On a Ubuntu 12.04 "precise" host, I have installed obfsproxy and upgraded tor via the debian packages. More specifically:
$> sudo apt-get install -y tor obfsproxy...$> which obfsproxy/usr/bin/obfsproxy$> obfsproxy --versionobfsproxy 0.1.4 (git-94ebc4c3edf1e3e5)$> tor --version [notice] Tor v0.2.3.22-rc (git-4a0c70a817797420) running on Linux. [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warningTor version 0.2.3.22-rc (git-4a0c70a817797420).
When I turn Log on via torrc, the log output is slightly more verbose:
$> sudo grep -v "^#" /etc/tor/torrc | grep LogLog debug file /var/log/tor/debug.log$> sudo grep obfs /var/log/tor/debug.log [info] launch_managed_proxy(): Managed proxy at '/usr/bin/obfsproxy' has spawned with PID '2423'. [info] handle_proxy_line(): Got a line from managed proxy '/usr/bin/obfsproxy': (ERR: Failed to spawn background process - code 9/D) [warn] Could not launch managed proxy executable at '/usr/bin/obfsproxy' ('Permission denied').
The reason I was thinking it has to do with my init script (although I don't think I changed it myself. It was probably installed with Tor 0.2.2.x originally), is that I tried to run multiple Tor processes controlled via init.d using the instructions here:
[https://www.torservers.net/wiki/setup/server#multiple_tor_processes]
And the effect was that obfsproxy did start using this alternative init script. However, I reverted back to the original init script because the stopping of multiple Tor processes didn't work and I realized that I only need one Tor process to support a regular and an obfuscated bridge.
In the hope that the permission required to start the managed obfsproxy had to do with write permissions in certain locations, I attempted: (but it didn't resolve the problem)
I'm attaching the short log and the more detailed debug.log. Also the init scripts tor (which must have come with the first Tor installation) and tor.MULTIPLE, which came from the commands below, are attached.
$> cd /etc/init.d$> sudo mv tor tor.ORIG$> sudo wget -O tor https://www.torservers.net/misc/config/initd-tor$> sudo mv tor tor.MULTIPLE$> sudo mv tor.ORIG tor
Thanks!
Linda
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Child items
...
Show closed items
Linked items
0
Link issues together to show that they're related.
Learn more.
I can't reproduce this behavior with the same Ubuntu version and the Debian obfsproxy package. It might be something in your environment.
What happens if you try to run tor without the init script?
Can you try:
tor -f torrc
where tor points to your tor binary, and torrc to your torrc file?
I can't reproduce this behavior with the same Ubuntu version and the Debian obfsproxy package. It might be something in your environment.
What happens if you try to run tor without the init script?
Can you try:
tor -f torrc
where tor points to your tor binary, and torrc to your torrc file?
YES! It must be the init script:
linda@vm05:~$ tor -f /etc/tor/torrcOct 01 07:12:50.618 [notice] Tor v0.2.3.22-rc (git-4a0c70a817797420) running on Linux....Oct 01 07:12:53.000 [notice] Registered server transport 'obfs2' at '0.0.0.0:8082'Oct 01 07:13:02.000 [notice] Bootstrapped 100%: Done.Oct 01 07:13:02.000 [notice] Now checking whether ORPort 128.18.9.70:8888 is reachable... (this may take up to 20 minutes -- look for log messages indicating success)Oct 01 07:13:05.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.^Z[1]+ Stopped tor -f /etc/tor/torrclinda@vm05:~$ bg[1]+ tor -f /etc/tor/torrc &linda@vm05:~$ sudo grep Transport /var/lib/tor/statelinda@vm05:~$ sudo grep Transport /var/tor/stateTransportProxy obfs2 0.0.0.0:8082linda@vm05:~$ ps axu | grep obfslinda 16315 0.0 0.0 19024 1824 pts/0 S 07:12 0:00 /usr/bin/obfsproxy --managed
Hmmmm. It uses the state under /var/tor/ (with a little hack to force it using our open port 8082). When using the init script, I think it wants to write to /var/lib/tor/state, which is why I had originally changes the permissions for those files (with no luck).
I haven't done anything to the init script since installing Tor for the first time on this machine in version 0.2.2.x (I think Dec. 2011).
Maybe you can share your init script since it seems to work? (I'm not really an expert on administrating Linux/Debian/Ubuntu, so not very familiar with the workings of /etc/init.d/ and sudo service XXX start|stop)
Now I'm trying to add all the options in /usr/share/tor/tor-service-defaults-torrc to the command line to see if it reproduces the error. It works if I leave out User debian-tor:
linda@vm05:~$ more /usr/share/tor/tor-service-defaults-torrc DataDirectory /var/lib/torPidFile /var/run/tor/tor.pidRunAsDaemon 1User debian-torControlSocket /var/run/tor/controlControlSocketsGroupWritable 1CookieAuthentication 1CookieAuthFileGroupReadable 1CookieAuthFile /var/run/tor/control.authcookieLog notice file /var/log/tor/loglinda@vm05:~$ sudo -u debian-tor tor -f /etc/tor/torrc DataDirectory /var/lib/tor RunAsDaemon 1 Log "notice file /var/log/tor/log" ControlSocket /var/run/tor/control ControlSocketsGroupWritable 1 PidFile /var/run/tor/tor.pid CookieAuthentication 1 CookieAuthFileGroupReadable 1 CookieAuthFile /var/run/tor/control.authcookieOct 01 07:44:16.272 [notice] Tor v0.2.3.22-rc (git-4a0c70a817797420) running on Linux.Oct 01 07:44:16.272 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warningOct 01 07:44:16.272 [notice] Read configuration file "/etc/tor/torrc".Oct 01 07:44:16.274 [notice] Your ContactInfo config option is not set. Please consider setting it, so we can contact you if your server is misconfigured or something else goes wrong.Oct 01 07:44:16.274 [notice] We were compiled with headers from version 2.0.16-stable of Libevent, but we're using a Libevent library that says it's version 2.0.19-stable.Oct 01 07:44:16.275 [notice] Initialized libevent version 2.0.19-stable using method epoll (with changelist). Good.Oct 01 07:44:16.275 [notice] Opening Control listener on /var/run/tor/controlOct 01 07:44:16.275 [notice] Opening OR listener on 0.0.0.0:8888linda@vm05:~$ sudo grep obfs /var/log/tor/logOct 01 07:44:19.000 [notice] Registered server transport 'obfs2' at '0.0.0.0:53224'linda@vm05:~$ sudo grep Transport /var/lib/tor/stateTransportProxy obfs2 0.0.0.0:53224
However, if I add the user as an option, tor doesn't even come up. Nothing else gets printed into /var/log/tor/log:
linda@vm05:~$ sudo -u debian-tor tor -f /etc/tor/torrc DataDirectory /var/lib/tor RunAsDaemon 1 Log "notice file /var/log/tor/log" ControlSocket /var/run/tor/control ControlSocketsGroupWritable 1 PidFile /var/run/tor/tor.pid CookieAuthentication 1 CookieAuthFileGroupReadable 1 CookieAuthFile /var/run/tor/control.authcookie User debian-torOct 01 07:47:37.331 [notice] Tor v0.2.3.22-rc (git-4a0c70a817797420) running on Linux.Oct 01 07:47:37.331 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warningOct 01 07:47:37.331 [notice] Read configuration file "/etc/tor/torrc".Oct 01 07:47:37.334 [notice] Your ContactInfo config option is not set. Please consider setting it, so we can contact you if your server is misconfigured or something else goes wrong.Oct 01 07:47:37.334 [notice] We were compiled with headers from version 2.0.16-stable of Libevent, but we're using a Libevent library that says it's version 2.0.19-stable.Oct 01 07:47:37.334 [notice] Initialized libevent version 2.0.19-stable using method epoll (with changelist). Good.Oct 01 07:47:37.335 [notice] Opening Control listener on /var/run/tor/controlOct 01 07:47:37.335 [notice] Opening OR listener on 0.0.0.0:8888Oct 01 07:47:37.335 [warn] Error setting groups to gid 115: "Operation not permitted".Oct 01 07:47:37.335 [warn] Tor is already running as debian-tor. You do not need the "User" option if you are already running as the user you want to be. (If you did not set the User option in your torrc, check whether it was specified on the command line by a startup script.)Oct 01 07:47:37.335 [warn] Failed to parse/validate config: Problem with User value. See logs for details.Oct 01 07:47:37.335 [err] Reading config failed--see warnings above.
Now I'm trying to add all the options in /usr/share/tor/tor-service-defaults-torrc to the command line to see if it reproduces the error. It works if I leave out User debian-tor:
linda@vm05:~$ sudo -u debian-tor tor -f /etc/tor/torrc DataDirectory /var/lib/tor RunAsDaemon 1 Log "notice file /var/log/tor/log" ControlSocket /var/run/tor/control ControlSocketsGroupWritable 1 PidFile /var/run/tor/tor.pid CookieAuthentication 1 CookieAuthFileGroupReadable 1 CookieAuthFile /var/run/tor/control.authcookie User debian-tor
Oct 01 07:47:37.335 [warn] Error setting groups to gid 115: "Operation not permitted".
Oct 01 07:47:37.335 [warn] Tor is already running as debian-tor. You do not need the "User" option if you are already running as the user you want to be. (If you did not set the User option in your torrc, check whether it was specified on the command line by a startup script.)
Oct 01 07:47:37.335 [warn] Failed to parse/validate config: Problem with User value. See logs for details.
Does this give you any clues?
The init script starts Tor as root, and then Tor drops privs to the debian-tor user. If you start Tor as debian-tor, you shouldn't ask it to change user. Hopefully the above explanation by Tor makes sense?
Now I'm trying to add all the options in /usr/share/tor/tor-service-defaults-torrc to the command line to see if it reproduces the error. It works if I leave out User debian-tor:
linda@vm05:~$ sudo -u debian-tor tor -f /etc/tor/torrc DataDirectory /var/lib/tor RunAsDaemon 1 Log "notice file /var/log/tor/log" ControlSocket /var/run/tor/control ControlSocketsGroupWritable 1 PidFile /var/run/tor/tor.pid CookieAuthentication 1 CookieAuthFileGroupReadable 1 CookieAuthFile /var/run/tor/control.authcookie User debian-tor
Oct 01 07:47:37.335 [warn] Error setting groups to gid 115: "Operation not permitted".
Oct 01 07:47:37.335 [warn] Tor is already running as debian-tor. You do not need the "User" option if you are already running as the user you want to be. (If you did not set the User option in your torrc, check whether it was specified on the command line by a startup script.)
Oct 01 07:47:37.335 [warn] Failed to parse/validate config: Problem with User value. See logs for details.
Does this give you any clues?
The init script starts Tor as root, and then Tor drops privs to the debian-tor user. If you start Tor as debian-tor, you shouldn't ask it to change user. Hopefully the above explanation by Tor makes sense?
Yes, it does. And from the log output, I understood that calling tor from the command line as user debian-tor made the option User moot. I was just trying to get as close as possible to what the (broken?) init script does. Unfortunately, it worked like a charm when I called tor from the command line with all the other options.
I wish there was a way to see what kind of permission is denied when I use the init script. Is it writing to a file? Which one? I guess the --managed is still a mystery to me... (although I like how it works when I send SIGTERM to tor and it also kills the obfsproxy process if running).
I can't reproduce this behavior with the same Ubuntu version and the Debian obfsproxy package. It might be something in your environment.
What happens if you try to run tor without the init script?
Can you try:
tor -f torrc
where tor points to your tor binary, and torrc to your torrc file?
OK, another thing that works is:
$> sudo tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc...$> ps axu | grep tor107 17474 0.8 1.7 396556 69412 ? Sl 08:50 0:02 tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc$> id debian-toruid=107(debian-tor) gid=115(debian-tor) groups=115(debian-tor)$> sudo grep obfs /var/log/tor/logOct 01 08:50:34.000 [notice] Registered server transport 'obfs2' at '0.0.0.0:8082'$> sudo grep Transport /var/lib/tor/stateTransportProxy obfs2 0.0.0.0:8082
but the init script still doesn't work. However, I can use the init script to stop the above started tor and obfsproxy. So using this method for now to have the bridge up and running. However, if you have any clues as to what the init script does differently to the above command line, maybe we can fix it for future use...
Now I'm trying to add all the options in /usr/share/tor/tor-service-defaults-torrc to the command line to see if it reproduces the error. It works if I leave out User debian-tor:
linda@vm05:~$ sudo -u debian-tor tor -f /etc/tor/torrc DataDirectory /var/lib/tor RunAsDaemon 1 Log "notice file /var/log/tor/log" ControlSocket /var/run/tor/control ControlSocketsGroupWritable 1 PidFile /var/run/tor/tor.pid CookieAuthentication 1 CookieAuthFileGroupReadable 1 CookieAuthFile /var/run/tor/control.authcookie User debian-tor
Oct 01 07:47:37.335 [warn] Error setting groups to gid 115: "Operation not permitted".
Oct 01 07:47:37.335 [warn] Tor is already running as debian-tor. You do not need the "User" option if you are already running as the user you want to be. (If you did not set the User option in your torrc, check whether it was specified on the command line by a startup script.)
Oct 01 07:47:37.335 [warn] Failed to parse/validate config: Problem with User value. See logs for details.
Does this give you any clues?
The init script starts Tor as root, and then Tor drops privs to the debian-tor user. If you start Tor as debian-tor, you shouldn't ask it to change user. Hopefully the above explanation by Tor makes sense?
Yes, it does. And from the log output, I understood that calling tor from the command line as user debian-tor made the option User moot. I was just trying to get as close as possible to what the (broken?) init script does. Unfortunately, it worked like a charm when I called tor from the command line with all the other options.
I wish there was a way to see what kind of permission is denied when I use the init script. Is it writing to a file? Which one? I guess the --managed is still a mystery to me... (although I like how it works when I send SIGTERM to tor and it also kills the obfsproxy process if running).
The permission error happened when Tor tried to execute the file /usr/bin/obfsproxy.
execve() (the function used to execute that file) says "Permission denied" when the following things happen:
EACCES Search permission is denied on a component of the path prefix of filename or the name of a script interpreter. (See also path_resolution(7).) EACCES The file or a script interpreter is not a regular file. EACCES Execute permission is denied for the file or a script or ELF interpreter. EACCES The file system is mounted noexec.
I'm not sure in which case you belong, and unfortunately there is no way for execve() to be more verbose.
I also tried using your /etc/tor/torrc with the default init script of tor in Ubuntu, and obfsproxy spawned fine.
If you feel playful, you can move the obfsproxy binary to a different place (like /tmp/obfsproxy or something) and see if you still get the Permission Denied error. Or you can replace /usr/bin/obfsproxy with a different binary and see if you still get the same error.
So it's AppArmor playing games here and somehow we must alter the policy to allow obfsproxy be started by the init-script. I'm not AppArmor savvy (yet), but that's the way to go, I suppose. Maybe you see these AppArmor messages too in your logs?
Thanks! I've come accross an AppArmor profile, but this did not work. The line above did almost work, but AppArmor complained:
AppArmor parser error for /etc/apparmor.d/system_tor in /etc/apparmor.d/local/system_tor at line 4: \ Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'
So I replaced "rx" ("read", "execute") with "ix" ("inherit execute"):
and /etc/apparmor.d/local/system_tor did exist, but was empty. After adding the line above to this file, Tor could be started via the init-script. The tor package (0.2.3.25-1~precise+1 from deb.torproject.org) already shipped /etc/apparmor.d/system_tor.
Hm, I don't know much about AppArmor configuration, but it seems that you should allow it to access Python modules (and weird scripts like sitecustomize.py). There is probably a standard way to whitelist Python applications in AppArmor, right?
You can run aa-genprof which will put apparmor in complain mode then will analyze kernel logs looking for apparmor syslog messages and finally generate a more or less accurate profile for the specific program
Interestingly it says "profile=system_tor", although I just generated /etc/apparmor.d/usr.bin.obfsproxy. Hm, for now I'll let obfsproxy run unconfined:
/usr/bin/obfsproxy Uxr,
I'll have to ponder this a bit more. But maybe I should take this to the mailing list instead of spamming this ticket, sorry for this.
It doesn't make a difference what it's coded in. This is a permissions issue when auto launching at startup which starts with the "debian-t" profile.
Launching it via terminal there is no issues, but that launches as root. I don't know enough about apparmor to help debug it, but looking through the profiles, there are 0 entries for obfsproxy, making me think the profile was created before obfsproxy even existed.
Trac: Username: funkstar Status: closed to reopened Version: Tor: 0.2.3.22-rc to Tor: 0.2.5.1-alpha Resolution: wontfix toN/A
AFAIK, the Tor AppArmor profile is neither shipped in Tor nor obfsproxy tarballs. It is only shipped by the tor Debian package. So, the relevant place to report this bug is the Debian bug tracker.
Assuming this is done (and hopefully the problem is summarized, so that I can avoid reading 1.5 years of comments on this ticket), I've got great news for you: luckily, the person who wrote this profile, had it integrated into the Debian package, and is happy to maintain it (hint: that's me) is subscribed to the bugs affecting the tor package on the Debian bug tracker, and will then know about it... as opposed to learning about the problem 17 months after it has been submitted here.
I'm not using anything from Debian. I'm using the auto generated nightly PPA which is hosted on torproject.org and thus, created a ticket on the Tor ticket tracker. I will not be registering to the Debian tracker to report something that is already documented here, sorry.
The full error is below, feel free to ask any other questions, though I'm not sure what more can be said that I haven't already. There's no real need to read the other posts.
[warn] Could not launch managed proxy executable at '/usr/bin/obfsproxy' ('Permission denied')
Reported as Debian bug 739279, with a patch attached.
Dear obfsproxy / Tor folks, I assume this is another occurrence of unclear scopes of responsibilities, that lead us to wait that long before the person responsible for these bits was made aware of the situation. In the future, please forward issues with the AppArmor profile shipped in the tor Debian package to me, or, even better, to the Debian bug tracker. Thanks in advance :)
Now, I'll let you handle this ticket the way you want, and won't monitor it.