On Thu, 08 Dec 2016, Joey Hess wrote:
> > Do we want directory shared across all tor instances, or do we want a
> > different one for every instance?
>
> The only tor instance I am familar with, aside from the system tor, is
> torbrowser's instance.
tor-instance-create(8) lets you create other instances of tor. They
have their own user, their own data directory, their own configuration.
This is useful if you want to run say a relay and also provide a hidden
service on your host.
> Actually, I can't create a socket file owned by debian-tor, and I need
> to be the one to create the socket (when my hidden service binds it).
> So, it would really look like this:
>·
> drwxr-xr-x root root /var/lib/tor_hidden_service_sockets
> drwxr-x--- joey debian-tor /var/lib/tor_hidden_service_sockets/joeyservice
> -rw-r--r-- joey joey
> /var/lib/tor_hidden_service_sockets/joeyservice/socket
>·
> This still only lets debian-tor read from the socket due to the
> permissions of the directory, which is good.
If we call it tor_hidden_service_sockets, then the onionshare usecase is
not really covered by that name. However, I'm also not sure that it's a
valid use-case - it probably ought to put the hidden service directory
into /var/lib/tor and use the control interface to learn the hostname.
Or use ephemeral hidden services via the control interface.
With the top directory not having any user specific modes, different tor
instances can share that tree. I wonder if we still want
/var/lib/tor-onion-sockets/{default,foo,bar} so that we get
systemd protection and prevent a tor instance from accessing another
instances's tree.
> Shipping the directory would be a good indication that this version of
> tor supports it. Otherwise a hidden service installer would need to look
> at version numbers or the apparmor config to guess.
>
> Also, shipping the directory would let you pick the best permissions for it.
Good reasons, thanks.
--
| .''`. ** Debian **
Peter Palfrader | : :' : The universal
https://www.palfrader.org/ | `. `' Operating System
| `- https://www.debian.org/
