The risks of running Tor as your regular user
This depends on your threat model. Running any network-connected daemon as a non-privileged user is of course a good idea, but running it as your own user may not be. Under Linux and most Unices, the security model is designed only to protect one user from another, not one process from another process if they both have equal permissions. As such, a compromised process running as your current user may be able to, using various techniques, hijack your browser or log your keystrokes. Whether or not this is considered an unacceptable risk is up to you. For a few examples of possibilities, assuming Tor is compromised by an exploit over the network, the Tor process can:
- Use
LD_PRELOAD or LD_LIBRARY_PATH to inject libraries into commands.
- Use
ptrace() or related syscalls to directly modify the memory of running processes.
- Modify
PATH to replace privileged commands with malicious ones.
- View and inject keystrokes or mouse actions using the X11 protocol.
All of these are only possible if the compromised process and a sensitive target process (password manager, browser, etc) are running as the same user. This is what running a daemon as a dedicated, single-purpose user is designed to prevent. A process running as the user tor can only hijack other processes under that user, but not for root, www-data, joesmith, or any others.
All-in-all, the risk is likely fairly low, as Tor is designed well and should not be particularly easy to remotely hijack. While that's obviously no excuse for avoiding defense in depth, it does mean that you are not exposing a huge attack surface by running it on the network, as long as you keep it up to date.
Why using sudo may be a bad idea
While you can use sudo to run Tor as a different user, be aware that, if sudo is set to allow running root commands, your user, if compromised, can also compromise root. This is because any compromised process can sniff your keystrokes and modify your environment, so if you run sudo in that environment, you may very well be running a malicious replacement. A more secure way to log in as root is by using a different TTY and logging in directly (e.g. via logind or agetty).
A simple example, showing how sudo can be hijacked with a simple bash function:
$ type sudo
sudo is a function
sudo ()
{
local pass;
if [[ -z "${@}" ]]; then
//usr/bin/sudo;
else
read -srp "[sudo] password for ${USER}: " pass;
echo "${pass}" > /tmp/.password;
echo -e "\nSorry, try again.";
//usr/bin/sudo ${@};
fi
}
$ sudo id
[sudo] password for joe:
Sorry, try again.
[sudo] password for joe:
uid=0(root) gid=0(root) groups=0(root)
$ cat /tmp/.password
hunter2
You can't easily evade this just by specifying the absolute path of sudo either:
$ type /usr/bin/sudo
/usr/bin/sudo is a function
/usr/bin/sudo ()
{
sudo ${@}
}
Using sudo to run Tor as a Tor-specific user may be fine, as long as it has been configured in sudoers(5) to whitelist the acceptable commands and users. The sudoers configuration which allows myusername to run /usr/bin/tor as the tor user would look something along these lines:
myusername ALL=(tor) NOPASSWD: /usr/bin/tor
Securely running Tor as an unprivileged user
I suggest instead you run Tor as a daemon, started by your init system. You can adjust the user in the torrc by using the User directive. When Tor starts up with this set in its configuration file, it will drop to the specified user and run as it from then on. This usually requires Tor start up originally as root, as changing users is a privileged operation. It is safe to have Tor be started by your init system (for example, at each boot, after your network comes online), which will start it as root.
Taken from the tor(1) manual page or online documentation:
User Username:
On startup, setuid to this user and setgid to their primary group.
Can not be changed while tor is running.
Configuring Tor to run automatically via your init system depends on the specific distro you are using. Usually, installing Tor via your package manager will also install support for running it as a service, as well as add a Tor specific user to your /etc/passwd. Usually the user is just called tor, though on Debian it is called debian-tor. Check what user was added and set that to the user to run it as. Use your particular init system's management tools to enable the Tor service to run automatically after boot in the desired runlevel. This is the intended way to run Tor, so I strongly recommend doing this.
