aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLudovic Courtès <ludo@gnu.org>2022-07-19 16:26:53 +0200
committerLudovic Courtès <ludo@gnu.org>2022-07-19 18:54:42 +0200
commitfb868cd7794f15e21298e5bdea996fbf0dad17ca (patch)
treedc20ff15186e5658ff176b0cd1d81a5c8b051c5f
parentf0acb12db92b66069bbf77bcde64bdd890e9eb93 (diff)
downloadguix-fb868cd7794f15e21298e5bdea996fbf0dad17ca.tar.gz
guix-fb868cd7794f15e21298e5bdea996fbf0dad17ca.zip
services: tor: Switch to 'least-authority-wrapper'.
* gnu/services/networking.scm (tor-configuration->torrc): Remove "User" and "PidFile". (tor-shepherd-service): Use 'least-authority-wrapper' and 'make-forkexec-constructor' instead of 'make-forkexec-constructor/container'.
-rw-r--r--gnu/services/networking.scm47
1 files changed, 28 insertions, 19 deletions
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index a9560db66b..b555c46040 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -918,9 +918,7 @@ applications in communication. It is used by Jami, for example.")))
(lambda (port)
(display "\
### These lines were generated from your system configuration:
-User tor
DataDirectory /var/lib/tor
-PidFile /var/run/tor/tor.pid
Log notice syslog\n" port)
(when (eq? 'unix '#$socks-socket-type)
(display "\
@@ -960,7 +958,25 @@ HiddenServicePort ~a ~a~%"
"Return a <shepherd-service> running Tor."
(match config
(($ <tor-configuration> tor)
- (let ((torrc (tor-configuration->torrc config)))
+ (let* ((torrc (tor-configuration->torrc config))
+ (tor (least-authority-wrapper
+ (file-append tor "/bin/tor")
+ #:name "tor"
+ #:mappings (list (file-system-mapping
+ (source "/var/lib/tor")
+ (target source)
+ (writable? #t))
+ (file-system-mapping
+ (source "/dev/log") ;for syslog
+ (target source))
+ (file-system-mapping
+ (source "/var/run/tor")
+ (target source)
+ (writable? #t))
+ (file-system-mapping
+ (source torrc)
+ (target source)))
+ #:namespaces (delq 'net %namespaces))))
(with-imported-modules (source-module-closure
'((gnu build shepherd)
(gnu system file-systems)))
@@ -974,22 +990,15 @@ HiddenServicePort ~a ~a~%"
(modules '((gnu build shepherd)
(gnu system file-systems)))
- (start #~(make-forkexec-constructor/container
- (list #$(file-append tor "/bin/tor") "-f" #$torrc)
-
- #:log-file "/var/log/tor.log"
- #:mappings (list (file-system-mapping
- (source "/var/lib/tor")
- (target source)
- (writable? #t))
- (file-system-mapping
- (source "/dev/log") ;for syslog
- (target source))
- (file-system-mapping
- (source "/var/run/tor")
- (target source)
- (writable? #t)))
- #:pid-file "/var/run/tor/tor.pid"))
+ ;; XXX: #:pid-file won't work because the wrapped 'tor'
+ ;; program would print its PID within the user namespace
+ ;; instead of its actual PID outside. There's no inetd or
+ ;; systemd socket activation support either (there's
+ ;; 'sd_notify' though), so we're stuck with that.
+ (start #~(make-forkexec-constructor
+ (list #$tor "-f" #$torrc)
+ #:user "tor" #:group "tor"
+ #:log-file "/var/log/tor.log"))
(stop #~(make-kill-destructor))
(documentation "Run the Tor anonymous network overlay."))))))))