NO, Tor and Linux users are NOT classified as extremists by the Intelligence Community.
Yes, there are mentions of 'Linux Journal', 'TAILs' and 'Tor' in a file with filter definitions. But why? If we look at the actual rules in the file (http://daserste.ndr.de/panorama/xkeyscorerules100.txt) we see it contains the following definition:
// START_DEFINITION
/*
These variables define terms and websites relating to the TAILs (The Amnesic
Incognito Live System) software program, a comsec mechanism advocated by
extremists on extremist forums.
*/
$TAILS_terms=word('tails' or 'Amnesiac Incognito Live System') and word('linux'
or ' USB ' or ' CD ' or 'secure desktop' or ' IRC ' or 'truecrypt' or ' tor ');
$TAILS_websites=('tails.boum.org/') or ('linuxjournal.com/content/linux*');
// END_DEFINITION
Notice that they describe TAILs is a 'comsec mechanism advocated by extremists' and then go on to define a filter that selects users searching for it. However it would be used in conjunction with filters that also select traffic from browsing those extremist forums. This usefully gives a list of addresses that frequent extremist forums and then seek out and implement the communications security advice given in those forums, thereby indicating they are more than just casual browsers, they have something they wish to hide or secure in their communications.
So, once again, the XKeyScore definitions do NOT automatically classify Linux, Tor and TAILs users as 'extremists', they merely give examples of filters that can be used to select traffic mentioning these keywords or connecting to related sites, in order to further filter traffic from known extremist or terrorist groups that also advocate using these tools for communications security. This allows analysts to determine whether an address belongs to a casual browser of these forums, or someone who wishes to keep their extremist or terrorist related browsing secret, and is therefore worthy of further surveillance of their internet traffic.