Tor on Sailfish OS 5.0
Hidden Services & the Control Interface

[Desktop Entry]
Name=Tor Control
Exec=invoker --type=silica-qt5 /usr/share/harbour-tor-button/qml/harbour-tor-button.qml
Icon=harbour-tor-button
Type=Application

[X-Sailjail]
# Principle of least privilege: no Internet permission needed.
# All network ops are delegated to the D-Bus helper process.
Permissions=Privileged
OrganizationName=harbour
ApplicationName=harbour-tor-button

// Allow 'defaultuser' to start/stop/restart tor.service only.
// Any other unit name is denied by default rule fallthrough.
polkit.addRule(function(action, subject) {
    if (action.id === "org.freedesktop.systemd1.manage-units"
        && action.lookup("unit") === "tor.service"
        && action.lookup("verb") !== "mask"
        && action.lookup("verb") !== "unmask"
        && subject.user === "defaultuser"
        && subject.local
        && subject.active) {
        return polkit.Result.YES;
    }
});

DBusInterface {
    id: systemd
    service: "org.freedesktop.systemd1"
    path: "/org/freedesktop/systemd1"
    iface: "org.freedesktop.systemd1.Manager"
    bus: DBus.SystemBus
}

function startTor() {
    // "replace" mode: if a job is already pending, replace it.
    systemd.call("StartUnit", ["tor.service", "replace"])
}

function stopTor() {
    systemd.call("StopUnit", ["tor.service", "replace"])
}

function getActiveState() {
    // Poll the unit's ActiveState property for UI feedback.
    var unitPath = systemd.call("GetUnit", ["tor.service"])
    return unitIface.getProperty("ActiveState")
    // Returns: "active" | "inactive" | "activating" | "failed"
}

import socket, binascii, hmac, hashlib, os

COOKIE_PATH = "/var/run/tor/control.authcookie"
CONTROL_ADDR = ("127.0.0.1", 9051)

def safe_cookie_authenticate(sock: socket.socket) -> None:
    """SAFECOOKIE auth per tor control-spec §3.24"""

    # 1. Client nonce (32 bytes random)
    client_nonce = os.urandom(32)

    sock.sendall(b"AUTHCHALLENGE SAFECOOKIE "
                 + binascii.hexlify(client_nonce) + b"\r\n")

    resp = sock.recv(512).decode()
    # Expect: 250 AUTHCHALLENGE SERVERHASH=... SERVERNONCE=...
    assert resp.startswith("250")

    server_hash  = binascii.unhexlify(resp.split("SERVERHASH=")[1].split()[0])
    server_nonce = binascii.unhexlify(resp.split("SERVERNONCE=")[1].strip())

    cookie = open(COOKIE_PATH, "rb").read()

    # 2. Verify server's knowledge of the cookie (MITM guard)
    expected_server = hmac.new(
        cookie,
        b"Tor safe cookie authentication server-to-controller hash"
        + cookie + client_nonce + server_nonce,
        hashlib.sha256
    ).digest()
    assert hmac.compare_digest(server_hash, expected_server), "Server auth failed!"

    # 3. Send our own HMAC
    client_hash = hmac.new(
        cookie,
        b"Tor safe cookie authentication controller-to-server hash"
        + cookie + client_nonce + server_nonce,
        hashlib.sha256
    ).hexdigest()

    sock.sendall(f"AUTHENTICATE {client_hash}\r\n".encode())
    assert sock.recv(64).startswith(b"250")

import dbus.service, dbus.mainloop.glib, stat, os, shutil, tempfile

KEY_PATH = "/var/lib/tor/hidden_service/hs_ed25519_secret_key"

class TorHelper(dbus.service.Object):

    # Polkit-protected method — only callable by defaultuser on active session.
    @dbus.service.method("harbour.tor.button.Helper",
                         in_signature="s", out_signature="b")
    def ExportKeyToPath(self, dest_dir):
        """Copy hidden service keypair to a user-chosen directory."""
        dest_dir = os.path.realpath(dest_dir)

        # Refuse paths outside the user's home to prevent exfil.
        allowed = ("/home/defaultuser", "/media/sdcard")
        if not any(dest_dir.startswith(p) for p in allowed):
            raise dbus.DBusException("Destination outside allowed paths")

        # Write to a temp file first, then atomic rename.
        fd, tmp = tempfile.mkstemp(dir=dest_dir)
        try:
            with open(KEY_PATH, "rb") as src, os.fdopen(fd, "wb") as dst:
                dst.write(src.read())
            os.chmod(tmp, stat.S_IRUSR | stat.S_IWUSR)  # 0600
            os.rename(tmp, os.path.join(dest_dir, "hs_ed25519_secret_key.bak"))
            return True
        except Exception:
            os.unlink(tmp)
            raise

## ─── Identity & Paths ────────────────────────────────────────────── ##
DataDirectory          /var/lib/tor
PidFile                /var/run/tor/tor.pid
Log                    notice syslog

## ─── Control Port ────────────────────────────────────────────────── ##
# Bind only on loopback. Never 0.0.0.0.
ControlPort            127.0.0.1:9051
CookieAuthentication   1
CookieAuthFileGroupReadable 1
CookieAuthFile         /var/run/tor/control.authcookie

## ─── SOCKS Proxy ─────────────────────────────────────────────────── ##
SocksPort              127.0.0.1:9050 IsolateDestAddr IsolateDestPort
# IsolateDestAddr: different destination IPs use different circuits.
# IsolateDestPort: different ports use different circuits.
# This limits correlation across app connections.

## ─── Hidden Service ──────────────────────────────────────────────── ##
HiddenServiceDir       /var/lib/tor/hidden_service
HiddenServicePort      80 127.0.0.1:8080
# HiddenServiceVersion defaults to 3 since tor 0.4.0 — no need to set it.

## ─── Hardening ───────────────────────────────────────────────────── ##
DisableAllSwap         1     # Prevent key material leaking to swap.
HardwareAccel          0     # Deterministic behaviour; enable if benchmarked.
AvoidDiskWrites        1     # Reduces writes; good for eMMC longevity.
MaxMemInQueues         64 MB # Phone has constrained RAM; cap relay buffer.
NumCPUs                2     # Jolla C2 has 4 cores; leave headroom for UI.

## ─── Not a Relay ─────────────────────────────────────────────────── ##
ExitPolicy             reject *:*
RelayBandwidthRate     0
# These ensure we contribute no relay capacity.
# Improves latency; reduces legal exposure on mobile networks.

# Tail the journal for the app and systemd in parallel
journalctl -f -u tor.service &
journalctl -f _COMM=invoker &

# Check Polkit evaluation for a simulated request
pkcheck --action-id org.freedesktop.systemd1.manage-units \
        --system-bus-name $(dbus-send --system --print-reply \
          --dest=org.freedesktop.DBus /org/freedesktop/DBus \
          org.freedesktop.DBus.GetNameOwner string:org.freedesktop.systemd1 \
          | awk '/string/{print $2}' | tr -d '"') \
        --process $$ -v

# Verify tor is listening on control port
ss -tlnp | grep 9051

# Quick AUTHENTICATE test from shell
printf 'AUTHENTICATE ""\r\nGETINFO version\r\nQUIT\r\n' \
  | nc 127.0.0.1 9051