Prerequisite knowledge:
Ticket:
https://phabricator.whonix.org/T118
Related:
[quote=“troubadour, post:447, topic:108”][quote author=Patrick link=topic=97.msg5328#msg5328 date=1415400889]
Working on https://github.com/Whonix/Whonix/issues/167 at the moment.
Getting this.
Nov 7 22:51:47 host kernel: [ 2923.658653] type=1400 audit(1415400707.346:32): apparmor="DENIED" operation="rename_src" parent=1 profile="system_tor" name="/etc/tor/torrc" pid=12507 comm="tor" requested_mask="wd" denied_mask="wd" fsuid=106 ouid=0What must I add to fix it? Trying like crazy…
/etc/apparmor.d/local/system_tor /etc/tor/torrc rwmixkl,
/etc/tor/torrc.anondist rwmixkl,Restarted Tor…
Doesn’t help.
[/quote]
Most likely, the problem does not come from system-tor profile. Could you check that tor-launcher (what did you install, by the way?) has not installed its own profile. There is a bug in Vidalia. https://bugs.launchpad.net/ubuntu/+source/vidalia/+bug/680192[/quote]
TBB for Linux from The Tor Project does not ship its own AppArmor profile. Throughly searched for any signs of AppArmor. And it makes sense. Otherwise Micah Lee wouldn’t have developed AppArmor profiles for torbrowser-launcher.
I am very certain it’s causes by system_tor, because when I set in /etc/default/tor
# USE_AA_EXEC="yes" # default
USE_AA_EXEC="no"
then the AppArmor denied messages vanished.
I downloaded TBB using tb-updater using these instructions:
Then started experimenting. Put a script named “a” (any name would work) into ~/tor-browser_en-US.
Credits go to Tails.
(Original source: https://git-tails.immerda.ch/tails/plain/config/chroot_local-includes/usr/local/sbin/tails-tor-launcher)
#!/bin/sh
## This file is part of Whonix.
## Copyright (C) Amnesia <amnesia at boum dot org>
## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Original source from Tails:
## https://git-tails.immerda.ch/tails/plain/config/chroot_local-includes/usr/local/sbin/tails-tor-launcher
set -x
set -e
unset TOR_CONTROL_PASSWD
unset TOR_FORCE_NET_CONFIG
TOR_CONFIGURE_ONLY=1
TOR_CONTROL_PORT=9051
TOR_CONTROL_COOKIE_AUTH_FILE=/var/run/tor/control.authcookie
export TOR_CONFIGURE_ONLY
export TOR_CONTROL_PORT
export TOR_CONTROL_COOKIE_AUTH_FILE
#if echo "$@" | grep -qw -- --force-net-config; then
TOR_FORCE_NET_CONFIG=1
export TOR_FORCE_NET_CONFIG
#fi
# Get LIVE_USERNAME
#. /etc/live/config.d/username.conf
LIVE_USERNAME=user
# Get LANG
. /etc/default/locale
#until pgrep -u "${LIVE_USERNAME}" nm-applet >/dev/null ; do
# sleep 5
#done
export LANG
#export DISPLAY=':0.0'
#export XAUTHORITY="`echo /var/run/gdm3/auth-for-${LIVE_USERNAME}-*/database`"
#sudo -u ${LIVE_USERNAME} xhost +SI:localuser:user
#gksudo -u user /usr/bin/tor-launcher
./start-tor-browser
RET=${?}
#sudo -u ${LIVE_USERNAME} xhost -SI:localuser:user
# Save ~10 RAM (due to the tmpfs) by removing this unused file
#rm -f /usr/Data/Browser/*.default/places.sqlite
exit ${RET}(Still need to pretty that up. IF we can go that route. Just an experiment for now.)
Got that message when running.
./aLooks like reboot was required. Stopping/starting Tor didn’t do.
Then I got another denied message.
type=1400 audit(1415567983.905:23): apparmor="DENIED" operation="rename_dest" parent=1 profile="system_tor" name="/etc/tor/torrc.orig.1" pid=18142 comm="tor" requested_mask="wc" denied_mask="wc" fsuid=106 ouid=0Fixed by using /etc/apparmor.d/local/system_tor with.
/etc/tor rwmixkl,
/etc/tor/** rwmixkl,Reboot required again. Why?
No more AppArmor issues after reboot.
[
After relaxing file permissions.
sudo chmod o+rw /etc/tor
sudo chmod o+rw /etc/tor/**Using the above script, tor-launcher was able to manipulate /etc/tor/torrc.
It doesn’t work yet. And I don’t know it’s a sane idea yet. Discussion about that should probably go into a separate thread.
]
