The Tor project developers have introduced Oniux, a utility designed to force traffic from individual applications through the Tor network. Oniux is similar in purpose to the previously available program torsocks, but differs by utilizing the network namespace isolation provided by the Linux kernel instead of replacing standard library functions via the LD_PRELOAD mechanism. The utility's code is written in Rust and is distributed under the Apache 2.0 and MIT licenses.
Oniux allows the creation of an isolated container for any application, with traffic being forcibly redirected solely through the Tor network. To send traffic, a tunnel based on onionmasq is created, appearing within the container as a virtual network interface (TUN). Access to network interfaces available in the main environment is blocked at the network stack isolation level within the separate namespace.
Compared to torsocks, the new utility does not limit itself to replacing library functions and blocks potential leakage channels (for example, the redirection through torsocks can be bypassed by directly accessing kernel system calls). The program also protects against leaks caused by misconfigurations of SOCKS proxies directing traffic to the Tor network. The cost of stricter isolation is the loss of cross-platform support — Oniux can only run on Linux.
The Oniux utility is self-sufficient and does not require the launching of a separate Tor background process to operate. Interaction with the Tor network in Oniux is built using a library developed by the Arti project, while torsocks is based on CTor and uses SOCKS proxies. Oniux may prove useful for running applications and services that are critically important for ensuring privacy.
Usage involves adding a call to the utility 'oniux' before starting the desired program. For instance, to send a request via curl over Tor, one can execute the command 'oniux curl URL', and to direct any requests through Tor within a session with the command interpreter — 'oniux bash'. Isolation of graphical applications is supported.
Source: opennet.ru
