Timeline for Linux tor.service fails with "Unable to raise RLIMIT_MEMLOCK" at boot
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 17, 2020 at 7:57 | vote | accept | Cbhihe | ||
| Nov 15, 2020 at 19:57 | comment | added | Cbhihe |
@steve: [on DIsableAllSwap] You are right, I did not use the word (hardening) in the intervening explanations in the post, because I thought it hardly mattered. But the flag was always there and tagged # New. As it turns out it was in fact inconsequential. (I was effectively starting the service as User=root then switching to user tor.) Also I had tried both setups, with and without ... with the same result. The solution lies in attributing the right capabilities to the non-privileged process, be it from the start or later on if the process is owned by rootwhen execution starts.
|
|
| Nov 15, 2020 at 18:55 | comment | added | Steve | Your post didn't say anything about hardening, just that you upgraded your kernel version and it broke tor, and that you added new torrc options to try to fix it. | |
| Nov 15, 2020 at 18:51 | history | edited | Cbhihe | CC BY-SA 4.0 |
modified title to better reflect solved issue.
|
| Nov 15, 2020 at 10:57 | comment | added | Cbhihe |
... and to address your request, without any line tagged # New in the /etc/tor/torrc file above and with no User=root \n Group=root in the unit file, this is just reverting to the original setup, which just does not fly; hence my post. If I do add the capability per my comment above, it works as before.
|
|
| Nov 15, 2020 at 10:56 | comment | added | Cbhihe |
Yes, @Steve and thank you for helping. I new that and wanted DisableAllSwap 1 (defaults to 0) so memory would not be paged out (no "swapping") but would remain within the limits imposed by hardware and other process requirements. For me this was an experiment in trying to harden the box with that setup. The idea was to boot with User=root and Group=root and then reduce privileges to User tor in /etc/tor/torrc. This actually works if you add CAP_SYS_RESOURCE in your CapabilityBoundingSet in the tor-service unit file. I have not had the time to investigate that fully just yet.
|
|
| Nov 15, 2020 at 10:37 | answer | added | Cbhihe | timeline score: 1 | |
| Nov 14, 2020 at 19:59 | comment | added | Steve |
The Unable to raise RLIMIT_MEMLOCK error should only appear if you've set DisableAllSwap in your torrc, which requires you to start tor as root. Try removing that option and update your post with the new log messages if they change.
|
|
| Nov 14, 2020 at 17:48 | review | First posts | |||
| Nov 28, 2020 at 17:56 | |||||
| Nov 14, 2020 at 17:48 | history | asked | Cbhihe | CC BY-SA 4.0 |