torrc.d is comming

Sounds great to me. I will start working on the script right now.

1 Like

(Somehow my reply by e-mail was truncated.)

## Tor user specific configuration file
##
## Add user modifications below this line:
##########
1 Like

I tried the approach as follows, but it does not work as expected:

There are two problems:

  1. The script needs root, but systemd does not run it with root privilege
  2. The extended ExecStartPre in /lib/systemd/system/tor@default.service.d/40_torrcd-workaround.conf will only be executed after all the ExecStartPre in /lib/systemd/system/tor@default.service have been done. However, in /lib/systemd/system/tor@default.service, there is a line to check if Tor will work or not: ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config, and it will be executed (and then fail) before the script is executed.

iry:

I tried the approach as follows, but it does not work as expected:
Attempt to make sure all torrc files exist · irykoon/anon-gw-anonymizer-config@ae80ee0 · GitHub

There are two problems:

  1. The script needs root, but systemd does not run it with root privilege

This might be fixable using User= or so, but we shouldn’t do it. Too
intrusive since not our service. Could lead to bugs.

  1. The extended ExecStartPre in /lib/systemd/system/tor@default.service.d/40_torrcd-workaround.conf will only be executed after all the ExecStartPre in /lib/systemd/system/tor@default.service have been done. However, in /lib/systemd/system/tor@default.service, there is a line to check if Tor will work or not: ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config, and it will be executed (and then fail) before the script is executed.

I see. I doubt that can be solved directly.

So we need our own systemd unit file that uses systemd directive
Before=tor.service that runs make-sure-torrc-exist.

/lib/systemd/system/anon-gw-anonymizer-config.service or so.

(Or even Before=tor@default.service - only if that is required.)

Could you please move /usr/bin/make-sure-torrc-exist to
/usr/lib/anon-gw-anonymizer-config/make-sure-torrc-exist?

Otherwise we’d have to create and ship a man page (otherwise lintian
warning). And users wouldn’t run this command so be safe all this effort
by moving it to a more appropriate directory.

Could implement that please?

Hints for new systemd unit file packaging implementation:

  • In debian/control add to Build-Depends: dh-systemd.
  • In debian/rules, change dh $@ to dh $@ --with systemd.
  • There are quite a few systemd unit files in Whonix source code as
    examples.

myfind . | grep systemd | grep \.service | grep --invert-match \\.d | grep --invert-match \\.in

1 Like

Patrick Schleizer:

Could implement that please?

Yes, definitely! I consider it as a great learning opportunity. Thank
you so much for your instructions, Patrick!

1 Like

Qubes-Whonix
Now, that we no longer have to modify file /etc/tor/torrc, folder /etc/tor can and should be removed from bind-dirs?

bind-dirs reference:

1 Like
1 Like
1 Like

Again, thank your very much for your instructions, Patrick!

Done:

https://github.com/Whonix/anon-gw-anonymizer-config/pull/9

I set User=root in /lib/systemd/system/anon-gw-anonymizer-config.service. Otherwise, I do not know how to write to /use/local.

We should avoid any %include directory for now.

https://github.com/Whonix/anon-gw-anonymizer-config/pull/9/commits/17c3df9b7eb4d2ec496df8a262573fb85bb59379

1 Like
1 Like

Systemd units running as root is the systemd default. I doubt any of the
units in /lib/systemd/system/ use User=root. So this can be dropped.

1 Like

All merged, thanks! :slight_smile:

Some commits on top.

WantedBy… Not easy to explain. I learned this mostly by looking at other systemd unit files.
https://www.freedesktop.org/software/systemd/man/systemd.unit.html

Could you please review my latest additions?

1 Like

Hi Patrick!

For unknown reason, the latest tor@default.service does not work as expected:

sudo rm -r /usr/local/etc

Expected behavior: systemctl restart tor@default.service will run anon-gw-anonymizer-config.service which will grantee /usr/local/etc/torrc.d and the two files in it.
Actually, anon-gw-anonymizer-config.service will not be run, causing the Tor fail to start due to the missing torrc files. Running systemctl restart anon-gw-anonymizer-config.service manually will works fine though.

I tried to debug it by removing several additional commit but I did not figure out the reason.

1 Like

Works as expected by me. It only works after boot. (And this is important because that helps our torrc.d implementation also also creating the files in time for first boot and even in Qubes-Whonix.) It is to cover the Whonix specific implementation (which is not simple with Qubes vs persistence of TemplateBased VMs) so we can provide a config file for acw and user-modified-only. I think this is sufficient. (Deleting /usr/local/etc and then rebooting works as well.)

The case that the user deletes files and user restarts Tor is not covered.

  • Are there other systemd unit files where once you restart them, also another systemd unit gets restarted automatically beforehand?
  • Are there any other daemons that file to start if their config file is missing?
  • Are there any other daemons where missing config files in /etc (root required!) will be automagically created if missing?
  • If the user starts deleting files, it’s up to the user to fix?

(We could even do the opposite. Doing this creation of files only at first boot and not again.)

1 Like

https://github.com/Whonix/anon-gw-anonymizer-config/pull/11

1 Like

Whonix 14 repository Tor package was upgraded. Just now uploaded.

user@host:~$ anon-info
INFO: version of the 'tor' package: 0.3.3.7-1~d90.stretch+1

Would %include /etc/torrc.d/*.conf work now? If so, could you make the pull request please?

1 Like

I tried the latest uploaded Tor. No, it doesn’t work.

I’ve been keeping an eye on the ticket and the status is still needs_revision. Jigsaw52 has not been working on it after the review by ahf:


I will keep an eye on it and do a PR whenever the feature is ready.

Note: anon-verify also needs to be changed to simulate new parsing rule when it’s ready.

1 Like

Debian likes neither:

  • /etc/torrc.d/
  • /usr/local/etc/torrc.d/

Source:
Apparmor profile whitelist /etc/torrc.d/ and /usr/local/etc/torrc.d/
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910017

Maybe it will be /etc/tor/torrc.d/ but it’s not yet finally decided.

1 Like

Since still not done I am considering to create a script that runs before Tor which would move any files not ending with *.conf out of the way. May be possible to start using systemd drop-in ExecStartPre.

2 Likes