1

Tails 2.10 includes the OnionShare software for the first time. While experimenting with OnionShare I discovered that I could share files on my desktop. That surprised me. TorBrowser was hardened so that it could only access files in the /home/amnesia/TorBrowser directory. Allowing OnionShare to access files on the desktop seems contrary to the philosophy that guided the hardening of Tor Browser.

Is my analysis correct? Is a user of OnionShare protected with the same kind of hardening as is a user of TorBrowser? Are the threats completely different, rendering my view of things too superficial? Should we be asking Tails developers to adopt the same approach to OnionShare as to TorBrowser?

3

The threats are completely different.

Tor Browser has a much larger attack surface (it has far more features and functionality that could go wrong) and it's not written in an memory safe language (if features or functionality do go wrong, the potential for exploitation is far greater) where as OnionShare is written in python which is memory safe and has a far smaller attack surface and is designed and intended for a single task, with a far smaller code base.

There is similar hardening in place. This is applied through AppArmor, the same kernel access control module used to enforce Tor Browser's restrictions but it was decided to allow sharing of almost all content from the amnesia user's home directory, it's easy to imagine scenarios where users wish to share a document from inside ~/Documents/ or a file from inside ~/Persistent/. There are some exceptions for folders that may contain cryptographic keys, logs and a few other sensitive files, e.g.:

amnesia@amnesia:~$ onionshare .gnupg/secring.gpg 
Onionshare 0.9.1 | https://onionshare.org/
Connecting to Tor control port to set up onion service on port 17600.
Staring ephemeral Tor onion service and awaiting publication
Preparing files to share.
Traceback (most recent call last):
[...SNIP...]
PermissionError: [Errno 13] Permission denied: '/home/amnesia/.gnupg/secring.gpg'

Ultimately, like a lot of Tails' feature set, there is a trade off between security and usability (where they conflict). It could be more restrictive but if you made it difficult for people to use in the process, they might instead opt for a less secure alternative. An example of a more secure setting to run OnionShare from would be something like that used in Subgraph where they are run inside a sandbox and further restricted with other userspace and kernel hardening mechanisms.

The relevant AppArmor configurations are: abstractions/onionshare, onionshare and onionshare-gui.

Here is the ticket created for the review of the Tails developers AppArmor profiles: #11930.

  • Thank you very much. That answers all the questions very comprehensively. Equally, I don't think that the answers were obvious, so I'm pleased I asked the question! – user02814 Jan 27 '17 at 0:22
0

Tor browser is a browser, so it physically can't provide you the isolation level higher than any application can do it. If you need greater isolation than provided by browser(not just Tor Browser, but any of them) - use a dedicated VM for your setup, that's what I'm highly recommending you in case of any file sharing application usage, not just via Tor. An isolated VM can be a bit more complicated to set up from the very beginning, but it's worth the effort put into it: it won't have not just network access other than you have specified, but also - even using zero-day exploits - it's unable to jailbreak out into the host machine, so you're ensured that the files that you explicitly made available on read-only basis for sharing are actually shared and no other files. You can use either KVM in Linux host case, but personally I prefer Virtualbox or Xen - depending on the setup

0

With thanks to @canonizing ironize above, I can add a bit more information. The README.md file on the GitHub repository for OnionShare explains that:

If you're interested in exactly what OnionShare does and does not protect against, read the Security Design Document.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.