Commit aa24bdf8 authored by Julien Moutinho's avatar Julien Moutinho
Browse files

nixos/tor: do not put Unix sockets in BindPaths= 

- The socket may not be accessible at all times resulting in the Tor unit failing to start.
- If the socket is re-created it will become inaccessible.
- Tor can't be started if any of the UNIX sockets are not available,
which may result in a single service having issues affecting all services.
(It may be best to start Tor to serve N-1 sockets even if 1 socket isn't available).

Reverts: https://github.com/NixOS/nixpkgs/pull/440889
Fixes: https://github.com/NixOS/nixpkgs/issues/481673
Reported-by: https://github.com/kevincox
parent cb6aa806

nixos/doc/manual/release-notes/rl-2605.section.md

+5 −0
Original line number Diff line number Diff line
@@ -77,6 +77,11 @@ of pulling the upstream container image from Docker Hub. If you want the old beh 


- Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13.



- `services.tor` no longer bind mounts Unix sockets of onion services into its chroot

because it was not reliable. Users should do it themselves using either `JoinsNamespaceOf=` and Unix sockets in `/tmp`

or `BindPaths=` from a persistent parent directory of each Unix socket.

See <https://github.com/NixOS/nixpkgs/issues/481673>.



- support for `ecryptfs` in nixpkgs has been removed.



- The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.

nixos/modules/services/security/tor.nix

+25 −13
Original line number Diff line number Diff line
@@ -636,7 +636,31 @@ in 
        };



        onionServices = lib.mkOption {

          description = (descriptionGeneric "HiddenServiceDir");

          description = descriptionGeneric "HiddenServiceDir" + ''

            :::{.warning}

            Because `tor.service` runs in its own `RootDirectory=`,

            when using a onion service to reverse-proxy to a Unix socket,

            you need to make that Unix socket available

            within the mount namespace of `tor.service`.



            When you can configure your service to create its socket in `/tmp`,

            this can be done with:

            ```nix

            systemd.services.''${your-service} = {

              unitConfig.JoinsNamespaceOf = [ "tor.service" ];`

              serviceConfig.PrivateTmp = true;

            };

            ```

            Otherwise, you can use:

            ```nix

            systemd.services.tor.serviceConfig.BindPaths = [ "/path/to/your-service/socket/directory" ];

            ```

            but you have to be sure that `/path/to/socket/directory`

            exists before `tor.service` is started

            and is not deleted and recreated between restarts of `your-service`,

            or you'll need to restart `tor.service` to refresh the `BindPaths=`.

            :::

          '';

          default = { };

          example = {

            "example.org/www" = {
@@ -1416,18 +1440,6 @@ in 
        RootDirectoryStartOnly = true;

        #InaccessiblePaths = [ "-+${runDir}/root" ];

        UMask = "0066";

        BindPaths = [

          stateDir

        ]

        ++ lib.filter (x: x != null) (

          lib.catAttrs "unix" (

            lib.filter (x: x != null) (

              lib.catAttrs "target" (

                lib.concatMap (onionService: onionService.map) (lib.attrValues cfg.relay.onionServices)

              )

            )

          )

        );

        BindReadOnlyPaths = [

          builtins.storeDir

          "/etc"