Subject: [PATCH v2] services: tor: Raise file descriptor ulimit.

From: Tobias Geerinckx-Rice <[email-masked]>
Date: Thu, 21 Oct 2021 14:01:03 +0200

* gnu/services/tor.scm (tor-shepherd-service): Run ulimit -n before
launching Tor.
---

♪ …one of these days I'll send the right bleedin' patch… ♪

 gnu/services/networking.scm | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 7e310b70ec..5a8852f262 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -1,24 +1,24 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021 Ludovic Courtès <[email-masked]>
 ;;; Copyright © 2015 Mark H Weaver <[email-masked]>
 ;;; Copyright © 2016, 2018, 2020 Efraim Flashner <[email-masked]>
 ;;; Copyright © 2016 John Darrington <[email-masked]>
 ;;; Copyright © 2017 Clément Lassieur <[email-masked]>
 ;;; Copyright © 2017 Thomas Danckaert <[email-masked]>
 ;;; Copyright © 2017, 2018 Marius Bakke <[email-masked]>
-;;; Copyright © 2018 Tobias Geerinckx-Rice <[email-masked]>
+;;; Copyright © 2018, 2021 Tobias Geerinckx-Rice <[email-masked]>
 ;;; Copyright © 2018 Chris Marusich <[email-masked]>
 ;;; Copyright © 2018 Arun Isaac <[email-masked]>
 ;;; Copyright © 2019 Florian Pelz <[email-masked]>
 ;;; Copyright © 2019, 2021 Maxim Cournoyer <[email-masked]>
 ;;; Copyright © 2019 Sou Bunnbu <[email-masked]>
 ;;; Copyright © 2019 Alex Griffin <[email-masked]>
 ;;; Copyright © 2020 Brice Waegeneire <[email-masked]>
 ;;; Copyright © 2021 Oleg Pykhalov <[email-masked]>
 ;;; Copyright © 2021 Christine Lemmer-Webber <[email-masked]>
 ;;; Copyright © 2021 Maxime Devos <[email-masked]>
 ;;; Copyright © 2021 Guillaume Le Vaillant <[email-masked]>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
 ;;; GNU Guix is free software; you can redistribute it and/or modify it
@@ -948,32 +948,40 @@ (define (tor-shepherd-service config)
     (($ <tor-configuration> tor)
      (let ((torrc (tor-configuration->torrc config)))
        (with-imported-modules (source-module-closure
                                '((gnu build shepherd)
                                  (gnu system file-systems)))
          (list (shepherd-service
                 (provision '(tor))
 
                 ;; Tor needs at least one network interface to be up, hence the
                 ;; dependency on 'loopback'.
                 (requirement '(user-processes loopback syslogd))
 
                 (modules '((gnu build shepherd)
                            (gnu system file-systems)))
 
+                ;; The file descriptor ulimit must be raised in the
+                ;; environment from which the daemon is launched; see
+                ;; https://gitweb.torproject.org/tor.git/plain/doc/TUNING
+                ;; The exact number is somewhat arbitrary but taken from
+                ;; https://gitweb.torproject.org/debian/tor.git/tree/debian/tor.init#n40
                 (start #~(make-forkexec-constructor/container
-                          (list #$(file-append tor "/bin/tor") "-f" #$torrc)
+                          (list #$(file-append bash "/bin/bash") "-c"
+                                (string-append "ulimit -n 32768; exec "
+                                               #$(file-append tor "/bin/tor")
+                                               " -f " #$torrc))
 
                           #:log-file "/var/log/tor.log"
                           #:mappings (list (file-system-mapping
                                             (source "/var/lib/tor")
                                             (target source)
                                             (writable? #t))
                                            (file-system-mapping
                                             (source "/dev/log") ;for syslog
                                             (target source))
                                            (file-system-mapping
                                             (source "/var/run/tor")
                                             (target source)
                                             (writable? #t)))
                           #:pid-file "/var/run/tor/tor.pid"))
                 (stop #~(make-kill-destructor))
-- 
2.33.0