Oniux: Kernel-level Tor isolation for any Linux app

https://blog.torproject.org/introducing-oniux-tor-isolation-using-linux-namespaces/

by marcodiego • 1 year ago

199 52 1 year ago

blog.torproject.org

They use hexchat as an example but do these processes run with the users configuration? Wouldn't this leak IRC usernames if you forget to change it. ... Or leak cookies if you launch a browser?

charcircuit3• 1 year ago

What do you mean by leak usernames? It would leaks that a username uses tor. It would still leak that all of the usernames connecting to the same IRC host would be the same person.

IRC seems pretty dangerous if you want to remaining anonymous considering how many people are logging disconnection times allowing them to be correlated with other network disruption events.

01HNNWZ0MV43FF• 1 year ago

Irssi iirc used to default your username to your system username, so noobs would leak their given name by accident. After seeing that I changed my username in Linux to always be the most common username

47282847• 1 year ago

Tor is anonymizing you primarily from the network. There are many use cases where you do want to be authenticated/known to whoever you are talking to. You just want observers to not know.

In your example of correlation of connection times, it may not be your goal to remain anonymous from the network and its participants, you may be interested in the location-hiding properties, and/or adversarial networks (like local government or corporate networks) and firewalls.

alfiedotwtf2• 1 year ago

Separation of concerns - although Tor goes to great lengths to prevent fingerprinting, Tor and Oniux’s main aim IMHO is to make the source IP untraceable.

Same thing could have been said about using Tor to login to Gmail (if it were not HTTPS).

alfiedotwtf2• 1 year ago

The DevEx is beautifully done here i.e it’s idiot-proof! Nice work to the people behind this <3

brians• 1 year ago

It’s really, really not. Idiots are ingenious. The operational care to use this in ways that preserve anonymity is beyond most users.

ahmedfromtunis• 1 year ago

Does this mean one can now access tor websites using chrome?

_k2vp• 1 year ago

You always could by just setting the proxy environment variables (or in settings). The standard port for the tor daemon is 9050.

In fact, it's relatively easy to write a socks proxy that lets you route traffic through a arbitrary protocols. For example, I can serve/visit websites on syncthing with a socks5 proxy as a translation layer: https://github.com/acheong08/syndicate

stepupmakeup• 1 year ago

Chrome has zero user-facing proxy controls of its own on Windows, nor PAC support. But the --proxy-server command line argument works.

kyguy23• 1 year ago

You can, but please don’t do this, you’ll stick out even more! Tor browser has a series of anti fingerprinting strategies that chrome doesn’t

OsrsNeedsf2P• 1 year ago

Does Brave attempt to mimic any of these anti fingerprinting strategies? Asking because it has a "Private tab with Tor" feature

jeroenhd• 1 year ago

I don't think anonimity is a concern for people who still use Chrome at this point.

It does allow accessing onion sites, though, even though anyone running an onion site will probably tell you that it's a terrible idea to use plain Chrome to access them.

mjg59• 1 year ago

Huh. I had a conversation with a Tor developer on this topic about a decade ago, when network namespaces were still kind of a new hotness - the feedback I got was that it would be an easy way for people to think they were being secure while still leaking a bunch of identifiable information, so I didn't push that any further.

computerfriend• 1 year ago

Strange, because torsock and torify do the same thing, but less robustly.

gobip• 1 year ago

When you have torsocks or torify for everything, you're gonna leave your footprint through tor, whereas something like Tor Browser is designed specifically not to leave any print on the web.

Using tor directly on the kernel level means that your DNS is gonna leak. Your OS telemetry is gonna leak etc.

It's still a good idea but it should be implemented top to bottom and nothing left in between, otherwise you're de-anonymized quickly.

ajb• 1 year ago

I think the tor folks made a fundamental strategic error by pushing that line. Yes, people who face a serious threat need to use tor browser and still pay attention to other ways to leak etc. But if we'd got 'tor everywhere' it would still make mass surveillance a lot harder. For one thing, today mass surveillance can detect who is using tor. If everyone was using it that wouldn't matter.

natmaka2• 1 year ago

Isn't all this reserved to TCP, in other words in which way may it protect non-TCP activity?

charcircuit3• 1 year ago

Non-TCP activity wouldn't route and will fail to send.

izhak• 1 year ago

UDP wouldn't route?..

natmaka2• 1 year ago

Thank you, therefore my first impression seems right: without any provision for UDP this isn't an easy-to-setup and transparent way for any user to preserve his/her privacy.

heavyset_go• 1 year ago

Note that you can use the Tor daemon as a normal DNS via UDP server and it will resolve your DNS requests over the network for you.

Maybe I'm wrong, but it seems similar to I2P where if you want "UDP", you'd need bespoke plugins/transports/whatever for each application.

mmooss3• 1 year ago

What do Tor Browser users do for YouTube or DNS? Also, what about HTTP/3?

FrostKiwi• 1 year ago

DNS is already done by Tor. In fact, if you feed it a raw IP, it will warn in tor's output that it received an IP, which may indicate that the user has accidentally setup browsing via Tor, but DNS resolution via a normal, unsecured way.

YouTube mainly throttles TOR hard and it's a bit of a fight uphill against a never ending avalanche of Captchas or a straight up service refusal. Bridges solve this, by going through exit nodes that are not publicly listed to be TOR exist nodes. Even with bridges it's still a high chance to trip Google's bot detection.

HTTP/3 is unsupported.

yencabulator2• 1 year ago

I don't know the details, but https://gitlab.torproject.org/tpo/core/onionmasq says

This project is an attempt to implement a simple user-space network stack that can handle TCP *and UDP* state such that it is possible to forward the traffic into the Tor network.

tobias2014• 1 year ago

Oniux seems like an "officially" supported tool similar to orjail (which hasn't received a commit in four years, but still works great as a shell script with iptables/iproute tools [1]). Orjail has also an option to run with firejail for further isolation, which seems to be still a feature that Oniux doesn't have.

[1] https://github.com/orjail/orjail/blob/master/usr/sbin/orjail

1vuio0pswjnm7• 1 year ago

No Javascript URL:

https://raw.githubusercontent.com/orjail/orjail/master/usr/s...

hexo• 1 year ago

Nice, now please rewrite the prototype in C and will happily use it.

jsiepkes2• 1 year ago

It's written in Rust. What would you need a C version for?

matt3210• 1 year ago

So I can read it to make sure it's not doing bad things.

mike-cardwell2• 1 year ago

Instructions on front page for install don't work. Need to change the version number from 0.4.0 to 0.5.0

  cargo install --git https://gitlab.torproject.org/tpo/core/oniux oniux@0.5.0

mike-cardwell2• 1 year ago

Hmm. I assumed this worked like torsocks in that it would direct traffic through the locally running tor daemon. However, I've noticed that if I stop the locally running tor daemon, oniux still works whilst torify and torsocks do not. [edit] The documentation does actually say this. Pretty neat.

It works inside docker as well, but I needed to use --privileged. Just copied the binary into a debian:12 container and it works there:

  docker run -it --rm --privileged -v "$PWD/oniux:/usr/bin/oniux" debian:12

yencabulator2• 1 year ago

I would assume this uses the Rust rewrite as a library, not the older C daemon.

https://tpo.pages.torproject.net/core/arti/

Aissen• 1 year ago

Fun fact, this has been broken with curl for 5 years (and so are the blog examples), because Tor developers previously insisted that apps shouldn't attempt to resolve .onion domain names: https://daniel.haxx.se/blog/2025/05/16/leeks-and-leaks/

I hope they can find a resolution.

Oniux: Kernel-level Tor isolation for any Linux app

Related Stories