4

I have problem with tor and obfsproxy for using bridges on ubuntu 14.04. Tor could not start obfsproxy and always return permission denied.

grep -v "^#" /etc/tor/torrc | sed '/^$/d'

UseBridges 1
Bridge obfs2 192.36.27.216:55313 fccb4bf2a7b89b070902bdd05923c255fb4b0bdb 
ClientTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy --managed

tail -f /var/log/tor/log

Aug 01 13:06:30.000 [notice] Tor 0.2.4.23 (git-05b81fcd2a655c5a) opening new log file.
Aug 01 13:06:30.000 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip.
Aug 01 13:06:30.000 [notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6.
Aug 01 13:06:30.000 [warn] OpenSSL version from headers does not match the version we're running with. If you get weird crashes, that might be why. (Compiled with 1000105f:     OpenSSL 1.0.1e 11 Feb 2013; running with 1000106f: OpenSSL 1.0.1f 6 Jan 2014).
Aug 01 13:06:33.000 [warn] Could not launch managed proxy executable at '/usr/bin/obfsproxy' ('Permission denied').
Aug 01 13:06:34.000 [notice] Bootstrapped 5%: Connecting to directory server.
Aug 01 13:06:34.000 [warn] We were supposed to connect to bridge '192.36.27.216:55313' using pluggable transport 'obfs2', but we can't find a pluggable transport proxy supporting 'obfs2'. This can happen if you haven't provided a ClientTransportPlugin line, or if your pluggable transport proxy stopped running.
8

Premise
How to configure Tor and Obfsproxy:
- https://www.torproject.org/projects/obfsproxy-debian-instructions

According with this bug report:
https://trac.torproject.org/projects/tor/ticket/6996
... the obfsproxy permission error is triggered by the tor init script ( at least on debian/ubuntu ) because of tor apparmor wrong script (/etc/apparmor.d/system_tor)

so basically approuch is to stop the service and launch tor directly so a simple and straight:

sudo service tor stop && tor

this should work ( don't use sudo to launch tor or you will get a different error :(

Better solution
is to fix the apparmor tor profile so that the tor service start correctly

  1. edit this file /etc/apparmor.d/system_tor
  2. add this line /usr/bin/obfsproxy Ux,
  3. restart apparmor service (sudo service apparmor restart )

So the profile should look something like this:

# vim:syntax=apparmor
#include <tunables/global>

profile system_tor {
  #include <abstractions/tor>

  owner /var/lib/tor/** rwk,
  owner /var/log/tor/* w,

  /usr/bin/obfsproxy  Ux,  ## this is the FIX

  /{,var/}run/tor/control w,
  /{,var/}run/tor/tor.pid w,
  /{,var/}run/tor/control.authcookie w,
  /{,var/}run/tor/control.authcookie.tmp rw,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/system_tor>
}
  • As you said, it's a bug. I had to disable default init script to prevent conflict and I'm using simple script in '/etc/init' folder atm to run tor automaticely. – nekofar Sep 4 '14 at 20:00
  • 1
    In later versions of Ubuntu, this needs another line in /etc/apparmor.d/system_tor or else it won't be able to stop the obfsproxy process when the tor service is stopped: signal (send) set=("term") peer="unconfined", See trac.torproject.org/projects/tor/ticket/13716 – Olathe Dec 17 '14 at 23:39
1

I modified apparmor profile /etc/apparmor.d/system_tor, just added three lines in it:

/usr/bin/obfsproxy PUx,
profile /etc/apparmor.d/usr.bin.obfsproxy {
}

Whole file sample:

# vim:syntax=apparmor
#include <tunables/global>

profile system_tor flags=(attach_disconnected) {
  #include <abstractions/tor>

  /usr/bin/obfsproxy PUx,

  profile /etc/apparmor.d/usr.bin.obfsproxy {
  }

  owner /var/lib/tor/** rwk,
  owner /var/lib/tor/ r,
  owner /var/log/tor/* w,

  # During startup, tor (as root) tries to open various things such as
  # directories via check_private_dir().  Let it.
  /var/lib/tor/** r,

  /{,var/}run/tor/ r,
  /{,var/}run/tor/control w,
  /{,var/}run/tor/socks w,
  /{,var/}run/tor/tor.pid w,
  /{,var/}run/tor/control.authcookie w,
  /{,var/}run/tor/control.authcookie.tmp rw,
  /{,var/}run/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/system_tor>
}

line

/usr/bin/obfsproxy  PUx,

I took from the post above

0

Newer versions of Ubuntu require /etc/apparmor/system_tor to be like this:

# vim:syntax=apparmor
#include <tunables/global>

profile system_tor {
  #include <abstractions/tor>

  owner /var/lib/tor/** rwk,
  owner /var/log/tor/* w,

  /usr/bin/obfsproxy  PUx,  ## this is the FIX

  /{,var/}run/tor/control w,
  /{,var/}run/tor/tor.pid w,
  /{,var/}run/tor/control.authcookie w,
  /{,var/}run/tor/control.authcookie.tmp rw,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/system_tor>
}

Make note of the PUx instead of the Ux as would be used in earlier versions of Ubuntu.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.