I'm looking at using the Tor browser bundle, and the instructions have one run the bundle as a normal user (in my case, on Debian Jessie). This would seem to expose the Tor files to tampering in a way that is not the case with iceweasel.
Q1: are my concerns misplaced?
I've tried to run Tor inside of /opt with a softlink to /usr/local/bin/start-tor-browser, but unless I assign "my user:my user" to the entire "/opt/torfolder" I get a permission error. There is code to stop Tor running as root which I'd prefer not to comment out, but regardless I don't think that is the main problem at the moment.
Q: is there a "best practice" for running Tor as a normal user, but for protecting the Tor files from user tampering with permissions?
Q: What are the benefits/downsides of using visudo?