to a Denial of Service Attack on the Tor Network / sdwdate synchronisation fails, sometimes works - #4 by Patrick has not been addressed due to lack of a concept how sdwdate could fetch time if most onions are down most of the time.

---

• sdwdate/sdwdate at master · Kicksecure/sdwdate · GitHub
• sdwdate/url_to_unixtime at master · Kicksecure/sdwdate · GitHub
• sdwdate/usr.bin.sdwdate at master · Kicksecure/sdwdate · GitHub
• sdwdate/usr.bin.url_to_unixtime at master · Kicksecure/sdwdate · GitHub
• sdwdate/sdwdate.service at master · Kicksecure/sdwdate · GitHub
• https://github.com/Whonix/sdwdate/blob/master/lib/systemd/system/sdwdate-restart-tor-request-file-watcher.service
• https://github.com/Whonix/sdwdate/blob/master/usr/lib/sdwdate/sdwdate-restart-tor-request-file-watcher
• sdwdate/test-clock-fast at master · Kicksecure/sdwdate · GitHub
• sdwdate/test-clock-slow at master · Kicksecure/sdwdate · GitHub

---

• helper-scripts/anondate at master · Kicksecure/helper-scripts · GitHub
• helper-scripts/anondate-get at master · Kicksecure/helper-scripts · GitHub
• helper-scripts/anondate-set at master · Kicksecure/helper-scripts · GitHub
• helper-scripts/anondate-tester at master · Kicksecure/helper-scripts · GitHub
• https://github.com/Whonix/helper-scripts/blob/master/etc/apparmor.d/usr.sbin.anondate-get
• https://github.com/Whonix/helper-scripts/blob/master/etc/apparmor.d/usr.sbin.anondate-set

---

Could use some help with apparmor / seccomp / systemd / sandbox-app-launcher confinement.

disable systemd hardening

//cc @madaidan

[Patrick]

@Patrick

Could use some help with apparmor / seccomp / systemd / sandbox-app-launcher confinement.

@Patrick

disable systemd hardening

This was resolved thanks to:

Apply systemd sandboxing by default to some services

Is disable systemd hardening · Kicksecure/sdwdate@b5f0ea1 · GitHub still a problem? I can’t reproduce it with the sandboxing enabled. I can send a PR to strengthen sdwdate’s sandboxing too if that isn’t an issue anymore.

[Patrick]

Full System AppArmor Policy - Testers Wanted!

sdwdate is not supposed to be run in terminal under user user. Maybe useful during development without AppArmor profile. But otherwise sdwdate’s AppArmor profile doesn’t support that. And if it did, it might weaken AppArmor protections. Dunno. Maybe with some HOME variable in sdwdate apparmor profile it might work. I think running sdwdate under user user was discussed earlier in these forums somewhere. I am not sure what I should be doing in such situations. Changing the clock requires root or …

port from tor-control-status tor_status to anon-connection-wizard

[Patrick]

access control disabled, clients can connect from any host

That comes from this:

Kicksecure/sdwdate-gui/blob/master/usr/bin/sdwdate-gui#L6

QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to ‘/tmp/runtime-sdwdate-gui’

See also below.

I guess don’t fix if not broken. We possibly need to redesign this for wayland anyhow. See also above.

[Patrick]

Add 'autostart=no' option to qrexec policy

qubes-core-admin-addon-whonix sdwdate-gui qrexec service should use autostart=no

[Patrick]

fix

minor

restart action: use `sdwdate-clock-jump`

[nurmagoz]

sdwdate-gui wont show up in the taskbar on non-kicksecure-xfce DE like e.g Gnome

---

Confusing Thing: (Whonix-WS)

Permission Denied because root not used:

user@host:~$ sdwdate --verbose --debug
2022-05-31 17:05:34 - sdwdate - INFO - sdwdate started. PID: 42564
Traceback (most recent call last):
File “/usr/bin/sdwdate”, line 10, in
sdwdate.main()
File “/usr/lib/python3/dist-packages/sdwdate/sdwdate.py”, line 1018, in main
global_files()
File “/usr/lib/python3/dist-packages/sdwdate/sdwdate.py”, line 970, in global_files
Path(sdwdate_status_files_folder).mkdir(parents=True, exist_ok=True)
File “/usr/lib/python3.9/pathlib.py”, line 1312, in mkdir
self._accessor.mkdir(self, mode)
PermissionError: [Errno 13] Permission denied: ‘/home/user/sdwdate’
user@host:~$

But sdwdate should not run as root:

user@host:~$ sudo sdwdate --verbose --debug
2022-05-31 17:05:18 - sdwdate - INFO - sdwdate started. PID: 42562
2022-05-31 17:05:18 - sdwdate - ERROR - Exit error… sdwdate should not be run as root!
2022-05-31 17:05:18 - sdwdate - INFO - Exiting with exit_code ‘1’ because or reason ‘sdwdate should not be run as root.’.
2022-05-31 17:05:18 - sdwdate - INFO - sdwdate stopped by user or system.
write_status unexpected error: <class ‘NameError’>
2022-05-31 17:05:18 - sdwdate - INFO - sclockadj process not running, ok.
2022-05-31 17:05:18 - sdwdate - INFO - sleep process not running, ok.
Traceback (most recent call last):
File “/usr/bin/sdwdate”, line 10, in
sdwdate.main()
File “/usr/lib/python3/dist-packages/sdwdate/sdwdate.py”, line 1013, in main
exit_handler(exit_code, reason)
File “/usr/lib/python3/dist-packages/sdwdate/sdwdate.py”, line 116, in exit_handler
Path(sleep_long_file_path).unlink(missing_ok=True)
NameError: name ‘sleep_long_file_path’ is not defined

?

[Patrick]

https://www.kicksecure.com/wiki/Dev/sdwdate#sdwdate_linux_user_account

[Patrick]

avoid accidentally starting sdwdate as user/root,