0

Permissions are set so tor should be able to access through the postfix-test-queue user:

$ sudo ls -l /var/spool/postfix-test/public/smtpd 
srw-rw-rw- 1 postfix-test postfix-test 0 █████ /var/spool/postfix-test/public/smtpd
$ sudo ls -l /var/spool/postfix-test
# ...
drwx--x---  2 postfix-test postfix-test-queue 4096 █████ public
$ sudo -u _tor-test id
uid=130(_tor-test) gid=141(_tor-test) groups=141(_tor-test),1006(postfix-test-queue)
$ cat /etc/tor/instances/test/torrc | grep HiddenServicePort
HiddenServicePort 25 unix:/var/spool/postfix-test/public/smtpd
$ cat /run/tor-instances/test.defaults | grep User
User _tor-test

Running tor@test via the default systemctl config shows:

$ ps -ax -o uid,gid,supgid,command | grep /usr/bin/tor
  130   141 141                  /usr/bin/tor --defaults-torrc /run/tor-instances/test.defaults -f /etc/tor/instances/test/torrc

Which is missing the postfix-test-queue 1006 user which, for example shows up if I do:

$ sudo -u _tor-test sleep 1000 & ps -ax -o uid,gid,supgid,command | grep sleep
[1] 132314
    0   141 141,1006             sudo -u _tor-test sleep 1000

Connecting using sudo -u works (the message indicates successful connection):

$ sudo -u _tor-test curl --unix-socket /var/spool/postfix-test/public/smtpd http://localhost
curl: (1) Received HTTP/0.9 when not allowed

But connecting via tor does not:

$ torsocks --ipv6 curl http://█████.onion:25
█████ ERROR torsocks[134873]: Host unreachable (in socks5_recv_connect_reply() at socks5.c:539)
curl: (7) Couldn't connect to server

But does if I allow access to the socket to everyone:

$ sudo chmod "o+x" /var/spool/postfix-test/public/
$ torsocks --ipv6 curl http://█████.onion:25
curl: (1) Received HTTP/0.9 when not allowed

Tor's relevant source code: Tor: lib/process/setuid.c Source File

And torrc documentation:

 User UID
On startup, setuid to this user and setgid to their primary group.
0

1 Answer 1

0

I asked on #tor irc:

<ketyn> Is it intended that tor doesn't set supplementary groups when starting as root and then doing setgid? This describes my issue: https://tor.stackexchange.com/questions/23225/tor-cant-read-hiddenserviceport-unix-socket-through-group-permissions-when-star
<ketyn> I see many threads on the internet of people claiming that tor unix socket permissions aren't working for them and while sometimes it turns out to be apparmor/SELinux, I think this might be biting other people too
<ketyn> I think significant numbers of people might just be giving up and making their unix socket globally readable, or switching to numbered port based sockets rather than unix domain sockets.
<arma> ketyn: we had a series of security surprises in the past with how we did groups and dropping privs,
<arma> and we settled on what we do now as the safest option
<ketyn> Alright, I guess I'll need to either make the sockets tor listens to owned by the tor user, or use socat to forward. Maybe there's a documentation fix to apply here though.
<ketyn> tor forwards to*
<bentham> ketyn: What are you doing that would make that necessary?
<bentham> Is the default not working for you for some reason?
<bentham> Also, which socket(s) is(are) causing issues for you?  Is it something in /run/tor?
<ketyn> I want to make a tor hidden service listening to port 25, connected to a socket at /var/spool/postfix-test/public/smtpd owned by the user postfix-queue
<ketyn> According to postfix, I'm then supposed to add whatever user I want to read to that socket to the group postfix-queue
<arma> ketyn: hmmm
<arma> for the control socket see the GroupWritable flags
<arma> ControlSocket /run/tor/control GroupWritable RelaxDirModeCheck
<arma> ControlSocketsGroupWritable 1
<arma> this is how you can add your username to the tor group and then have permissions to connect with a controller
<ketyn> This is not a control socket. This is a hidden service. e.g. HiddenServicePort 25 unix:/var/spool/postfix-test/public/smtpd
<arma> i don't think anybody has built something similar for the onion service lines
<arma> but i think that tor is not dropping the groups, it simply is not letting you use the group permission there
<ketyn> I want to be able to receive email over a hidden service. Like in https://github.com/ehloonion/onionmx
<ketyn> > <arma> but i think that tor is not dropping the groups, it simply is not letting you use the group permission there
<ketyn> Huh, ok.
<arma> i say that because being in the group, for the control port, does work
<arma> so it's not like the group got dropped
<arma> check out the UnixSocksGroupWritable config option
<arma> maybe it will help what you want
<bentham> ketyn: Out of curiosity, why is your smtpd listening on a socket rather than, say, 127.0.0.1:25?
<arma> looks like no, it won't do what you want, because UnixSocksGroupWritable doesn't apply to hiddenservice lines
<ketyn> bentham: Because it seems more secure and means I don't have to worry about port conflicts or firewalls, and deploy this setup to computers I don't have full control over.
<ketyn> Here's another good reason I saw: https://github.com/freedomofpress/securedrop/issues/1261
<ketyn> "because applications sometimes (fairly) assume that localhost has a different threat model than an externally exposed service. Most recently, this common configuration lead to some hidden services exposing sensitive information through the Apache mod_status module"
...
<arma> actually arma said "just barely possible that the network team would take a good patch"
<arma> not quite the same as "probably not take"
<arma> but yes, more generally, there is vast confusion about what permissions are *supposed* to be, what groups happen by default in debian/ubuntu, what the SELinux and Apparmor policies do, etc
<arma> i think most people are probably doing it wrong but i don't even know what right is
<arma> i end up putting all my onion service directories in /tmp/ so they work, and that cannot at all be right

tor-dev thread: https://lists.torproject.org/pipermail/tor-dev/2022-July/014745.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.