HexicPyth
commented
7 years ago Hi, It's 'user___' from IRC :)
So after playing around a bit, and looking at a bunch of bug reports on launchpad, I found a much safer workaround/fix for getting bridges to work properly. The issue lies in the system_tor AppArmor abstraction file, /etc/apparmor.d/abstractions/tor
Simply change line 27 from /usr/bin/obfs4proxy, PUx, to /usr/bin/obfs4proxy, ix, and reboot.
(note the commas)
Here is a full dump of the corrected /etc/apparmor.d/abstractions/tor:
`# vim:syntax=apparmor
#include <abstractions/base>
#include <abstractions/nameservice>
network tcp,
network udp,
capability chown,
capability dac_override,
capability fowner,
capability fsetid,
capability setgid,
capability setuid,
/usr/bin/tor r,
/usr/sbin/tor r,
/proc/sys/kernel/random/uuid r,
/sys/devices/system/cpu/ r,
/sys/devices/system/cpu/** r,
/etc/tor/* r,
/usr/share/tor/** r,
/usr/bin/obfsproxy PUx,
/usr/bin/obfs4proxy ix,`Credits to Ali Mirjamali (alimirjamali) from (https://bugs.launchpad.net/ubuntu/+source/tor/+bug/1568435) (comment number six) for the solution.
A quick note on security According to Apparmor's QuickProfileLanguage specifications: 'Pux' means: "Execute under a specific profile (scrub the environment) but fallback to executing unconfined if the target profile is not found," while 'ix' means " Execute and inherit the current profile"
I'll probably make a pull request tomorrow.
intrigeri
dma
Configuring an obfs3/4 bridge results in this error when Tor attempts to use the bridge:
Jun 29 15:02:24.000 [warn] Could not launch managed proxy executable at '/usr/bin/obfs4proxy' ('Operation not permitted').
No AppArmor violations in audit log.
Workaround: Can be fixed by disabling all hardening in /lib/systemd/system/tor@default.service
Do not yet know precisely which hardening setting is responsible for this.