nusenu <[email protected]> writes: >>>> Actually also CAP_KILL is needed, otherwise reload will not work. >>> > >>> > CAP_KILL is not needed, see: >>> > https://lists.torproject.org/pipermail/tor-dev/2015-April/008759.html >> Well. You can either do that, or add CAP_KILL. Either will work you >> chose one and I chose the other. > > With the difference that "your" tor daemons run with more capabilities > than actually needed.
Makes sense. A new patch with that change is attached. -- Arto Jantunen
>From 42962d2c0cc5a5df4d3348e8cdafb60304460543 Mon Sep 17 00:00:00 2001 From: Arto Jantunen <[email protected]> Date: Thu, 30 Apr 2015 13:56:43 +0300 Subject: [PATCH] Install and enable the systemd service file - Patch the included service file to closely match the initscript - Add build-dep on dh-systemd - Install the service file --- debian/control | 2 +- debian/patches/debianize-systemd-service | 48 ++++++++++++++++++++++++++++++++ debian/patches/series | 1 + debian/rules | 3 +- debian/tor.dirs | 1 + 5 files changed, 53 insertions(+), 2 deletions(-) create mode 100644 debian/patches/debianize-systemd-service diff --git a/debian/control b/debian/control index 76b8ce1..c5e1258 100644 --- a/debian/control +++ b/debian/control @@ -2,7 +2,7 @@ Source: tor Section: net Priority: optional Maintainer: Peter Palfrader <[email protected]> -Build-Depends: debhelper (>= 8.1.0~), quilt, libssl-dev, zlib1g-dev, libevent-dev (>= 1.1), binutils (>= 2.14.90.0.7), hardening-includes, asciidoc (>= 8.2), docbook-xml, docbook-xsl, xmlto, dh-apparmor, libseccomp-dev [amd64 i386] +Build-Depends: debhelper (>= 8.1.0~), quilt, libssl-dev, zlib1g-dev, libevent-dev (>= 1.1), binutils (>= 2.14.90.0.7), hardening-includes, asciidoc (>= 8.2), docbook-xml, docbook-xsl, xmlto, dh-apparmor, libseccomp-dev [amd64 i386], dh-systemd Build-Conflicts: libnacl-dev, libseccomp-dev [!amd64 !i386] Standards-Version: 3.9.4 Homepage: https://www.torproject.org/ diff --git a/debian/patches/debianize-systemd-service b/debian/patches/debianize-systemd-service new file mode 100644 index 0000000..1dc956e --- /dev/null +++ b/debian/patches/debianize-systemd-service @@ -0,0 +1,48 @@ +From: Arto Jantunen <[email protected]> +Date: Wed, 29 Apr 2015 19:27:02 +0300 +Subject: Debianize systemd service file + +--- + contrib/dist/tor.service.in | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/contrib/dist/tor.service.in b/contrib/dist/tor.service.in +index c251158..848dd9b 100644 +--- a/contrib/dist/tor.service.in ++++ b/contrib/dist/tor.service.in +@@ -3,10 +3,12 @@ Description = Anonymizing overlay network for TCP + After = syslog.target network.target nss-lookup.target + + [Service] +-Type = notify +-NotifyAccess = all +-ExecStartPre = @BINDIR@/tor -f @CONFDIR@/torrc --verify-config +-ExecStart = @BINDIR@/tor -f @CONFDIR@/torrc ++Type = forking ++PIDFile = /var/run/tor/tor.pid ++EnvironmentFile=-/etc/default/tor ++ExecStartPre = /usr/bin/install -Z -m 02750 -o debian-tor -g debian-tor -d @LOCALSTATEDIR@/run/tor ++ExecStartPre = @BINDIR@/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc --verify-config ++ExecStart = @BINDIR@/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc $ARGS + ExecReload = /bin/kill -HUP ${MAINPID} + KillSignal = SIGINT + TimeoutSec = 30 +@@ -15,6 +17,7 @@ WatchdogSec = 1m + LimitNOFILE = 32768 + + # Hardening ++PermissionsStartOnly = yes + PrivateTmp = yes + PrivateDevices = yes + ProtectHome = yes +@@ -22,8 +25,8 @@ ProtectSystem = full + ReadOnlyDirectories = / + ReadWriteDirectories = -@LOCALSTATEDIR@/lib/tor + ReadWriteDirectories = -@LOCALSTATEDIR@/log/tor +-NoNewPrivileges = yes +-CapabilityBoundingSet = CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE ++ReadWriteDirectories = -@LOCALSTATEDIR@/run ++CapabilityBoundingSet = CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER + + [Install] + WantedBy = multi-user.target diff --git a/debian/patches/series b/debian/patches/series index 19e8864..b267a32 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1 +1,2 @@ improve-geoip-warning +debianize-systemd-service diff --git a/debian/rules b/debian/rules index d404e19..2bf6b9b 100755 --- a/debian/rules +++ b/debian/rules @@ -15,7 +15,7 @@ endif %: dh \ $@ \ - --with quilt \ + --with quilt,systemd \ --builddirectory=build \ --parallel @@ -52,6 +52,7 @@ override_dh_install: cp debian/tor.apparmor-profile debian/tor/etc/apparmor.d/system_tor cp debian/tor.apparmor-profile.abstraction debian/tor/etc/apparmor.d/abstractions/tor dh_apparmor --profile-name=system_tor -ptor + cp build/contrib/dist/tor.service debian/tor/lib/systemd/system override_dh_installdocs: dh_installdocs -ptor-dbg --link-doc=tor diff --git a/debian/tor.dirs b/debian/tor.dirs index f693956..7c82b44 100644 --- a/debian/tor.dirs +++ b/debian/tor.dirs @@ -1 +1,2 @@ etc/apparmor.d/abstractions +lib/systemd/system -- 2.1.4
