Repository: freedomofpress/securedrop

Issue:
The torrc file is not a persistent option on tails 
The torrc file (needed for the document interface's authenticated tor hidden services) is not a persistent option for tails. Currently each time a journalist boots the SVS they need to set a root password and after Tails boots they need to add the ATHS config line to the torrc file.

Putting a copy of the torrc file and a simple script like the one below on the SVS persistent volume. Where the journalist can just double click the script to add the config back to the torrc file is a workaround until Tails supports persistent torrc files.

The execute flag needs to be set when the script is copied to the persistent volume because tails sets a default umask of 002. The tor service should be reloaded only after the initial network connection is enabled and synced. 

```
#!/bin/bash
sudo cp /home/amnesia/Persistent/torrc
sudo service tor reload
```



Discussion:
I have a solution for this. It's not the most elegant when first installing in the persistent volume, but it works great from that point on.

It lets the unprivileged amnesia user update /etc/tor/torrc without needing to set a root password, using the setuid file permission. Check it out: https://github.com/micahflee/securedrop-torrc

If we have other things that need to be done as root on each Tails boot it wouldn't be hard to do them in a similar way. Unfortunately it all has to be programmed in C. I could merge this into the securedrop repo, but I have to set up git flow and stuff first.

Also, can people who program in C more often than me make sure there aren't any stupid security mistakes in my code? Obviously this code lets the amnesia user control torrc, which in itself can be dangerous but is necessary.

Interesting solution. So by comparison with the bash-script-in-persistent-volume method, this doesn't prompt you when you run sudo. But one still has to double click a script at every boot. I guess when introducing C code trust becomes an issue as you noted. Though it is pretty easy to look over the source, I just wonder to what extent building on your own should be encouraged. Usually FPF's people are on site to help the first time journalists log in so probably not a big deal. But journos could grow to distrust or wonder about that executable? 

Anyway nice work; I still think getting Tails to support this or building a custom Tails image ( https://tails.boum.org/contribute/build/ ) are potential other ways to resolve this issue. The SecureDrop-branded version of Tails could eventually include more enhancements needed by journalists (like ability to open more file types), would be signed and served over HTTPS.

Yup, this doesn't prompt you to use sudo, and you don't need to set a password when booting Tails. As far as I know, Tails doesn't have a startup script option, so it still has be manual. And in fact, you have to wait until after you've connected to the Tor network before running it.

But something that Tails does support is installing packages and having them get installed again each time you boot. Rather than releasing a SecureDrop-branded version of Tails, we could just create a tails-securedrop deb package (and make it depend on other packages we want) and have people install that. Then we could do whatever we want, such as modifying torrc.

I say we go ahead and implement this as long as no one has objections. Only thing is @micahflee: would you mind updating the documentation for the journalists under "How to Use SecreDrop" too, so everything is consistent? 


Resolving patch:
diff --git a/tails_files/securedrop_init.py b/tails_files/securedrop_init.py
new file mode 100644
--- /dev/null
+++ b/tails_files/securedrop_init.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python
+
+import os, sys, subprocess
+
+if __name__ == '__main__':
+    # check for root
+    if not os.geteuid()==0:
+        sys.exit('You need to run this as root')
+
+    # paths
+    path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'
+    path_torrc_backup = '/etc/tor/torrc.bak'
+    path_torrc = '/etc/tor/torrc'
+
+    # load torrc_additions
+    if os.path.isfile(path_torrc_additions):
+        torrc_additions = open(path_torrc_additions).read()
+    else:
+        sys.exit('Error opening {0} for reading'.format(path_torrc_additions));
+
+    # load torrc
+    if os.path.isfile(path_torrc_backup):
+        torrc = open(path_torrc_backup).read()
+    else:
+        if os.path.isfile(path_torrc):
+            torrc = open(path_torrc).read()
+        else:
+            sys.exit('Error opening {0} for reading'.format(path_torrc));
+
+        # save a backup
+        open(path_torrc_backup, 'w').write(torrc)
+
+    # append the additions
+    open(path_torrc, 'a').write(torrc_additions)
+
+    # reload tor
+    subprocess.call(['/usr/sbin/service', 'tor', 'reload'])
+
+    # success
+    subprocess.call(['/usr/bin/sudo', '-u', 'amnesia', '/usr/bin/notify-send', 'Updated torrc', 'You can now connect to your SecureDrop document interface']);
+


Test patch: