Bug 2252618

Summary: Tor.service fails to start
Product: [Fedora] Fedora Reporter: bitestring <upcz5mw0>
Component: torAssignee: Marcel Haerry <mh>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 39CC: mh, miabbott, pablo, paul.wouters, rh-bugzilla, tsilvs
Target Milestone: ---Keywords: Desktop
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: tor-0.4.8.12-2.el9 tor-0.4.8.12-2.el8 tor-0.4.8.12-2.fc39 tor-0.4.8.12-2.fc40 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-08-16 00:41:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description bitestring 2023-12-03 03:48:36 UTC
In Fedora 39 (Silverblue), /var/lib/tor is owned by a different user called setroubleshoot or some random user ID. Everytime `rpm-ostree upgrade` is executed the ownership seems to be changed from `toranon` to a different user. Thus systemd service keeps failing

```
> sudo systemctl start tor
tor.service: Failed with result 'exit-code'.
tor.service: Control process exited, code=exited, status=1/FAILURE
Dec 03 08:47:28.341 [err] Reading config failed--see warnings above.
Dec 03 08:47:28.341 [warn] Failed to parse/validate config: Couldn't access private data directory "/var/lib/tor/keys"
Dec 03 08:47:28.341 [warn] Directory /var/lib/tor/keys cannot be read: Permission denied
Dec 03 08:47:28.334 [notice] Read configuration file "/etc/tor/torrc".
Dec 03 08:47:28.334 [notice] Read configuration file "/usr/share/tor/defaults-torrc".
Dec 03 08:47:28.334 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://support.torproject.org/faq/staying-anonymous/
Dec 03 08:47:28.334 [notice] Tor 0.4.8.9 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.1.1, Zlib 1.2.13, Liblzma 5.4.4, Libzstd 1.5.5 and Glibc 2.38 as libc.
```

Reproducible: Always

Steps to Reproduce:
1. Install `rpm-ostree install tor`
2. Reboot
3. Start the service `sudo systemctl start tor`
Actual Results:  
tor.service: Failed with result 'exit-code'.
tor.service: Control process exited, code=exited, status=1/FAILURE
Dec 03 08:47:28.341 [err] Reading config failed--see warnings above.
Dec 03 08:47:28.341 [warn] Failed to parse/validate config: Couldn't access private data directory "/var/lib/tor/keys"
Dec 03 08:47:28.341 [warn] Directory /var/lib/tor/keys cannot be read: Permission denied
Dec 03 08:47:28.334 [notice] Read configuration file "/etc/tor/torrc".
Dec 03 08:47:28.334 [notice] Read configuration file "/usr/share/tor/defaults-torrc".
Dec 03 08:47:28.334 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://support.torproject.org/faq/staying-anonymous/
Dec 03 08:47:28.334 [notice] Tor 0.4.8.9 running on Linux with Libevent 2.1.12-stable, OpenSSL 3.1.1, Zlib 1.2.13, Liblzma 5.4.4, Libzstd 1.5.5 and Glibc 2.38 as libc.

Expected Results:  
Service should start successfully.

Changing ownership of all files in `/var/lib/tor/` seems to fix the problem.

```
> cd /var/lib/tor/
> chown toranon:toranon *
> systemctl start tor
```

fixes the issue.

Comment 1 Micah Abbott 2023-12-11 15:27:24 UTC
I'm not a packaging expert, but it appears that the spec files is manually using `useradd` to configure the `toranon` user:

https://src.fedoraproject.org/rpms/tor/blob/rawhide/f/tor.spec#_129-134

...but probably should be using the sysusers.d approach:

https://docs.fedoraproject.org/en-US/packaging-guidelines/UsersAndGroups/#_allocation_strategies

Comment 2 bitestring 2023-12-11 17:48:00 UTC
Linking another Fedora Discussion thread

https://discussion.fedoraproject.org/t/tor-service-fail-to-start-on-silverblue-f39/98725

Comment 3 Vsevolod 2024-06-22 09:46:11 UTC
Can confirm that this issue persists on Fedora Silverblue 40. `toranon` user workarounds don't work, because SystemD Login management service prevents it from being created.

Comment 4 Fedora Update System 2024-08-03 21:05:32 UTC
FEDORA-2024-c015cf3a38 (tor-0.4.8.12-1.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-c015cf3a38

Comment 5 Fedora Update System 2024-08-03 21:09:39 UTC
FEDORA-2024-4d686ae1b5 (tor-0.4.8.12-1.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-4d686ae1b5

Comment 6 Fedora Update System 2024-08-04 01:16:56 UTC
FEDORA-2024-4d686ae1b5 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-4d686ae1b5`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-4d686ae1b5

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2024-08-04 01:52:17 UTC
FEDORA-2024-c015cf3a38 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-c015cf3a38`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-c015cf3a38

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2024-08-06 11:56:46 UTC
FEDORA-2024-3f9eb3c86c (tor-0.4.8.12-2.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-3f9eb3c86c

Comment 9 Fedora Update System 2024-08-06 11:57:51 UTC
FEDORA-2024-c2da7f4de7 (tor-0.4.8.12-2.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-c2da7f4de7

Comment 10 Fedora Update System 2024-08-06 11:58:57 UTC
FEDORA-EPEL-2024-4188096f1c (tor-0.4.8.12-2.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-4188096f1c

Comment 11 Fedora Update System 2024-08-06 11:59:15 UTC
FEDORA-EPEL-2024-2d8a766d53 (tor-0.4.8.12-2.el8) has been submitted as an update to Fedora EPEL 8.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-2d8a766d53

Comment 12 Fedora Update System 2024-08-08 00:20:46 UTC
FEDORA-EPEL-2024-4188096f1c has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-4188096f1c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 Fedora Update System 2024-08-08 00:30:55 UTC
FEDORA-EPEL-2024-2d8a766d53 has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-2d8a766d53

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 14 Fedora Update System 2024-08-08 03:36:33 UTC
FEDORA-2024-c2da7f4de7 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-c2da7f4de7`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-c2da7f4de7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2024-08-08 04:45:58 UTC
FEDORA-2024-3f9eb3c86c has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-3f9eb3c86c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-3f9eb3c86c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 16 Fedora Update System 2024-08-16 00:41:41 UTC
FEDORA-EPEL-2024-4188096f1c (tor-0.4.8.12-2.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 17 Fedora Update System 2024-08-16 01:03:43 UTC
FEDORA-EPEL-2024-2d8a766d53 (tor-0.4.8.12-2.el8) has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 18 Fedora Update System 2024-08-16 01:20:54 UTC
FEDORA-2024-c2da7f4de7 (tor-0.4.8.12-2.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 19 Fedora Update System 2024-08-16 13:06:59 UTC
FEDORA-2024-3f9eb3c86c (tor-0.4.8.12-2.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.