0

I am on Debian buster, running tbb 7.0.11 . This is a clean profile and everything. I wanted to upload a few pictures from /home/shirish/Pictures but when I tried to, it says/said the following - 

Could not read the contents of shirish

Error opening directory '/home/shirish': Permission denied

I have no idea why this is so, hunting on the board/forum gave me the following query and answer.

Directory Cannot be Readed: Permission Denied after update to 0.3.0

I do have apparmor installed but it seems it is like a dependency on something rather than something that I explicitly installed.

While the answer has been given therein, saying - 

[Service]
AppArmorProfile=

It didn't explain the rationale or what that line does or do, no explanation.

Could somebody throw some more light on the matter. I do see the following after seeing Could not launch managed proxy executable at '/usr/bin/obfs4proxy' ('Operation not permitted')

but do not have any undertanding of apparmor except what I could make from the description of it. 

shirish@debian:/etc/systemd/system$ cat /lib/systemd/system/tor@default.service
[Unit]
Description=Anonymizing overlay network for TCP
After=network.target nss-lookup.target
PartOf=tor.service
ReloadPropagatedFrom=tor.service

[Service]
Type=notify
NotifyAccess=all
PIDFile=/var/run/tor/tor.pid
PermissionsStartOnly=yes
ExecStartPre=/usr/bin/install -Z -m 02755 -o debian-tor -g debian-tor -d /var/run/tor
ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config
ExecStart=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0
ExecReload=/bin/kill -HUP ${MAINPID}
KillSignal=SIGINT
TimeoutStartSec=300
TimeoutStopSec=60
Restart=on-failure
LimitNOFILE=65536

# Hardening
AppArmorProfile=-system_tor
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/proc
ReadWriteDirectories=-/var/lib/tor
ReadWriteDirectories=-/var/log/tor
ReadWriteDirectories=-/var/run
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH

I have no idea if I'm barking up the wrong tree altogether.

Any help/guidance in the matter would be appreciated.

Improve this question
5
  • I don't have an answer to your question. But I can tell you that Tor Browser runs its own copy of Tor in the background. Therefore, editing systemd files for the system's Tor process will not help.
    – pastly
    Jan 2 '18 at 16:52
  • 1
    Are you using torbrowser-launcher? If so, it has its own apparmor profile that might be the source of this issue. Also if it is apparmor you should have a corresponding output in your logs, if you run like dmesg | grep -i apparmor or similar and see if it has anything related to access to that folder being denied and which profile caused it.
    – cacahuatl
    Jan 2 '18 at 20:30
  • aha, thank you for the pointer, didn't know that. It indeed seems to be the case. see paste.debian.net/1003344 for more. I don't know about audit bit in dmesg hence have obfuscated the numbers with xxx's . I hope you can help me in understanding what is happening here.
    – shirish
    Jan 3 '18 at 2:00
  • There seems to be lot of denials therein, are all of those from firefox's own apparmor profile or apparmor from Debian, anyway to know which is from where ?
    – shirish
    Jan 3 '18 at 2:01
  • If they're affecting Tor Browser, they're from the torbrowser-launcher profile, which is installed with it. Do you need anything specifically about it trying to access ~/Pictures? I don't see it allowing that anywhere: github.com/micahflee/torbrowser-launcher/blob/master/apparmor/…
    – cacahuatl
    Jan 4 '18 at 1:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.