On Mon, 28 Sep 2015, Laurent Bigonville wrote:
> When looking at the capabilities that are granted by the .service file
> compared to the upstream one (in the contrib directory), I'm wondering
> if it couldn't be reduced.
Maybe.
> -CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE
> +CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE
> CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER
>
> The dac_override one could atleast be dropped if root also had access
> to the /var/log/tor /var/lib/tor directories (giving access to the root
> group?). Not too sure about the other ones.
But root doesn't. And I think we need chown since we start as root and
then create sockets and give that to the target user. Do you disagree?
> I'm also wondering about: ReadWriteDirectories=-/var/run, shouldn't this
> be removed and shouldn't /var/run/tor be created by tmpfiles mechanism
> (or the RuntimeDirectory= option) instead of using the install command?
>From reading the manpage I get the impression that this will not allow
us to create the directory in a way that the right user ends up owning
it. Any ideas?
> Also, shouldn't "NoNewPrivileges=yes" be added like in the upstream one?
The manpage suggests that it disallows UID changes, but when I tested
it, tor should still transition from root to its target user. I think
we should set this option.
weasel
--
| .''`. ** Debian **
Peter Palfrader | : :' : The universal
https://www.palfrader.org/ | `. `' Operating System
| `- https://www.debian.org/
