From aa24bdf88fd39da965f7783058951b1a92780539 Mon Sep 17 00:00:00 2001 From: Julien Moutinho Date: Tue, 20 Jan 2026 17:04:41 +0100 Subject: [PATCH 1/3] nixos/tor: do not put Unix sockets in BindPaths= - The socket may not be accessible at all times resulting in the Tor unit failing to start. - If the socket is re-created it will become inaccessible. - Tor can't be started if any of the UNIX sockets are not available, which may result in a single service having issues affecting all services. (It may be best to start Tor to serve N-1 sockets even if 1 socket isn't available). Reverts: https://github.com/NixOS/nixpkgs/pull/440889 Fixes: https://github.com/NixOS/nixpkgs/issues/481673 Reported-by: https://github.com/kevincox --- .../manual/release-notes/rl-2605.section.md | 5 +++ nixos/modules/services/security/tor.nix | 38 ++++++++++++------- 2 files changed, 30 insertions(+), 13 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index d29cb9aa49dc..8c85dbc110f9 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -77,6 +77,11 @@ of pulling the upstream container image from Docker Hub. If you want the old beh - Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13. +- `services.tor` no longer bind mounts Unix sockets of onion services into its chroot +because it was not reliable. Users should do it themselves using either `JoinsNamespaceOf=` and Unix sockets in `/tmp` +or `BindPaths=` from a persistent parent directory of each Unix socket. +See . + - support for `ecryptfs` in nixpkgs has been removed. - The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system. diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix index 1c2cc65862e6..0c86f9572e09 100644 --- a/nixos/modules/services/security/tor.nix +++ b/nixos/modules/services/security/tor.nix @@ -636,7 +636,31 @@ in }; onionServices = lib.mkOption { - description = (descriptionGeneric "HiddenServiceDir"); + description = descriptionGeneric "HiddenServiceDir" + '' + :::{.warning} + Because `tor.service` runs in its own `RootDirectory=`, + when using a onion service to reverse-proxy to a Unix socket, + you need to make that Unix socket available + within the mount namespace of `tor.service`. + + When you can configure your service to create its socket in `/tmp`, + this can be done with: + ```nix + systemd.services.''${your-service} = { + unitConfig.JoinsNamespaceOf = [ "tor.service" ];` + serviceConfig.PrivateTmp = true; + }; + ``` + Otherwise, you can use: + ```nix + systemd.services.tor.serviceConfig.BindPaths = [ "/path/to/your-service/socket/directory" ]; + ``` + but you have to be sure that `/path/to/socket/directory` + exists before `tor.service` is started + and is not deleted and recreated between restarts of `your-service`, + or you'll need to restart `tor.service` to refresh the `BindPaths=`. + ::: + ''; default = { }; example = { "example.org/www" = { @@ -1416,18 +1440,6 @@ in RootDirectoryStartOnly = true; #InaccessiblePaths = [ "-+${runDir}/root" ]; UMask = "0066"; - BindPaths = [ - stateDir - ] - ++ lib.filter (x: x != null) ( - lib.catAttrs "unix" ( - lib.filter (x: x != null) ( - lib.catAttrs "target" ( - lib.concatMap (onionService: onionService.map) (lib.attrValues cfg.relay.onionServices) - ) - ) - ) - ); BindReadOnlyPaths = [ builtins.storeDir "/etc" From d5d3834b9da4da874242c6ce09c2cf2766d69eb3 Mon Sep 17 00:00:00 2001 From: Julien Moutinho Date: Tue, 20 Jan 2026 17:14:45 +0100 Subject: [PATCH 2/3] nixos/tor: do not bind storeDir when systemd-confinement is enabled Otherwise it undermines systemd-confinement whose job is to filter what gets bind mounted from the storeDir. --- nixos/modules/services/security/tor.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix index 0c86f9572e09..53a79984a38d 100644 --- a/nixos/modules/services/security/tor.nix +++ b/nixos/modules/services/security/tor.nix @@ -1441,9 +1441,9 @@ in #InaccessiblePaths = [ "-+${runDir}/root" ]; UMask = "0066"; BindReadOnlyPaths = [ - builtins.storeDir "/etc" ] + ++ lib.optional (!config.systemd.services.tor.confinement.enable) builtins.storeDir ++ lib.optionals config.services.resolved.enable [ "/run/systemd/resolve/stub-resolv.conf" "/run/systemd/resolve/resolv.conf" From 49dc4455a6289d15871abfa05080c8df92a34013 Mon Sep 17 00:00:00 2001 From: Julien Moutinho Date: Tue, 20 Jan 2026 17:14:45 +0100 Subject: [PATCH 3/3] nixos/tor: do not change the default of SystemCallErrorNumber= No reason to do so. --- nixos/modules/services/security/tor.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix index 53a79984a38d..359745b4060d 100644 --- a/nixos/modules/services/security/tor.nix +++ b/nixos/modules/services/security/tor.nix @@ -1497,7 +1497,6 @@ in "~@timer" ]; SystemCallArchitectures = "native"; - SystemCallErrorNumber = "EPERM"; }; };