[tor-dev] Tor can't read HiddenServicePort unix socket through group permissions when starting as root and using setgid?

[keyandthegate]

I had a conversation about this on OFTC #tor:

<ketyn> Is it intended that tor doesn't set supplementary groups when starting as root and then doing setgid? This describes my issue: https://tor.stackexchange.com/questions/23225/tor-cant-read-hiddenserviceport-unix-socket-through-group-permissions-when-star
<ketyn> I see many threads on the internet of people claiming that tor unix socket permissions aren't working for them and while sometimes it turns out to be apparmor/SELinux, I think this might be biting other people too
<ketyn> I think significant numbers of people might just be giving up and making their unix socket globally readable, or switching to numbered port based sockets rather than unix domain sockets.
<arma> ketyn: we had a series of security surprises in the past with how we did groups and dropping privs,
<arma> and we settled on what we do now as the safest option
<ketyn> Alright, I guess I'll need to either make the sockets tor listens to owned by the tor user, or use socat to forward. Maybe there's a documentation fix to apply here though.
<ketyn> tor forwards to*
<bentham> ketyn: What are you doing that would make that necessary?
<bentham> Is the default not working for you for some reason?
<bentham> Also, which socket(s) is(are) causing issues for you?  Is it something in /run/tor?
<ketyn> I want to make a tor hidden service listening to port 25, connected to a socket at /var/spool/postfix-test/public/smtpd owned by the user postfix-queue
<ketyn> According to postfix, I'm then supposed to add whatever user I want to read to that socket to the group postfix-queue
<arma> ketyn: hmmm
<arma> for the control socket see the GroupWritable flags
<arma> ControlSocket /run/tor/control GroupWritable RelaxDirModeCheck
<arma> ControlSocketsGroupWritable 1
<arma> this is how you can add your username to the tor group and then have permissions to connect with a controller
<ketyn> This is not a control socket. This is a hidden service. e.g. HiddenServicePort 25 unix:/var/spool/postfix-test/public/smtpd
<arma> i don't think anybody has built something similar for the onion service lines
<arma> but i think that tor is not dropping the groups, it simply is not letting you use the group permission there
<ketyn> I want to be able to receive email over a hidden service. Like in https://github.com/ehloonion/onionmx
<ketyn> > <arma> but i think that tor is not dropping the groups, it simply is not letting you use the group permission there
<ketyn> Huh, ok.
<arma> i say that because being in the group, for the control port, does work
<arma> so it's not like the group got dropped
<arma> check out the UnixSocksGroupWritable config option
<arma> maybe it will help what you want
<bentham> ketyn: Out of curiosity, why is your smtpd listening on a socket rather than, say, 127.0.0.1:25?
<arma> looks like no, it won't do what you want, because UnixSocksGroupWritable doesn't apply to hiddenservice lines
<ketyn> bentham: Because it seems more secure and means I don't have to worry about port conflicts or firewalls, and deploy this setup to computers I don't have full control over.
<ketyn> Here's another good reason I saw: https://github.com/freedomofpress/securedrop/issues/1261
<ketyn> "because applications sometimes (fairly) assume that localhost has a different threat model than an externally exposed service. Most recently, this common configuration lead to some hidden services exposing sensitive information through the Apache mod_status module"
...
<arma> actually arma said "just barely possible that the network team would take a good patch"
<arma> not quite the same as "probably not take"
<arma> but yes, more generally, there is vast confusion about what permissions are *supposed* to be, what groups happen by default in debian/ubuntu, what the SELinux and Apparmor policies do, etc
<arma> i think most people are probably doing it wrong but i don't even know what right is
<arma> i end up putting all my onion service directories in /tmp/ so they work, and that cannot at all be right

I also asked on stackexchange:
https://tor.stackexchange.com/questions/23225/tor-cant-read-hiddenserviceport-unix-socket-through-group-permissions-when-star/23226

------- Original Message -------
On Tuesday, July 5th, 2022 at 5:30 AM, keyandthegate via tor-dev <tor-dev at lists.torproject.org> wrote:

> Permissions are set so tor should be able to access through the `postfix-test-queue` user:
>
>> $ sudo ls -l /var/spool/postfix-test/public/smtpd
>> srw-rw-rw- 1 postfix-test postfix-test 0 █████ /var/spool/postfix-test/public/smtpd
>> $ sudo ls -l /var/spool/postfix-test
>> # ...
>> drwx--x--- 2 postfix-test postfix-test-queue 4096 █████ public
>> $ sudo -u _tor-test id
>> uid=130(_tor-test) gid=141(_tor-test) groups=141(_tor-test),1006(postfix-test-queue)
>> $ cat /etc/tor/instances/test/torrc | grep HiddenServicePort
>> HiddenServicePort 25 unix:/var/spool/postfix-test/public/smtpd
>> $ cat /run/tor-instances/test.defaults | grep User
>> User _tor-test
>
> Running `tor at test` via the default systemctl config shows:
>
>> $ ps -ax -o uid,gid,supgid,command | grep /usr/bin/tor
>> 130 141 141 /usr/bin/tor --defaults-torrc /run/tor-instances/test.defaults -f /etc/tor/instances/test/torrc
>
> Which is missing the `postfix-test-queue` `1006` user which, for example shows up if I do:
>
>> $ sudo -u _tor-test sleep 1000 & ps -ax -o uid,gid,supgid,command | grep sleep
>> [1] 132314
>> 0 141 141,1006 sudo -u _tor-test sleep 1000
>
> Connecting using `sudo -u` works (the message indicates successful connection):
>
>> $ sudo -u _tor-test curl --unix-socket /var/spool/postfix-test/public/smtpd http://localhost
>> curl: (1) Received HTTP/0.9 when not allowed
>
> But connecting via tor does not:
>
>> $ torsocks --ipv6 curl http://█████.onion:25
>> █████ ERROR torsocks[134873]: Host unreachable (in socks5_recv_connect_reply() at socks5.c:539)
>> curl: (7) Couldn't connect to server
>
> But does if I allow access to the socket to everyone:
>
>> $ sudo chmod "o+x" /var/spool/postfix-test/public/
>> $ torsocks --ipv6 curl http://█████.onion:25
>> curl: (1) Received HTTP/0.9 when not allowed
>
> Tor's relevant source code: [Tor: lib/process/setuid.c Source File](https://tpo.pages.torproject.net/core/doc/tor/setuid_8c_source.html)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20220706/79fc23be/attachment-0001.htm>