From 8ffeaf17b5a33e0240035fe31af2114b2e63a8f2 Mon Sep 17 00:00:00 2001
From: Pig Monkey <pm@pig-monkey.com>
Date: Tue, 26 Dec 2017 16:40:45 -0800
Subject: [PATCH] use default firejail tor profile

requires firejail >= 0.9.52

I haven't figured out why private-dev breaks tor.
---
 roles/tor/files/tor-service-override.conf |  2 +-
 roles/tor/tasks/main.yml                  | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/roles/tor/files/tor-service-override.conf b/roles/tor/files/tor-service-override.conf
index b254476..591a19b 100644
--- a/roles/tor/files/tor-service-override.conf
+++ b/roles/tor/files/tor-service-override.conf
@@ -1,4 +1,4 @@
 [Service]
 ExecStart=
-ExecStart=/usr/bin/firejail --writable-var --ignore=private-dev /usr/bin/tor -f /etc/tor/torrc
+ExecStart=/usr/bin/firejail /usr/bin/tor -f /etc/tor/torrc
 User=root
diff --git a/roles/tor/tasks/main.yml b/roles/tor/tasks/main.yml
index bab2dfd..dac8632 100644
--- a/roles/tor/tasks/main.yml
+++ b/roles/tor/tasks/main.yml
@@ -23,6 +23,18 @@
   tags:
     - firejail
 
+- name: Verify Tor firejail local profile exists
+  file: path=/etc/firejail/tor.local state=touch
+  tags:
+    - firejail
+
+- name: Allow Tor firejail /dev access
+  lineinfile:
+    dest: /etc/firejail/tor.local
+    line: "ignore private-dev"
+  tags:
+    - firejail
+
 - name: Enable and start Tor
   service: name=tor enabled=yes state=started
   when: tor.run_on == "all"