write draft for stackable wrappers on debian-devel

phabricator-migrator · February 19, 2024, 5:44pm

Information

ID: 634
PHID: PHID-TASK-wusarvu2cuj63v67kpy4
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

Subject:

stackable wrappers

Draft:

github.com

Kicksecure/proposals/blob/master/634-stackable-wrappers.txt

# Stackable Wrappers (Proposal 634)

- Ticket: https://phabricator.whonix.org/T634
- File: https://github.com/Whonix/proposals/blob/master/634-stackable-wrappers.txt

# Description

In Debian there is no such thing as stackable wrappers. Would be desirable to have.

A wrapper in this context is defined as a minimal script that automatically prepends something in front of a program that the user wants to run. Or appends something such as default command line parameters.

Here are some examples of commands to prepend:

* firejail firefox
* torsocks gpg
* LD_PRELOAD="$LD_PRELOAD":libeatmydata.so rsync
* bindp, timeprivacy and probably a lot more
* probably quite some dpkg diversions used for that purpose

Here are some examples of commands to append:

This file has been truncated. show original

TODO:

improve draft
send to debian-devel mailing list
discuss on debian-devel

Comments

Patrick

2017-02-16 18:31:03 UTC

HulaHoop

2017-02-17 23:55:33 UTC

Patrick

2017-02-18 17:08:49 UTC

HulaHoop

2017-02-20 02:00:51 UTC

Patrick

2017-02-20 14:25:12 UTC

dau

2017-03-20 02:21:21 UTC

Patrick

2017-03-20 13:35:50 UTC

dau (Felipe Dau):

dau added a comment.

This is a great idea!

Thanks for the feedback!

One thought I had that is not too related to the actual “wrapping”, but might be important: my concern here is how this will be presented/documented to Tor users which gives the idea that “wrapping” an app with, for example, torsocks makes it “Tor-ready”. As it is discussed in the Torify HOWTO 0, there are quite a few aspects to be taken into account in order to torify an application. One silly example would be having an app that for some reason adds your real IP to its headers and once it is wrapped it now anonymously transmits your real IP.

I’d say it’s out of scope here. torsocks only serves as one example
among others here on how one might like to use multiple wrappers at once
by stacking them. The decision to use/not use torsocks on a non-Whonix
system is up the user. Any and torsocks leak issues are torsocks’ bugs.
I’d like to focus this proposal on stackable wrappers generally and
avoid anything Tor specific with the goal for getter better feedback on
the proposal.

Actually, if there was a good answer to this, then there would be much
less need for Whonix. In Whonix we use torsocks only on a best effort
basis for stream isolation. However, in Whonix, if torsocks leaks
something, it’s not catastrophic, since it leaks through Tor, not clear.net

dau

2017-03-21 01:26:37 UTC

! In T634#12786, @Patrick wrote:
Any and torsocks leak issues are torsocks’ bugs.

I believe it is not torsocks’ fault, but the app’s for “not knowing how to be anonymous”. In the end, it is really the user’s fault for not knowing what they were doing.

Actually, if there was a good answer to this, then there would be much
less need for Whonix. In Whonix we use torsocks only on a best effort
basis for stream isolation. However, in Whonix, if torsocks leaks
something, it’s not catastrophic, since it leaks through Tor, not clear.net

Right. Although I think that leaking identifying information through Tor is just as bad.

Going a bit more off-topic:

It’s surprising that there is not a single warning in torsocks’ docs/manual about how dangerous it can be to torify an app when you don’t know how it works

Is there documentation on “how to torify/make apps Whonix friendly/compliant”?

I’d like to focus this proposal on stackable wrappers generally and
avoid anything Tor specific with the goal for getter better feedback on
the proposal.

Whoops.

Regarding the proposal:

It is not clear to me how to actually specify the wrapping. For example:

What should be the contents of /etc/wrapper.d/30_usr.bin.gpg_torsocks.conf? Something like torsocks * ?

What about /etc/wrapper.d/30_usr.bin.zeronet_tor.conf? * --tor?

Thanks!

Patrick

2017-03-21 12:53:34 UTC

! In T634#12790, @dau wrote:

! In T634#12786, @Patrick wrote:
Any and torsocks leak issues are torsocks’ bugs.

I believe it is not torsocks’ fault, but the app’s for “not knowing how to be anonymous”. In the end, it is really the user’s fault for not knowing what they were doing.

Right. torsocks is somewhere in between. It’s useful for experts who know what they are doing or for users where it does not matter so much if DNS leaks or so. By simply prepending torsocks one can never get the same quality and assurances compared to more and more Tor/privacy-aware-by-default applications nowadays.

Going a bit more off-topic:

It’s surprising that there is not a single warning in torsocks’ docs/manual about how dangerous it can be to torify an app when you don’t know how it works

Right. (Feel free to report a bug against http://trac.torproject.org torsocks component.)

Is there documentation on “how to torify/make apps Whonix friendly/compliant”?

Just now created a discussion https://forums.whonix.org/t/best-practices-on-how-to-make-your-application-anonymity-privacy-whonix-friendly for it.

Regarding the proposal:

It is not clear to me how to actually specify the wrapping. For example:

What should be the contents of /etc/wrapper.d/30_usr.bin.gpg_torsocks.conf? Something like torsocks * ?

What about /etc/wrapper.d/30_usr.bin.zeronet_tor.conf? * --tor?

Good question. Undecided. Indeed, this draft is not as well specified as the convention in T635. Perhaps similar to T635 wrt include and config folder locations. The goal I had in mind when posting this is to have an open discussion on debian-devel and get some pointers which of the multiple suggested implementation paths are favored.

dau

2017-03-21 20:22:34 UTC

! In T634#12793, @Patrick wrote:
Right. (Feel free to report a bug against http://trac.torproject.org torsocks component.)

Good idea. Thanks!

Just now created a discussion https://forums.whonix.org/t/best-practices-on-how-to-make-your-application-anonymity-privacy-whonix-friendly for it.

Great!

Good question. Undecided. Indeed, this draft is not as well specified as the convention in T635. Perhaps similar to T635 wrt include and config folder locations. The goal I had in mind when posting this is to have an open discussion on debian-devel and get some pointers which of the multiple suggested implementation paths are favored.

I see. Then I think it would be useful to have a note there asking “how exactly should the wrapping be specified by the .conf files?” or something like that. What do you think?

Thanks!

Patrick

2017-03-21 22:10:29 UTC

Patrick

2019-08-17 06:56:43 UTC

dau

2017-03-21 23:36:37 UTC

dau

2017-04-08 23:28:30 UTC

Patrick

2020-02-29 11:09:45 UTC