The Tor Project has launched Oniux, a groundbreaking command-line tool designed to enforce kernel-level network isolation for Linux applications, ensuring all traffic is routed through the Tor network.
This release addresses longstanding privacy concerns around accidental data leaks in traditional Tor proxy methods like torsocks, offering a more robust solution for activists, journalists, and developers handling sensitive data.
What Makes Oniux Unique?
Oniux leverages Linux namespaces, a kernel feature introduced in 2000, to create isolated environments for applications.
By confining apps to their network namespaces, oniux replaces system interfaces (e.g., eth0) with a virtual interface called onion0, which exclusively routes traffic through Tor.
This approach eliminates risks from misconfigured proxy settings or applications bypassing SOCKS wrappers via raw system calls.
Key technical features include:
- Arti integration: Uses Tor’s modern Rust-based implementation for improved performance and safety.
- Onionmasq support: Manages DNS resolution and IP routing within the isolated namespace.
- Privilege dropping: After setup, the tool relinquishes elevated permissions to minimize attack surfaces.
Oniux vs. Torsocks: A Security Upgrade
| Oniux | Torsocks |
|---|---|
| Uses kernel namespaces for isolation | Relies on LD_PRELOAD hijacking |
| Works with static binaries/Zig apps | Limited to dynamically linked C |
| Prevents all kernel-level leaks | Vulnerable to raw syscall leaks |
| Linux-only, Rust-based | Cross-platform, C-based |
| Experimental but cutting-edge | Mature (15+ years of use) |
The shift to kernel-level isolation makes Oniux immune to leaks caused by non-libc system calls critical weakness in Torsocks.
Getting Started with Oniux
Installation requires a Rust toolchain:
bash$ cargo install --git https://gitlab.torproject.org/tpo/core/oniux oniux@0.4.0
Example use cases:
- Isolate a single command: bash
$ oniux curl https://icanhazip.com # Outputs Tor exit node IP - Torify an entire shell session: bash
$ oniux bash - Run graphical apps securely: bash
$ oniux hexchat
Under the Hood
Oniux creates child processes via clone(2) With a dedicated network, mount, PID, and user namespaces.
It then:
- Configures a custom resolver via bind-mounted
/etc/resolv.conf. - Establishes the
onion0interface using onionmasq. - Drops privileges before executing the target application.
Experimental but Promising
While Oniux is still new compared to Torsocks, its design avoids entire classes of proxy-related vulnerabilities.
The Tor Project acknowledges its experimental status but emphasizes active development, inviting community testing and feedback.
This release underscores Tor’s commitment to advancing privacy tech through modern systems programming, with Rust’s memory safety and Linux’s isolation primitives playing pivotal roles.
For high-risk users, Oniux could become an essential tool in the fight against surveillance.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
%20(1).webp?fit=1600,900&ssl=1&description=This release addresses longstanding privacy concerns around accidental data leaks in traditional Tor proxy methods like torsocks.){kind=link}