Package: tor Version: 0.2.9.11-1~deb9u1 Severity: important Dear Maintainer,
I was debugging why obfs4proxy was failing to load in Debian 9 (Whonix 14 developers), without any helpful error messages in the log. I notice that if I changed the AA execution permissions in abstractions/tor for obfsproxy to ix instead of PUx, it loads. I also noticed that if I commented out or changed the systemd hardening flag NoNewPrivileges inside systemd/system/[email protected], obfs4proxy also successfully loads. I have no idea why or where to find any error message from systemd or apparmor about the failure to load /usr/bin/obfs4proxy. I also don't know how the hardening NoNewPrivileges and the apparmor execution permission PUx interact to cause the failure to load obfs4proxy. But changing PUx to ix AND/OR changing NoNewPrivileges to blank or YES, allows obfs4proxy to load and tor to connect to an obfs4 bridge. For now, I created a workaround for Whonix users that simply disables NoNewPrivileges. -- System Information: Distributor ID: Whonix Description: Whonix GNU/Linux 9.0 (stretch) Release: 9.0 Codename: stretch Architecture: x86_64 Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages tor depends on: ii adduser 3.115 ii init-system-helpers 1.48 ii libc6 2.24-11+deb9u1 ii libevent-2.0-5 2.0.21-stable-3 ii libseccomp2 2.3.1-2.1 ii libssl1.1 1.1.0f-3 ii libsystemd0 232-25 ii lsb-base 9.20161125 ii zlib1g 1:1.2.8.dfsg-5 Versions of packages tor recommends: ii logrotate 3.11.0-0.1 ii tor-geoipdb 0.2.9.11-1~deb9u1 ii torsocks 2.2.0-1 Versions of packages tor suggests: ii apparmor-utils 2.11.0-3 pn mixmaster <none> ii obfs4proxy 0.0.7-1+b2 ii obfsproxy 0.2.13-2 pn socat <none> ii tor-arm 1.4.5.0-1.1 pn torbrowser-launcher <none> -- Configuration Files: /etc/apparmor.d/abstractions/tor changed [not included] /etc/apparmor.d/system_tor changed [not included] /etc/default/tor changed [not included] /etc/tor/torrc changed [not included] -- no debconf information -- debsums errors found: debsums: changed file /lib/systemd/system/[email protected] (from tor package)
