3

i am using the newest tbb version 6.0.1 on ubuntu 12.04. i wanted to know, if it is possible (and recommended) to start tbb with another user, for example user "tor_browser"? i just found that issue: Use Tor browser as non-root Linux but i had no success doing that way. i tried as follows:

  1. created new user "tor_browser"
  2. copied the tbb in the home dir of that user
  3. changed terminal dir to the tor_browser_LANG folder
  4. used this command: gksu -w -u tor_browser ./start-tor-browser.desktop
  5. entered password for user tor_browser
  6. the terminal shows: Launching './Browser/start-tor-browser --detach'... but nothing happened...

do i need to give the user some other privileges or add him to other groups? this user just has the rights for the tor_browser_LANG folder: he can read, write and execute it..

thanks in advanced :)

  • To what end? This would only be useful to avoid running it as a privileged user and even so the fact that you'd be running it inside the X session of the privileged user, means for all intents and purposes, it's running as a privileged user. This isn't meaningful security. – cacahuatl Jun 12 '16 at 19:27
  • The reason is, that I want to use a separated user which is able to surf with the tor browser. I normally use a firewall where I give all my users specific rights, for example the "tor_browser" has only the right to use the http and https ports. This user has no any other permissions to use other ports. Yeah I read there is a little security vulnerability in case of the X-server, but for Ubuntu there is no other solution at the moment. I read it here: wiki.ubuntuusers.de/Programme_abschotten but it is in german..Or do you have another tip for me to solve it on a similar way? – squirrel Jun 13 '16 at 8:12
  • Run tor as a system service, allow the debian-tor user through the packet filter, then connect your browser to the debian-tor user. – cacahuatl Jun 13 '16 at 15:51
  • Sorry I don't understand your way. What do you mean with "connect your browser to the debian-tor user"? – squirrel Jun 15 '16 at 15:31
  • *connect your tor browser to user tor instance running as the debian-tor user. see this wiki article as an example: trac.torproject.org/projects/tor/wiki/TorBrowserBundleSAQ – cacahuatl Jun 15 '16 at 18:48
1

I guess I'll try to formulate a full answer to this.

Your privilege seperation is security theatre.

Running Tor Browser as another user inside of the same X environment means the Tor Browser, regardless of an UID it is run under, can influence anything you can through your desktop, as an example see mjg59's Circumventing Ubuntu Snap confinement.

Your packet filtering is misguided.

You said "for example the "tor_browser" has only the right to use the http and https ports". The Tor Browser only uses ports 9150 and 9151. 9150 is the SOCKS where connections to arbitrary ends-points can be negotiated. Restricting tor "tor_browser" user ports 80 and 443 only restricts the selection of guards that the tor instance running as "tor_browser" can make.

What should I do?

If you want to create a tails-like setup where a packet filter enforces tor-only traffic, then you should instead run tor as a system daemon under a low privileged user and allow it and only it to send traffic out to the internet, then configure your Tor Browser running as your user to connect to the system daemon. You can do this by following this guide.

But I'd like better security still

You might consider using some of the modern sandboxing mechanisms built into the linux kernel. Create a new network namespace so the process only sees the local loopback device, create a read-only filesystem and mount a tmpfs with your copy of tor browser copied into it, use seccomp sandboxing (at least blacklisting if not whitelisting) to reduce the damage an exploit might do and any privilege escalation or lateral movement it might perform. You could also consider, along with these steps, using something like Xephyr or xpra to create a sandboxed X environment within your normal X environment. This would stop Tor Browser from being able to read your keystrokes to other windows or inserting its own keystrokes into other X windows. This is how Subgraph approaches the problem.

The alternative is to use a hypervisor and run entirely distinct operating systems to achieve the same effects at slightly more cost for more clean and distinct isolation, as per Qubes OS or Whonix.

  • Thanks a lot for your detailed answer! It helped me a lot to understand it better. I am going to read more about your suggested solution with the sandbox. If I have any questions, I will post it :-) – squirrel Jun 17 '16 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.