#1021911 obfs4proxy: preserve user capability overrides on upgrade

Package:
obfs4proxy
Source:
obfs4proxy
Description:
pluggable transport proxy for Tor, implementing obfs4
Submitter:
Toralf Förster
Date:
2023-06-11 15:21:03 UTC
Severity:
normal
#1021911#5
Date:
2022-10-17 09:29:04 UTC
From:
To:
Issue: overwriting capabilities

During update the package overwrites an installed /usr/bin/obfs4proxy
without preserving the capabilities, eg. set by

	 setcap cap_net_bind_service=+ep /usr/bin/obfs4proxy

So a Tor bridge with a port below 1024 emits after restart "obfs4 listen
tcp 0.0.0.0:443: bind: permission denied" to its warn log but continues
without obfuscation.

BTW, shouldn't an upgrade of obfs4proxy restart Tor unconditionally?
#1021911#10
Date:
2022-11-15 00:08:07 UTC
From:
To:
Control: block 1021911 by 502580 970827
Control: retitle 1021911 obfs4proxy: preserve user capability overrides on upgrade

Unfortunately, dpkg-statoverride doesn't yet support capabilities
(#502580), so preserving capability changes isn't easily possible and
dpkg and the .deb format doesn't yet support capabilities (#970827) so
obfs4proxy can't easily ship with reliably supported capabilities.

In theory there could be a complicated dance with preinst/postinst
scripts checking for overrides and restoring them after upgrade, but
that would be difficult, so might be best to wait for dpkg support.

One workaround would be for you to add an apt hook for this:

   /etc/apt/apt.conf.d/99-obfs4proxy-capability:

   DPkg::Post-Invoke { "setcap cap_net_bind_service=+ep /usr/bin/obfs4proxy"; };

This would be invoked after every single upgrade that apt does.

Other workaround would be for you to add a dpkg hook for this:

   /etc/dpkg/dpkg.cfg.d/obfs4proxy-capability:

   post-invoke=setcap cap_net_bind_service=+ep /usr/bin/obfs4proxy

This would be invoked after every single upgrade that dpkg does.

If you are using a metapackage to setup your system it could a trigger
on the obfs4proxy binary, which would only run on obfs4proxy upgrades.

In all of these workarounds there will a window of time where the
capability will not be set, so restarting tor/obfs4proxy during those
windows might cause the problem that you discovered.

I'm not one of the Tor/obfs4proxy maintainers, so I can't answer that.
#1021911#19
Date:
2022-11-15 09:11:25 UTC
From:
To:
This is a good work around - thx.
#1021911#24
Date:
2023-06-11 15:18:39 UTC
From:
To:
On Tue, 15 Nov 2022 10:11:25 +0100 =?UTF-8?Q?Toralf_F=c3=b6rster?= <toralf.foerster@gmx.de> wrote:

Today I upgraded from bullseye to bookworm. For some reason however
after that Tor gave the well-known warning:

     "(obfs4 listen tcp 0.0.0.0:443: bind: permission denied)"

I fixed it with an Ansible role but was wondering, why it was needed.