tor/contrib/dist/tor.service.in

[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target

[Service]
Type = simple
ExecStartPre = @BINDIR@/tor -f @CONFDIR@/torrc --verify-config
# A torrc that has "RunAsDaemon 1" won't work with the "simple" service type;
# let's explicitly override it.
ExecStart = @BINDIR@/tor -f @CONFDIR@/torrc --RunAsDaemon 0
ExecReload = /bin/kill -HUP ${MAINPID}
KillSignal = SIGINT
TimeoutSec = 30
Restart = on-failure
LimitNOFILE = 32768

# Hardening
PrivateTmp = yes
DeviceAllow = /dev/null rw
DeviceAllow = /dev/urandom r
InaccessibleDirectories = /home
ReadOnlyDirectories = /
ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor
ReadWriteDirectories = @LOCALSTATEDIR@/log/tor
ReadWriteDirectories = @LOCALSTATEDIR@/run/tor
NoNewPrivileges = yes

[Install]
WantedBy = multi-user.target
Add contrib/tor.service for use with systemd 2014-04-21 15:47:44 +02:00			`[Unit]`
			`Description = Anonymizing overlay network for TCP`
			`After = syslog.target network.target nss-lookup.target`

			`[Service]`
			`Type = simple`
Verify configuration file via ExecStartPre in the systemd unit file (#12730). 2014-07-29 14:13:01 +02:00			`ExecStartPre = @BINDIR@/tor -f @CONFDIR@/torrc --verify-config`
Explicitly disable RunAsDaemon in the systemd unit file (#12731). Our current systemd unit uses "Type = simple", so systemd does not expect tor to fork. If the user has "RunAsDaemon 1" in their torrc, then things won't work as expected. This is e.g. the case on Debian (and derivatives), since there we pass "--defaults-torrc /usr/share/tor/tor-service-defaults-torrc" (that contains "RunAsDaemon 1") by default. The only solution I could find is to explicitly pass "--RunAsDaemon 0" when starting tor from the systemd unit file, which this commit does. 2014-07-29 14:23:04 +02:00			`# A torrc that has "RunAsDaemon 1" won't work with the "simple" service type;`
			`# let's explicitly override it.`
			`ExecStart = @BINDIR@/tor -f @CONFDIR@/torrc --RunAsDaemon 0`
Add contrib/tor.service for use with systemd 2014-04-21 15:47:44 +02:00			`ExecReload = /bin/kill -HUP ${MAINPID}`
			`KillSignal = SIGINT`
			`TimeoutSec = 30`
			`Restart = on-failure`
			`LimitNOFILE = 32768`

			`# Hardening`
			`PrivateTmp = yes`
			`DeviceAllow = /dev/null rw`
			`DeviceAllow = /dev/urandom r`
			`InaccessibleDirectories = /home`
systemd unit file: only allow tor to write to /var/lib/tor and /var/log/tor (#12751). The rest of the filesystem is accessible for reading only. Still, quoting systemd.exec(5): Note that restricting access with these options does not extend to submounts of a directory that are created later on. 2014-08-27 05:05:12 +02:00			`ReadOnlyDirectories = /`
			`ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor`
			`ReadWriteDirectories = @LOCALSTATEDIR@/log/tor`
systemd unit file: set up /var/run/tor as writable for the Tor service. For some strange reason, this was not needed with systemd v208. But it's needed with systemd v215 on current Debian sid, and entirely makes sense. 2014-09-19 18:04:59 +02:00			`ReadWriteDirectories = @LOCALSTATEDIR@/run/tor`
systemd unit file: ensures that the process and all its children can never gain new privileges (#12939). 2014-08-27 05:18:26 +02:00			`NoNewPrivileges = yes`
Add contrib/tor.service for use with systemd 2014-04-21 15:47:44 +02:00
			`[Install]`
			`WantedBy = multi-user.target`