I'm looking at using the Tor browser bundle, and the instructions have one run the bundle as a normal user (in my case, on Debian Jessie). This would seem to expose the Tor files to tampering in a way that is not the case with iceweasel.

Q1: are my concerns misplaced?

I've tried to run Tor inside of /opt with a softlink to /usr/local/bin/start-tor-browser, but unless I assign "my user:my user" to the entire "/opt/torfolder" I get a permission error. There is code to stop Tor running as root which I'd prefer not to comment out, but regardless I don't think that is the main problem at the moment.

Q: is there a "best practice" for running Tor as a normal user, but for protecting the Tor files from user tampering with permissions?

Q: What are the benefits/downsides of using visudo?


  • 1
    In what ways are the Tor files exposed to tampering if running as a non-root user? (And how does Iceweasel prevent this?) Nov 15, 2015 at 18:05
  • Hi Richard, thanks for the question. My sense is installed linux apps like iceweasel files are stored in folders with root:root permissions, and libraries/application files have root:root permissions. The Tor Browser Bundle is meant to run in a user account, with regular user permissions, so my assumption is that it is easier for those files to be vulnerable to malware/user mistakes. If so, am looking for a way to set up Tor like iceweasel where Tor folders/files have root:root but can be run by regular users. Not sure TBB allows this easily given how it is configured to work.
    – Senrabdet
    Nov 17, 2015 at 11:57

2 Answers 2


In complement of Alexey's detailed answer, let me add the following. As indicated, for instance, here, the simpler way to install tor browser in /opt on Linux is probably the following:

  1. Download a bundle at https://www.torproject.org/download/#downloads
  2. (optional, but recommended) Check the signature (https://support.torproject.org/tbb/how-to-verify-signature/)
  3. Extract the file, for instance with

    tar -xvfJ tor-browser-linux64-9.0_en-US.tar.xz.asc
  4. As root, move the files to /opt, using for instance

    mv tor-browser_en-US /opt
  5. Finally, as a normal user, run the program with

        cd /opt/tor-browser_en-US/

and you can even add to that latter command --register-app at the end, to be able to run the program from anywhere (i.e., to add it to the applications in your menu, for instance).


So - here are your answers, step by step:

  • Q1 Tor has no folder-hardcode in it's entire source, and if you're about to use /opt/tordir or anything else that is physically reachable in your FileSystem API - it's totally OK. Just make sure that you will make it actually reachable by issuing chown -R tor-user:tor-user-primary-group /path/to/your/tordir and making it referenced as DataDirectory /full/path/to/your/tordir/from/the/very/top and corresponding values with full path too: GeoIPFile,GeoIPv6File,PidFile. And the magic goes on! Use User tor-user as the very last line in your torrc. That's it - I'm running Tor from it's dedicated and non-standart folder too.
  • Q2 Make a separate directory for Tor(look Q1 answer), use /etc/torrc owned by root only and run it as a regular dedicated user. Additional file security is - actually - not required strictly, but of course a UMASK 077 is in order system-wide, or don't speak about a filesystem security on that host at all. Extra level of defense - above umask 077 - if you will need it - I'd recommend you AppArmor, used it in Ubuntu and in Debian. Really simple and powerful tool if you need some additional hardening.
  • Q3 it's a native part of sudo toolset, so it's totally fine to use it: because only root is able to use it and even read a sudoers file. But as in any case of include-configs, do check that not a byte is included from either directories or files: all the sudo permissions must reside on one single file. And if you'll have a root account breached - your server is lost regardless of OS you're using(except MS-DOS, pehaps)

Feel free to ask more questions - I'll be glad to help!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .