The Tor team has announced Oniux -line tool that allows any Linux application to be routed securely through the Tor network, ensuring anonymous connections.
See also: Tor Browser 14.0.6 released, what's new?
Unlike traditional methods like torsocks , which rely on user-level tricks, Oniux uses Linux namespaces to create a fully isolated network environment for each application, preventing data leaks even if the application is malicious or misconfigured.
namespaces feature that allows processes to run in isolated environments, each with its own view of system resources such as the network, processes, or file mount points. Oniux leverages this feature to isolate applications at the kernel level, forcing all their traffic to go exclusively through Tor.
Oniux achieves this by placing each application in a separate network namespace without access to the host system and instead connects to a virtual interface (onion0) that routes traffic through Tor with the help of onionmasq.
Additionally, it uses mount namespaces to import a custom /etc/resolv.conf that ensures secure DNS lookups over Tor, as well as user/PID namespaces to create the least privileged and more secure. This architecture offers complete, inviolable isolation through the kernel, ensuring that any Linux application communicates exclusively over Tor, without leaks.
See also: Tor needs 200 new WebTunnel bridges to combat censorship
Instead, Torsocks works by using the LD_PRELOAD, interfering with the network functions of dynamically linked Linux applications and redirecting traffic through a Tor SOCKS proxy.
The problem with this approach is that raw system calls are not detected by Torsocks, allowing malicious applications to bypass libc functions and cause data leaks. Furthermore, Torsocks does not work at all with static binaries and does not provide true isolation, since applications still have access to the real network interfaces of the system.
The Tor Project has published a comparison table that highlights the qualitative differences between the two solutions. Despite the obvious advantages of Oniux, the Tor team points out that the project is still in an experimental stage and has not been extensively tested in various conditions and scenarios. As such, the tool may not work as expected, and its use in mission-critical applications.
Instead, Tor is calling on enthusiastic users to try Oniux and report any issues so that the tool can mature quickly and become suitable for wider use.
See also: IP Spoofing attack attempted to disrupt Tor network
Based on the above, we can say that Oniux represents a significant development in the effort to achieve stronger and more reliable anonymity on Linux. While until now tools like Torsocks have offered a basic solution for routing traffic through Tor, Oniux's new approach allows for complete kernel-level isolation, which was impossible with previous techniques.
Source: bleepingcomputer
