Hi weasel,

Here is a patch for the systemd unit files that we ship with tor.

It prevents tor from having read-write access to /var/run, and from having
access to /var/log (except for tor@default, which writes logs there).

Moreover, it restrict tor instances to their own directory under
/var/{lib,run}/tor-instances, now that #781730 is solved.

I did not (yet) test it on instances other than @default, but I will do so
momentarily.


Best,

  nicoo

- -- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (900, 'testing'), (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.13.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages tor depends on:
ii  adduser         3.116
ii  libc6           2.25-3
ii  libcap2         1:2.25-1.2
ii  libevent-2.1-6  2.1.8-stable-4
ii  liblzma5        5.2.2-1.3
ii  libseccomp2     2.3.1-2.1
ii  libssl1.1       1.1.0g-2
ii  libsystemd0     235-3
ii  libzstd1        1.3.2+dfsg2-1
ii  lsb-base        9.20170808
ii  zlib1g          1:1.2.8.dfsg-5

Versions of packages tor recommends:
ii  logrotate    3.11.0-0.1
pn  tor-geoipdb  <none>
ii  torsocks     2.2.0-2

Versions of packages tor suggests:
ii  apparmor-utils       2.11.1-4
pn  mixmaster            <none>
pn  obfs4proxy           <none>
ii  socat                1.7.3.2-2
ii  tor-arm              1.4.5.0-1.1
ii  torbrowser-launcher  0.2.8-5

- -- Configuration Files:
/etc/tor/torrc changed:
SOCKSPort 9050 IPv6Traffic


- -- no debconf information
-----BEGIN PGP SIGNATURE-----

iQJNBAEBCgA3FiEEiWEbFKE2h/s1SpJPnU+IAQz+GeMFAlo/u4gZHG5pY29sYXNA
YnJhdWQtc2FudG9uaS5ldQAKCRCdT4gBDP4Z46gtD/0chaqTZjTlNCloeQXgRLPx
quaEeXfytY61UpvX1ScpQDThLSpGcUW5SAnt/9LE04EHAmnqj30XmOAo0CQi41k4
K3k+UUWTGaRtIV0+HeaHLdj9AlrXGXSsllk9RzlnXcq2udQhrawTrGbeXau/QeOX
OL8oTFYT1qC9AEFh3f95nfEicyPv7j3/UYd/73vzzxA49lZ93FELXz5M3EHGiqCH
1nXMXPwoeYyEJApqe7jJdCCkrfgAO5fHogYzk5h518+Hd3fUHcwfj1zohRDp//L7
AZdEzghwNEgkS9VpxQ62MAlueeEwpO7VY12WDC+tulx0Z9pKMhQ+2s25aca/v6e4
ExE5oA4P9pwoGyyikRbYkq6G7FzTkLpZ1Fqz0VKEbiurrrLJTPG8CTBWDmk0aom0
PBOgz1nbsqpLJVMPq2sOGS4RGbnxy30vzKmnU7RrBknpvVDrHEqQxNNFjxlLIwJZ
D1HSOGuZHovVJ1pLqlNS5G2merVe67Rs7LBb09OlTqRLa4s5LOZooQbA7B2qx77z
FbcJtgB3UeXFy1VtsjDORP+qCI2Ngz5GWGFqNlGYUPNrL+VbwfZs7PwbvuwYD9Fm
dUIk/cfBxPlFpmEPrgMswNpezLXUX+cgQN0zzmHoAwSFdSmwZlcHDTCiDcPo6UrN
9svzH5COBLuPico9AOHHiA==
=zvBv
-----END PGP SIGNATURE-----

PS: Here is a patch for the backports script.
    I was unable to test it, as the script hardcodes your directory layout.

As discussed on IRC, here is a new patch that drops PermissionsStartOnly.

I also updated the backport script.