Package: systemd
Version: 208-6
Severity: normal
Hi,
the attached unit file has NoNewPrivileges set to "yes", which,
according to systemd.exec(5), "prohibits UID changes of any kind".
However, the tor daemon it starts successfully manages to change its
UID to debian-tor, as configured with "User debian-tor" in
/usr/share/tor/tor-service-defaults-torrc:
# systemctl status tor.service
tor.service - Anonymizing overlay network for TCP
Loaded: loaded (/etc/systemd/system/tor.service; disabled)
Active: active (running) since Thu 2014-07-31 11:25:47 CEST; 14min ago
Process: 30506 ExecStartPre=/usr/bin/tor --defaults-torrc
/usr/share/tor/tor-service-defaults-torrc --verify-config (code=exited,
status=0/SUCCESS)
Main PID: 30509 (tor)
CGroup: /system.slice/tor.service
└─30509 /usr/bin/tor --defaults-torrc
/usr/share/tor/tor-service-defaults-torrc --RunAsDaemon 0
$ ps aux | grep usr/bin/tor
debian-+ 30509 0.1 0.2 66536 33708 ? Ss 11:25 0:01 /usr/bin/tor
--defaults-torrc /usr/share/tor/tor-service-defaults-torrc --RunAsDaemon 0
Did I misunderstand the documentation, or is the doc wrong, or is
there a bug somewhere?
Cheers,
--
intrigeri
[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target
[Service]
Type = simple
ExecStartPre = /usr/bin/tor --defaults-torrc
/usr/share/tor/tor-service-defaults-torrc --verify-config
# A torrc that has "RunAsDaemon 1" won't work with the "simple" service type;
# let's explicitly override it.
ExecStart = /usr/bin/tor --defaults-torrc
/usr/share/tor/tor-service-defaults-torrc --RunAsDaemon 0
ExecReload = /bin/kill -HUP ${MAINPID}
KillSignal = SIGINT
TimeoutSec = 30
Restart = on-failure
LimitNOFILE = 32768
# Hardening
PrivateTmp = yes
DeviceAllow = /dev/null rw
DeviceAllow = /dev/urandom r
InaccessibleDirectories = / /home # does not extend to submounts
ReadOnlyDirectories = /etc /usr
ReadWriteDirectories = /var/lib/tor /var/log/tor
NoNewPrivileges = yes
#AppArmorProfile = system_tor
[Install]
WantedBy = multi-user.target
_______________________________________________
Pkg-systemd-maintainers mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-systemd-maintainers
