(name . Bug reports for GNU Guix)(address . bug-guix@gnu.org)
87sflxhg98.fsf@nckx
Hi all,
I recently found my Tor nodes dead, unable to bind to their port
with a confusing ‘permission denied’ error.
This was caused by a regression in Guix's Tor service: it now uses
‘least-authority-wrapper’, meaning that it… well, hasn't the
authority to bind to all ports. Oops.
Even today, (some, well-known) low ports are firewalled/flagged
noticeably less than higher ones. Thankfully, DPI isn't the norm
yet.
Reverting commit fb868cd7794f15e21298e5bdea996fbf0dad17ca fixes
this.
Our service wasn't insecure before: Tor expects to be started as
root and drop privileges through the torrc ‘User’ directive, not
the way Guix now does it through namespaces.
Still, I'll take a stab at relaxing the service's POLA parameters
to allow this, hoping to get the best of both worlds, but this is
new territory to me. Maybe that's not possible.
Kind regards,
T G-R
-----BEGIN PGP SIGNATURE-----
iIMEARYKACsWIQT12iAyS4c9C3o4dnINsP+IT1VteQUCYvo0cw0cbWVAdG9iaWFz
LmdyAAoJEA2w/4hPVW15gw0BAJIChj6smvZ2VF3KKxxtdkoiplDCLttKGgZAivH3
NjRuAP9UuAWrCwjnIEziQK9BP1BU8mUQgIVepvfVjXfeGKtDCw==
=fRty
-----END PGP SIGNATURE-----