After upgrading to Debian 13.7 (released today, new apparmor package accepted during upgrade), managed pluggable transports started failing silently on a production relay/bridge.
Environment: Debian 13.7 (trixie), Tor 0.4.9.12 from deb.torproject.org, self-built webtunnel 0.0.6, systemd multi-instance (tor@default).
Symptoms:
Tor logs only: Managed proxy "/usr/local/bin/webtunnel" having PID XXXX terminated with status code 1, in a ~1s respawn loop
Zero stderr from the transport, no ENV-ERROR, no hint that exec was denied
tor --verify-config passes, config itself is correct (ServerTransportPlugin, ServerTransportListenAddr, ServerTransportOptions all present)
Running the identical transport binary manually with a full PT environment works flawlessly (SMETHOD + SMETHODS DONE)
aa-status shows the system_tor profile attached to /usr/bin/tor; AppArmor inherits confinement to the exec'd PT child
Root cause: the updated system_tor profile only permits known, packaged PT binary paths. Self-compiled transports in /usr/local/bin (webtunnel in this case) are denied at exec — but the denial produces no actionable log line (kernel audit only surfaces it if actively hunted via journalctl -k / auditd; dmesg was restricted). The operator sees only an endless “terminated with status code 1” loop with no indication of the cause.
Workaround (verified working):
/etc/apparmor.d/local/system_tor:
/usr/local/bin/webtunnel rix,
then apparmor_parser -r /etc/apparmor.d/system_tor and restart the tor instance. Transport registers immediately: Registered server transport ‘webtunnel’.
Two suggestions:
When a managed proxy dies immediately at exec time (before it writes anything to stdout/stderr), could Tor detect and log a possible AppArmor denial ("exec failed — is the binary permitted by the AppArmor profile?")? Right now the failure mode is indistinguishable from dozens of other causes and cost hours to isolate.
Consider shipping the default system_tor profile with a commented /usr/local/bin/* example rule, since self-compiled PTs are a common operator setup.
Have a great weekend