Running Tor in /opt

Question

I'm looking at using the Tor browser bundle, and the instructions have one run the bundle as a normal user (in my case, on Debian Jessie). This would seem to expose the Tor files to tampering in a way that is not the case with iceweasel.

Q1: are my concerns misplaced?

I've tried to run Tor inside of /opt with a softlink to /usr/local/bin/start-tor-browser, but unless I assign "my user:my user" to the entire "/opt/torfolder" I get a permission error. There is code to stop Tor running as root which I'd prefer not to comment out, but regardless I don't think that is the main problem at the moment.

Q: is there a "best practice" for running Tor as a normal user, but for protecting the Tor files from user tampering with permissions?

Q: What are the benefits/downsides of using visudo?

Thanks!

Answer 1

In complement of Alexey's detailed answer, let me add the following. As indicated, for instance, here, the simpler way to install tor browser in /opt on Linux is probably the following:

1. Download a bundle at https://www.torproject.org/download/#downloads
2. (optional, but recommended) Check the signature (https://support.torproject.org/tbb/how-to-verify-signature/)

3. Extract the file, for instance with

   tar -xvfJ tor-browser-linux64-9.0_en-US.tar.xz.asc
   

4. As root, move the files to /opt, using for instance

   mv tor-browser_en-US /opt
   

5. Finally, as a normal user, run the program with

       cd /opt/tor-browser_en-US/
       ./start-tor-browser.desktop
   

and you can even add to that latter command --register-app at the end, to be able to run the program from anywhere (i.e., to add it to the applications in your menu, for instance).

Answer 2

So - here are your answers, step by step:

• Q1 Tor has no folder-hardcode in it's entire source, and if you're about to use /opt/tordir or anything else that is physically reachable in your FileSystem API - it's totally OK. Just make sure that you will make it actually reachable by issuing chown -R tor-user:tor-user-primary-group /path/to/your/tordir and making it referenced as DataDirectory /full/path/to/your/tordir/from/the/very/top and corresponding values with full path too: GeoIPFile,GeoIPv6File,PidFile. And the magic goes on! Use User tor-user as the very last line in your torrc. That's it - I'm running Tor from it's dedicated and non-standart folder too.
• Q2 Make a separate directory for Tor(look Q1 answer), use /etc/torrc owned by root only and run it as a regular dedicated user. Additional file security is - actually - not required strictly, but of course a UMASK 077 is in order system-wide, or don't speak about a filesystem security on that host at all. Extra level of defense - above umask 077 - if you will need it - I'd recommend you AppArmor, used it in Ubuntu and in Debian. Really simple and powerful tool if you need some additional hardening.
• Q3 it's a native part of sudo toolset, so it's totally fine to use it: because only root is able to use it and even read a sudoers file. But as in any case of include-configs, do check that not a byte is included from either directories or files: all the sudo permissions must reside on one single file. And if you'll have a root account breached - your server is lost regardless of OS you're using(except MS-DOS, pehaps)

Feel free to ask more questions - I'll be glad to help!