* security: validate and atomically install Tor config
* fix: harden candidate generation and HiddenServiceDir handling
Address review blocking findings:
- Replace sed|awk|tee pipelines with generateTorrcCandidate() which
checks every stage explicitly and refuses empty/truncated candidates
before installTorrc ever runs (both add and removal paths)
- Stop sourcing joinin.conf; read values with a grep-based helper
- Validate HiddenServiceDir against the expected Tor data roots
(/var/lib/tor, /mnt/hdd/tor) so a crafted value cannot inject Tor
directives into the candidate
- Quote HiddenServiceDir path expansions
* fix: keep torrc staging writes inside the privileged pipeline
Addresses re-review: sudo mktemp made the stage file root-owned while the
shell redirect ran unprivileged (EACCES on every add/remove path).
* fix: enable pipefail so failed torrc producers are detected
Without pipefail the 'sudo sed|sudo tee' and 'sudo awk|sudo tee' pipelines
only observed tee's status, so a producer failing after partial output could
yield a truncated candidate that still passes tor --verify-config.
---------
Co-authored-by: autoblitzbot <autoblitzbot@users.noreply.github.com>
f14730caa3