System tor does nothing after a system wide upgrade

Question

I'm not talking about the Tor Browser, which still works. I'm talking about the tor package which no longer works as intended after the upgrade.

When I say it does nothing, I mean it literally doesn't do anything. It doesn't even write to the log file. The service starts, its status is active when I check it, and I can stop it via service tor stop as usual. Except it doesn't work at all. When I try torify links http://google.com, I get this in return:

Error loading http://google.com/:
Host not found

My hidden service doesn't work either, and I find working over a naked IP SSH connection really insecure and inconvenient.

And, like I said, it doesn't write to the log file. At all. It's completely empty, and the last entry was made before the upgrade.

I suspect it might be due to the permissions. Which implies something changed after the upgrade. Anyway, when I simply run tor rather than sudo service tor start, this is what I get in response:

Jul 29 10:15:04.081 [warn] Directory /var/lib/tor/hidden_service cannot be read: Permission denied

The /var/lib/tor/hidden_service folder belongs to user debian-tor:debian-tor with permissions drwx--S---. When I ran sudo -u debian-tor tor, I got this:

Jul 29 10:15:32.607 [warn] Directory /home/user/.tor cannot be read: Permission denied

And I got the same warning after I recursively chowned the directory to debian-tor:debian-tor.

The log file is still empty regardless of what I do. It belongs to debian-tor:adm and has these permissions: drwxr-s---.

UPD

sudo -H tor produced this result:

Jul 29 12:16:55.871 [notice] Tor 0.3.0.9 (git-100816d92ab5664d) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.0.2g and Zlib 1.2.8.
Jul 29 12:16:55.871 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Jul 29 12:16:55.871 [notice] Read configuration file "/etc/tor/torrc".
Jul 29 12:16:55.874 [warn] /var/lib/tor/hidden_service is not owned by this user (root, 0) but by <unknown> (122). Perhaps you are running Tor as the wrong user?
Jul 29 12:16:55.874 [warn] Checking service directory /var/lib/tor/hidden_service failed.
Jul 29 12:16:55.874 [warn] Failed to parse/validate config: Failed to configure rendezvous options. See logs for details.
Jul 29 12:16:55.874 [err] Reading config failed--see warnings above.

After this, I checked /etc/passwd. The entry for debian-tor is debian-tor:x:122:131::/var/lib/tor:/bin/false. I'm not sure if that's where the problem is.

Answer 1

This is a known issue on Ubuntu/Debian, there's a conflict with apparmor because Tor is still running as root when it tries to scan the hidden service directories. They're looking into making the appropriate changes so that it has changed user when it tries this.

This is documented under #22331.

In the meantime, a workaround from Yawnbox is to edit the /etc/apparmor.d/abstractions/tor file and append onto the list of capabilities: capability dac_read_search,

Once it's edited, issue sudo service apparmor reload to make the newly edited apparmor effective, then sudo service tor restart to make the changes take effect.