Bug 1303754 - Permissions on directory /run/tor are too permissive.
Summary: Permissions on directory /run/tor are too permissive.
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: tor
Version: 23
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Nobody's working on this, feel free to take it
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-02-01 20:34 UTC by Paul DeStefano
Modified: 2020-11-05 09:32 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-02-02 09:27:56 UTC
Type: Bug


Attachments (Terms of Use)

Description Paul DeStefano 2016-02-01 20:34:39 UTC
Description of problem:
Tor is complaining after startup:

Permissions on directory /run/tor are too permissive.
Before Tor can create a control socket in "/run/tor/control", the directory "/run/tor" needs to exist, and to be accessible only by the user account that is running Tor.  (On some Unix systems, anybody who can list a socket can connect to it, so Tor is being careful.)

Version-Release number of selected component (if applicable):
tor-0.2.7.6-5.fc23.x86_64

How reproducible:
Always since recent update, possibly since F23.

Steps to Reproduce:
1. Install tor
2. configure
3. start service

Actual results:
Tor starts, but complains.

Expected results:
No complaints

Additional info:

Comment 1 Jamie Nguyen 2016-02-02 07:20:32 UTC
Thanks for the bug report!

However, I can't reproduce your problem. Can you please post the output of:

  ls -ld /run/tor

Also, please check /etc/tor directory for "torrc.rpmnew" file.

Comment 2 Paul DeStefano 2016-02-02 07:58:07 UTC
Gosh, you're very welcome!  I've never been thanked for a bug report before.

Oops, I should have thought you would want that.

$ ls -ld /run/tor
drwxr-x---. 2 toranon toranon 60 Feb  1 16:30 /run/tor/

Aha!  You are right; there is a new torrc.  I got the bug announcement for 2.7.6, I think, and just installed it when it hit the repos without thinking to check.  There were new lines in there about group permissions, so I bet that's all it was.  Let me restart...yep, it's good.

Thanks!  Sorry, sysadmin error.

Comment 3 Jamie Nguyen 2016-02-02 09:27:56 UTC
(In reply to Paul DeStefano from comment #2)
> Aha!  You are right; there is a new torrc.  I got the bug announcement for
> 2.7.6, I think, and just installed it when it hit the repos without thinking
> to check.  There were new lines in there about group permissions, so I bet
> that's all it was.  Let me restart...yep, it's good.
> 
> Thanks!  Sorry, sysadmin error.

This was actually an error on my part (though I fixed it before it left updates-testing).

In tor-0.2.7.6-3 I added ControlSocket/Cookie stuff but forgot the group permissions stuff. I did fix the problem before it left updates-testing, so most users would just jump straight to tor-0.2.7.6-5 and not have any issues. But anyone who installed -3 from updates-testing might encounter the same problem you saw.

Comment 4 Jamie Nguyen 2016-02-02 09:32:32 UTC
Actually, I think my error did make it to stable in 0.2.7.6-4.

Comment 5 Paul DeStefano 2016-02-06 23:05:15 UTC
So, quick question: why did /etc/tor/torrc change ownership and permission?  It was 600 toranon:toranon, now it's 644 root:root.  That's a significant change, and now provision was made for it.  (I have 2.7.6-5 now, wasn't a problem with -4 pkg.)

Comment 6 Jamie Nguyen 2016-02-07 07:15:37 UTC
(In reply to Paul DeStefano from comment #5)
> So, quick question: why did /etc/tor/torrc change ownership and permission? 
> It was 600 toranon:toranon, now it's 644 root:root.  That's a significant
> change, and now provision was made for it.  (I have 2.7.6-5 now, wasn't a
> problem with -4 pkg.)

The permissions of /etc/tor/torrc in the RPM have been the same for many years. Permissions were probably changed manually using chmod/chown.


Note You need to log in before you can comment on or make changes to this bug.