Package: tor
Version: 0.2.5.6-alpha-1
Severity: wishlist
Hi,
Tor 0.2.5.x ships a systemd unit file in the contrib/dist/ directory.
I've been using it for months on my sid system, and have improved it
upstream to make it easier to ship in Debian. The only changes I have
locally against the upstream version are:
--- contrib/dist/tor.service.in 2014-09-13 08:40:23.240138262 -0700
+++ /etc/systemd/system/tor.service 2014-08-26 20:00:22.702566794 -0700
@@ -4,10 +4,10 @@
[Service]
Type = simple
-ExecStartPre = @BINDIR@/tor -f @CONFDIR@/torrc --verify-config
+ExecStartPre = /usr/bin/tor --defaults-torrc
/usr/share/tor/tor-service-defaults-torrc --verify-config
# A torrc that has "RunAsDaemon 1" won't work with the "simple" service type;
# let's explicitly override it.
-ExecStart = @BINDIR@/tor -f @CONFDIR@/torrc --RunAsDaemon 0
+ExecStart = /usr/bin/tor --defaults-torrc
/usr/share/tor/tor-service-defaults-torrc --RunAsDaemon 0
ExecReload = /bin/kill -HUP ${MAINPID}
KillSignal = SIGINT
TimeoutSec = 30
... but I guess that @BINDIR@ should be kept as-is, to be replaced by
the build system at package build time. So, in short, we only need to
replace the two occurrences of "-f @CONFDIR@/torrc" with
"--defaults-torrc /usr/share/tor/tor-service-defaults-torrc".
I'll try to come up with a patch by the end of the month. To avoid
reinventing the wheel, I'll use dh-systemd. It's only available in
wheezy-backports and later, so I guess I'll also have to modify
Weasel's build scripts to patch out the systemd support when building
for older distributions.
Another change that we'll want to make is to use the AppArmorProfile=
unit file directive, to avoid a regression for AppArmor users.
This option only exists in systemd v210+ (and I had it added precisely
to support this usecase, actually), but is currently disabled in the
Debian package: #760526. The systemd maintainers seem to be open to
enable it, so I think it's fine to first install the Tor unit file in
experimental without this option, and add it once it is supported in
Debian's systemd.
To end with, I've added some hardening options to the unit file
upstream. They have been merged in the branch targeted at 0.2.6.x, and
are tagged "025-backport":
* https://trac.torproject.org/projects/tor/ticket/12751
* https://trac.torproject.org/projects/tor/ticket/12939
I'm going to talk to Nick to clarify whether we'll have it backported
into 0.2.5. I'd like to see it live in Jessie (assuming we have 0.2.5
in Jessie).
Cheers,
--
intrigeri
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
