This was done. If not, please create specific tickets where it isn't done.

https://www.whonix.org/wiki/Chat#Ricochet_IM

Removed a few. Would not start without openat, so kept.

Yay, we have ProtectSystem=strict now.

Yay, we have ProtectSystem=strict now.

Can we exclude ExecStartPre=/usr/lib/onion-grater-merger from systemd hardening?

Error back after reboot.

https://github.com/Whonix/onion-grater/blob/master/lib/systemd/system/onion-grater.service currently works without ReadWritePaths. So let's not add?

https://github.com/Whonix/onion-grater/blob/master/lib/systemd/system/onion-grater.service currently works without ReadWritePaths. So let's not add?

Dead upstream.

It's a file, not a folder.

https://github.com/Whonix/onion-grater/commit/8480cff304ea019b25dc49d91672e7c3f8599a07

It's a file, not a folder. Nothing in the code of
/usr/lib/onion-grater-merger writes to /usr/lib/onion-grater-merger.

I just re-read the error message. Try adding

That's weird. Onion-grater is trying to write to somewhere that's being mounted read-only by systemd.

Merged your changes.

Does it work after you comment ProtectSystem=strict and ReadWriteDirectories=? I think on Qubes-Whonix it is trying to write to a directory in /var/run (probably /var/run/qubes-service). I can't test as I don't use Qubes.

Unfortunately not. On Qubes-Whonix. Could be Non-Qubes-Whonix vs
Qubes-Whonix?

Does it work using this? It looks like it needs the openat syscall which it now allows.

Does not work yet. @madaidan

Reducing the number of lingering, unrealistic tickets, therefore closing.

https://github.com/Whonix/anon-ws-disable-stacked-tor/commit/128e2312bf58a5c1cea3eecd74d1fa0a1a194b51

Ping @dau.

There are up to date Whonix 14 testers versions available.

https://github.com/Whonix/uwt/commit/907f8e1ee93a0ec47febecce3e86266c681764fa

Yes, please.

I see. So without these variables set, ricochet tries to to start its
own Tor client?

Yes exactly !

Tibo (Tibo):

Tibo added a comment.

Any idea why that is required?

Yes, ricochet is looking if a control port is defined in the config file or in
the environment.
If a control port is defined, ricochet will not launch tor and will directly
connect to the control host.

Any idea why that is required?

In T444#15959, @Tibo wrote:

The only thing missing is to set environment variable TOR_CONTROL_PORT=9151 and TOR_CONTROL_HOST="127.0.0.1".
That's all :).

This ticket is in status "needs review". Meaning, implementation is
done, but should be tested in next build.

This status is confusing and for ticket changes we'll be using
testing-in-next-build-required as status.

This ticket is in status "needs review". Meaning, implementation is

done, but should be tested in next build.

So the only remaining work here before you started working on this
ticket was:
Do the instructions in the wiki work as is? If yes, the ticket is done.

Tibo (Tibo):

Tibo added a comment.

I think I misunderstood something.

I think I misunderstood something.
I thought that the goal was to not use EXTERNAL_OPEN_ALL=true and just open one port on the workstation firewall.

Tibo (Tibo):

Tibo added a comment.

Oh, my bad...

Probably a manual config is required because otherwise
localListenAddress is set to localhost.

Manual config is not how it is supposed to work. It worked before

Yes exactly, and also to set the localListenPort.