blob: 47229266d63d1517d7b0b1ef7645aa726f575e82 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
#!/bin/mkpkg
# description: Anonymous communication network - core daemon
# url: https://www.torproject.org/
name=tor
version=0.4.9.13
release=2
depends=(libressl libevent zlib)
groups=(tor:user:tor:/var/lib/tor:700:903:903)
services=(tor)
permissions=(
/etc/tor:root:tor:750
/usr/bin/tor:root:tor:750
/usr/bin/tor-resolve:root:tor:750
/usr/bin/tor-gencert:root:tor:750
/usr/bin/tor-print-ed-signing-cert:root:tor:750
/etc/tor/torrc:root:tor:640
)
source=(https://dist.torproject.org/$name-$version.tar.gz)
sha256sums=(
"5e748d3272cdf44a7d7741173f371c8def3d96eecb77e93c89c50663ce9cc792"
)
build() {
cd $name-$version
./configure \
--prefix=/usr \
--sysconfdir=/etc \
--localstatedir=/var \
--disable-systemd \
--disable-lzma \
--disable-zstd \
--disable-asciidoc \
--disable-html-manual \
--disable-manpage \
--disable-unittests \
--enable-pic \
--with-tor-user=tor \
--with-tor-group=tor \
--with-openssl-dir=/ \
--with-libevent-dir=/usr
make
make DESTDIR=$PKG install
# Remove docs
rm -rf $PKG/usr/share/doc
# Config directory
install -d -m 750 $PKG/etc/tor
# Hardened torrc
printf '%s\n' \
'## rawnix Tor configuration' \
'## See tor(1) for options' \
'' \
'DataDirectory /var/lib/tor' \
'PidFile /run/tor/tor.pid' \
'' \
'# Logging' \
'Log notice stderr' \
'' \
'# SOCKS port for local applications (e.g. browser)' \
'SocksPort 9050 IsolateDestAddr IsolateDestPort' \
'' \
'# DNS resolution through Tor' \
'DNSPort 5353' \
'AutomapHostsOnResolve 1' \
'VirtualAddrNetworkIPv4 10.192.0.0/10' \
'' \
'# Transparent proxy port' \
'TransPort 9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort' \
'' \
'# Hardening' \
'Sandbox 0' \
'NoExec 1' \
'SafeLogging 1' \
'' \
'# Disable relay/exit functionality' \
'ClientOnly 1' \
'' \
'# Connection padding to resist traffic analysis' \
'ConnectionPadding 1' \
'' \
'# Reject plaintext on SOCKS' \
'WarnPlaintextPorts 23,109,110,143' \
'RejectPlaintextPorts 23,109,110,143' \
> $PKG/etc/tor/torrc
# Data directory
install -d -m 700 $PKG/var/lib/tor
}
post_build() {
# runit service - touch down file so tor does not auto-start
install -d $PKG/etc/sv/tor/log
printf '%s\n' \
'#!/bin/sh' \
'exec 2>&1' \
'' \
'# Prepare runtime directories' \
'install -d -m 750 -o tor -g tor /run/tor' \
'install -d -m 700 -o tor -g tor /var/lib/tor' \
'' \
'# Verify config before starting' \
'chpst -u tor:tor tor --verify-config -f /etc/tor/torrc || exit 1' \
'' \
'# Start tor in foreground' \
'exec chpst -u tor:tor tor -f /etc/tor/torrc --RunAsDaemon 0' \
> $PKG/etc/sv/tor/run
printf '%s\n' \
'#!/bin/sh' \
'rm -rf /run/tor' \
> $PKG/etc/sv/tor/finish
printf '%s\n' \
'#!/bin/sh' \
'mkdir -p /var/log/tor' \
'exec svlogd -tt /var/log/tor' \
> $PKG/etc/sv/tor/log/run
chmod 755 $PKG/etc/sv/tor/run
chmod 755 $PKG/etc/sv/tor/finish
chmod 755 $PKG/etc/sv/tor/log/run
# Service disabled by default - must explicitly: rm /etc/sv/tor/down
touch $PKG/etc/sv/tor/down
}
signify() {
untrusted comment: public key
RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}
# vim: filetype=sh
|
