From ed996c8e9d26f84efca620b994a9e8c33cdf1e93 Mon Sep 17 00:00:00 2001 From: Sami Ahmed Date: Mon, 15 Jun 2026 15:32:28 -0700 Subject: [PATCH] Fix embedded Tor bootstrap (code -1): force 0700 on hidden service dir Tor's config validator refuses to start a hidden service on any directory whose permissions are not 0700. The daemon's fs::create_directories() honors the process umask (0022 on Linux), leaving hidden_service/ at 0755. tor_run_main() returned -1 with: [warn] Permissions on directory .../hidden_service are too permissive. [warn] Failed to parse/validate config: Failed to configure rendezvous options. This was misdiagnosed as a libtor.a build problem (the June 4 rebuild was a red herring). The real fix is two fs::permissions() calls after create_directories(). Reproduced with a standalone harness linking libtor.a, fixed, SOCKS port 19099 came up in 1 second and Tor began bootstrapping normally. Also force 0700 on the DataDirectory itself - same validator, same rule. Refs: SKILL.md pitfall #59 --- src/tor/tor_embedded.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/tor/tor_embedded.cpp b/src/tor/tor_embedded.cpp index 8dfd317..65983d0 100644 --- a/src/tor/tor_embedded.cpp +++ b/src/tor/tor_embedded.cpp @@ -122,11 +122,20 @@ bool CTorEmbedded::Start(int socks, int hsPort, bool enableHiddenService) // Prepare Tor data directory under the wallet's data dir torDataDir = (::GetDataDir() / "tor_data").string(); fs::create_directories(torDataDir); + // CRITICAL: Tor refuses to use a DataDirectory readable by other users. + // Without 0700, tor_run_main() returns -1 and the embedded Tor never starts. + fs::permissions(torDataDir, fs::perms::owner_all, fs::perm_options::replace); std::string hsDir; if (hiddenServiceEnabled) { hsDir = (fs::path(torDataDir) / "hidden_service").string(); fs::create_directories(hsDir); + // CRITICAL: Tor rejects hidden service directories that are not 0700 + // ("Permissions on directory ... are too permissive") and aborts config + // validation with code -1. This was the root cause of "Embedded Tor + // exited with code -1" — fs::create_directories honors umask (0022 on + // most Linux systems), leaving the dir at 0755. Force 0700 after creation. + fs::permissions(hsDir, fs::perms::owner_all, fs::perm_options::replace); } // Build the argv for tor_run_main