These scripts perform almost all of the steps involved in creating a chroot in OpenBSD for tor. It now includes all the configuration files you will need.
When a new version of tor is released, I run this script and copy my old '''/home/chrooted/tor/etc/tor/systrace''' directory over.
The systrace policies and updated rc.local are included here.
== Cautions ==
Currently tested but still needs more testing. I use these for my own setup. Don't run these on any kind of production system. However, if you have a spare machine around, try it out.
== Notes ==
OpenBSD 3.8 now has a recent version of libevent! So there is no need to compile your own any longer. Watch out for the dsocks package in 3.8 though. It does not include the tor-dns-proxy.py script that I use as a DNS resolver. I had to download it from the upstream location.
You may have to modify your systrace policies for python 2.4 as well.
It uses libstdc++ now.
Eventually, I would like to turn this script into a perl module. That way the error checking is more robust (or even present).
Also, it would be nice if I could upload my chroot to some website so people can easily download files and compare their configuration with mine.
=== Stage 1: Run as root ===
I hard coded the paths to '''/home/chrooted/tor''' on purpose. If this is ever converted into perl, then with the '''use strict;''' mode I would add the path as a parameter. Since the shell won't warn you if you have a typo, I try to use hard coded paths as much as possible.
Be sure to change the '''TOR_BUILD_USER''' and '''TOR_BUILD_GROUP''' to your own user. This is who is building the source. The files themselves will later be owned by '''_tor''' or '''root''' depending on the file.
'''tor_stage1_root.sh'''
{{{
#!/bin/sh
# Fail on the first error (non-zero return value)
set -e -x
TOR_BUILD_USER=tyranix
TOR_BUILD_GROUP=tyranix
## This is part one of the install.
##
## Be sure to set these variables below if you want them changed for this
## script
if [ ! "`/usr/bin/id -u`" = "0" ]; then
echo "Error: Must run $0 with root privileges"
exit 1
fi
check_package()
{
if [ ! "$#" = "2" ]; then
echo "Must send \"packagename\"\"return code\""
exit 1
fi
if [ ! "$2" = "0" ]; then
echo "Could not find \"$1\""
echo "Please build the port or install the package"
exit 1
fi
}
echo "Stage 1: Verify presence of pre-requisite programs"
# XXX Change this to use pkg_info -e (now implemented in OpenBSD 3.8).
