- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.3.0esr-7.5-2] bug 23104 - Add a default line height compensation
by gk＠torproject.org 22 Sep '17

22 Sep '17

commit 323d2525fcd2de963a2e291eab91d5ca9ea7ac9b Author: igt0 <igt0-tor(a)gmail.com> Date: Sat Sep 16 16:50:17 2017 -0300 bug 23104 - Add a default line height compensation Many fonts have issues with their vertical metrics. they are used to influence the height of ascenders and depth of descenders. Gecko uses it to calculate the line height (font height + ascender + descender), however because of that idiosyncratic behavior across multiple operating systems, it can be used to identify the user's OS. The solution proposed in the patch uses a default factor to be multiplied with the font size, simulating the concept of ascender and descender. This way all operating systems will have the same line height. --- layout/generic/ReflowInput.cpp | 6 +++++ tbb-tests/mochitest.ini | 1 + tbb-tests/test_tor_bug23104.html | 52 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 59 insertions(+) diff --git a/layout/generic/ReflowInput.cpp b/layout/generic/ReflowInput.cpp index 42f4a24b5314..e219ae032cc6 100644 --- a/layout/generic/ReflowInput.cpp +++ b/layout/generic/ReflowInput.cpp @@ -30,6 +30,7 @@ #include "CounterStyleManager.h" #include <algorithm> #include "mozilla/dom/HTMLInputElement.h" +#include "nsContentUtils.h" #ifdef DEBUG #undef NOISY_VERTICAL_ALIGN @@ -2768,6 +2769,11 @@ GetNormalLineHeight(nsFontMetrics* aFontMetrics) nscoord externalLeading = aFontMetrics->ExternalLeading(); nscoord internalLeading = aFontMetrics->InternalLeading(); nscoord emHeight = aFontMetrics->EmHeight(); + + if (nsContentUtils::ShouldResistFingerprinting()) { + return NSToCoordRound(emHeight * NORMAL_LINE_HEIGHT_FACTOR); + } + switch (GetNormalLineHeightCalcControl()) { case eIncludeExternalLeading: normalLineHeight = emHeight+ internalLeading + externalLeading; diff --git a/tbb-tests/mochitest.ini b/tbb-tests/mochitest.ini index 3d2e7c9db803..fca972a51211 100644 --- a/tbb-tests/mochitest.ini +++ b/tbb-tests/mochitest.ini @@ -10,3 +10,4 @@ support-files = [test_tor_bug2875.html] [test_tor_bug4755.html] [test_tor_bug5856.html] +[test_tor_bug23104.html] diff --git a/tbb-tests/test_tor_bug23104.html b/tbb-tests/test_tor_bug23104.html new file mode 100644 index 000000000000..c2e4a51f1f75 --- /dev/null +++ b/tbb-tests/test_tor_bug23104.html @@ -0,0 +1,52 @@ +<!DOCTYPE HTML> +<meta charset="UTF-8"> +<html> +<head> + <title>Test for Tor Bug #23104: CSS line-height reveals the platform Tor browser is running</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="application/javascript" src="/tests/SimpleTest/SpawnTask.js"></script> + <style type="text/css"> + span { + background-color: #000; + color: #fff; + font-size: 16.5px; + } + </style> +</head> +<body> +<span id="test1">Test1</span> +<span id="test2">كلمة</span> +<span id="test3">ação</span> +<script type="application/javascript;version=1.7"> + +let setPref = function* (key, value) { + return new Promise(function(resolve, reject) { + SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve); + }); +} + +function getStyle(el, styleprop) { + el = document.getElementById(el); + return document.defaultView.getComputedStyle(el, null).getPropertyValue(styleprop); +} + +function validateElement(elementName, isFingerprintResistent) { + var fontSize = getStyle(elementName, 'font-size'); + var lineHeight = getStyle(elementName, 'line-height'); + var validationCb = isFingerprintResistent ? is : isnot; + validationCb(parseFloat(lineHeight), Math.ceil(parseFloat(fontSize)) * 1.2, 'Line Height validation'); +} + +add_task(function* () { + for (let resistFingerprintingValue of [true, false]) { + yield setPref("privacy.resistFingerprinting", resistFingerprintingValue); + for (let elementId of ['test1', 'test2', 'test3']) { + validateElement(elementId, resistFingerprintingValue); + } + } +}); + +</script> +</body> +</html> +

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] fixup! bug 23104 - Add a default line height compensation
by gk＠torproject.org 22 Sep '17

22 Sep '17

commit 125ac5c7c4259be3d0bfa9da6fe5a6466ee975cb Author: Georg Koppen <gk(a)torproject.org> Date: Fri Sep 22 06:59:35 2017 +0000 fixup! bug 23104 - Add a default line height compensation --- tbb-tests/test_tor_bug23104.html | 1 - 1 file changed, 1 deletion(-) diff --git a/tbb-tests/test_tor_bug23104.html b/tbb-tests/test_tor_bug23104.html index c2e4a51f1f75..77d7d190d7c8 100644 --- a/tbb-tests/test_tor_bug23104.html +++ b/tbb-tests/test_tor_bug23104.html @@ -49,4 +49,3 @@ add_task(function* () { </script> </body> </html> -

1 0

[tor-browser-build/master] Bug 16010: Enabling the sandbox on Windows
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 682966b5b0faf438e69f61092487a6ea99534525 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 19 14:32:36 2017 +0000 Bug 16010: Enabling the sandbox on Windows --- projects/firefox/mozconfig-windows-i686 | 3 --- 1 file changed, 3 deletions(-) diff --git a/projects/firefox/mozconfig-windows-i686 b/projects/firefox/mozconfig-windows-i686 index af30573..dfb3326 100644 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@ -18,9 +18,6 @@ ac_add_options --enable-tor-browser-update ac_add_options --enable-signmar ac_add_options --enable-verify-mar -# We can't build the sandbox code with mingw-w64: -# https://bugzilla.mozilla.org/show_bug.cgi?id=1042426 -ac_add_options --disable-sandbox # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --disable-crashreporter

1 0

[torbutton/master] Bug 23483: Donation banner on about:tor for 2017
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit b3ff9863db338b2bd612f109e8bbce4c4af7cbd0 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Sep 18 16:42:07 2017 -0700 Bug 23483: Donation banner on about:tor for 2017 (Also removes a dot from aboutTor.donationBanner.slogan) --- src/chrome/content/aboutTor/aboutTor-content.js | 5 ++ src/chrome/content/aboutTor/aboutTor.xhtml | 19 +++- src/chrome/content/aboutTor/donation_banner.js | 105 ++++++++++++++++++++++ src/chrome/content/aboutTor/onion-hand.png | Bin 0 -> 69055 bytes src/chrome/content/torbutton.js | 4 +- src/chrome/locale/en/aboutTor.properties | 2 +- src/chrome/skin/donation_banner.css | 113 ++++++++++++++++++++++++ src/modules/donation-banner.js | 112 +++++++++++++++++++++++ 8 files changed, 357 insertions(+), 3 deletions(-) diff --git a/src/chrome/content/aboutTor/aboutTor-content.js b/src/chrome/content/aboutTor/aboutTor-content.js index ec515bb..95e8abd 100644 --- a/src/chrome/content/aboutTor/aboutTor-content.js +++ b/src/chrome/content/aboutTor/aboutTor-content.js @@ -105,6 +105,11 @@ var AboutTorListener = { else body.removeAttribute("showmanual"); + if (aData.bannerData) + body.setAttribute("banner-data", aData.bannerData); + else + body.removeAttribute("banner-data"); + // Setting body.initialized="yes" displays the body, which must be done // at this point because our remaining initialization depends on elements // being visible so that their size and position are accurate. diff --git a/src/chrome/content/aboutTor/aboutTor.xhtml b/src/chrome/content/aboutTor/aboutTor.xhtml index 7ae4b8b..367f9a6 100644 --- a/src/chrome/content/aboutTor/aboutTor.xhtml +++ b/src/chrome/content/aboutTor/aboutTor.xhtml @@ -21,6 +21,8 @@ <title>&aboutTor.title;</title> <link rel="stylesheet" type="text/css" media="all" href="resource://torbutton/chrome/skin/aboutTor.css"/> + <link rel="stylesheet" type="text/css" media="all" + href="resource://torbutton/chrome/skin/donation_banner.css"/> <script type="text/javascript;version=1.7"> <![CDATA[ window.addEventListener("pageshow", function() { @@ -31,6 +33,21 @@ window.addEventListener("pageshow", function() { </script> </head> <body dir="&locale.dir;"> + <div id="banner"> + <div id="banner-contents-container"> + <div id="banner-tagline"><span></span></div> + <div id="banner-slogan"><span></span></div> + <a id="banner-donate-button-link" + href="https://www.torproject.org/donate/donate-tbb"> + <div id="banner-donate-button"> + <div id="banner-donate-button-inner"> + <span></span> + </div> + </div> + </a> + </div> + </div> + <div id="banner-spacer"></div> <div id="torstatus" class="top"> <div id="torstatus-version"/> <div id="torstatus-image"/> @@ -112,6 +129,6 @@ window.addEventListener("pageshow", function() { <p>&aboutTor.footer.label; <a href="&aboutTor.learnMore.link;">&aboutTor.learnMore.label;</a></p> </div> - + <script src="resource://torbutton/chrome/content/aboutTor/donation_banner.js"></script> </body> </html> diff --git a/src/chrome/content/aboutTor/donation_banner.js b/src/chrome/content/aboutTor/donation_banner.js new file mode 100644 index 0000000..1c95822 --- /dev/null +++ b/src/chrome/content/aboutTor/donation_banner.js @@ -0,0 +1,105 @@ +/* jshint esnext:true */ + +let sel = selector => document.querySelector(selector); + +// Shrink the font size if the text in the given element is overflowing. +let fitTextInElement = function (element) { + element.style.fontSize = "8px"; + let defaultWidth = element.scrollWidth, + defaultHeight = element.scrollHeight; + let bestSize; + for (let testSize = 8; testSize <= 40; testSize += 0.5) { + element.style.fontSize = `${testSize}px`; + if (element.scrollWidth <= defaultWidth && + element.scrollHeight <= defaultHeight) { + bestSize = testSize; + } else { + break; + } + } + element.style.fontSize = `${bestSize}px`; +}; + +// Increase padding at end to "squeeze" text, until just before +// it gets squeezed so much that it gets longer vertically. +let avoidWidows = function (element) { + element.style.paddingRight = "0px"; + let originalWidth = element.scrollWidth; + let originalHeight = element.scrollHeight; + let bestPadding; + for (let testPadding = 0; testPadding < originalWidth; testPadding += 0.5) { + element.style.paddingRight = `${testPadding}px`; + if (element.scrollHeight <= originalHeight) { + bestPadding = testPadding; + } else { + break; + } + } + element.style.paddingRight = `${bestPadding}px`; + if (window.getComputedStyle(element).direction === "rtl") { + element.style.paddingLeft = element.style.paddingRight; + element.style.paddingRight = "0px"; + } +}; + +// Resize the text inside banner to fit. +let updateTextSizes = function () { + fitTextInElement(sel("#banner-tagline")); + fitTextInElement(sel("#banner-slogan")); + fitTextInElement(sel("#banner-donate-button-inner")); + avoidWidows(sel("#banner-tagline span")); +}; + +// Returns a random integer x, such that 0 <= x < max +let randomInteger = max => Math.floor(max * Math.random()); + +// The main donation banner function. +let runDonationBanner = function ({ taglines, slogan, donate, shortLocale }) { + try { + sel("#banner-tagline span").innerText = taglines[randomInteger(taglines.length)]; + sel("#banner-slogan span").innerText = slogan; + let donateButtonText = sel("#banner-donate-button-inner span"); + let rtl = window.getComputedStyle(donateButtonText).direction === "rtl"; + donateButtonText.innerHTML = donate + " " + (rtl ? "◀" : "▶"); + sel("#banner").style.display = "flex"; + sel("#banner-spacer").style.display = "block"; + addEventListener("resize", updateTextSizes); + updateTextSizes(); + // Add a suffix corresponding to locale so we can send user + // to a correctly-localized donation page via redirect. + sel("#banner-donate-button-link").href += "-" + shortLocale; + sel("#torstatus-image").style.display = "none"; + } catch (e) { + // Something went wrong. + console.error(e); + sel("#banner").style.display = "none"; + sel("#bannerSpacer").style.display = "none"; + sel("#torstatus-image").style.display = "block"; + } +}; + +// Calls callback(attributeValue) when the specified attribute changes on +// target. Returns a zero-arg function that stops observing. +let observeAttribute = function (target, attributeName, callback) { + let observer = new MutationObserver(mutations => { + mutations.forEach(mutation => { + if (mutation.type === "attributes" && + mutation.attributeName === attributeName) { + callback(target.getAttribute(attributeName)); + } + }); + }); + observer.observe(target, { attributes: true }); + return () => observer.disconnect(); +}; + +// Start the donation banner if "toron" has been set to "yes". +let stopObserving = observeAttribute(document.body, "toron", value => { + stopObserving(); + if (value === "yes") { + let bannerDataJSON = document.body.getAttribute("banner-data"); + if (bannerDataJSON && bannerDataJSON.length > 0) { + runDonationBanner(JSON.parse(bannerDataJSON)); + } + } +}); diff --git a/src/chrome/content/aboutTor/onion-hand.png b/src/chrome/content/aboutTor/onion-hand.png new file mode 100644 index 0000000..00a5a41 Binary files /dev/null and b/src/chrome/content/aboutTor/onion-hand.png differ diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index db6b694..955f8eb 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -13,6 +13,7 @@ let { showDialog } = Cu.import("resource://torbutton/modules/utils.js", {}); let { unescapeTorString } = Cu.import("resource://torbutton/modules/utils.js", {}); let SecurityPrefs = Cu.import("resource://torbutton/modules/security-prefs.js", {}); let { bindPrefAndInit, observe } = Cu.import("resource://torbutton/modules/utils.js", {}); +let { bannerData } = Cu.import("resource://torbutton/modules/donation-banner.js", {}); const k_tb_last_browser_version_pref = "extensions.torbutton.lastBrowserVersion"; const k_tb_browser_update_needed_pref = "extensions.torbutton.updateNeeded"; @@ -450,7 +451,8 @@ var torbutton_abouttor_message_handler = { torOn: torbutton_tor_check_ok(), updateNeeded: torbutton_update_is_needed(), showManual: torbutton_show_torbrowser_manual(), - toolbarButtonXPos: torbutton_get_toolbarbutton_xpos() + toolbarButtonXPos: torbutton_get_toolbarbutton_xpos(), + bannerData: bannerData(), }; }, diff --git a/src/chrome/locale/en/aboutTor.properties b/src/chrome/locale/en/aboutTor.properties index 4436e21..d0d3a64 100644 --- a/src/chrome/locale/en/aboutTor.properties +++ b/src/chrome/locale/en/aboutTor.properties @@ -10,7 +10,7 @@ aboutTor.searchDDG.search.link=https://duckduckgo.com/ aboutTor.donationBanner.donate=Donate Now! -aboutTor.donationBanner.slogan=Tor: Powering Digital Resistance. +aboutTor.donationBanner.slogan=Tor: Powering Digital Resistance aboutTor.donationBanner.mozilla=Give today and Mozilla will match your gift! aboutTor.donationBanner.tagline1=Protecting Journalists, Whistleblowers, & Activists Since 2006 diff --git a/src/chrome/skin/donation_banner.css b/src/chrome/skin/donation_banner.css new file mode 100644 index 0000000..8580066 --- /dev/null +++ b/src/chrome/skin/donation_banner.css @@ -0,0 +1,113 @@ +#banner { + -khtml-user-select: none; /* Konqueror */ + -moz-user-select: none; /* Firefox */ + -ms-user-select: none; /* Internet Explorer/Edge */ + -webkit-touch-callout: none; /* iOS Safari */ + -webkit-user-select: none; /* Chrome/Safari/Opera */ + display: none; + height: 150px; + justify-content: center; + left: 0px; + margin-top: 0px; + min-width: 900px; + opacity: 1; + position: absolute; + user-select: none; + width: 100%; + z-index: 1; +} +#banner:before { + background-color: #406; + background-image: url('resource://torbutton/chrome/content/aboutTor/onion-hand.png'); + background-position: center; + background-size: cover; + content: ""; + height: 150px; + left: 0px; + position: absolute; + top: 0px; + width: 100%; +} +#banner:-moz-dir(rtl):before { + transform: scaleX(-1); +} +#banner-contents-container { + align-items: center; + height: 100%; + max-width: 700px; + position: relative; + width: 700px; +} +#banner-tagline { + align-items: center; + bottom: 60px; + color: white; + display: flex; + font-family: monospace; + font-size: 8px; + font-weight: bold; + left: 85px; + position: absolute; + right: 0px; + text-align: start; + text-transform: uppercase; + top: 10px; +} +#banner-tagline:-moz-dir(rtl) { + left: 0px; + right: 85px; +} +#banner-slogan { + align-items: start; + bottom: 0px; + color: #f8f8a0; + display: flex; + font-family: monospace; + font-weight: bold; + left: 85px; + position: absolute; + right: 285px; + text-align: start; + top: 100px; + white-space: nowrap; +} +#banner-slogan:-moz-dir(rtl) { + left: 285px; + right: 85px; +} +#banner-donate-button { + background-color: #13a513; + border: 0px; + bottom: 10px; + color: #fbf7ef; + font-family: sans-serif; + font-size: 12px; + font-weight: bold; + left: 430px; + letter-spacing: -0.00em; + position: absolute; + right: 0px; + top: 100px; +} +#banner-donate-button:-moz-dir(rtl) { + left: 0px; + right: 430px; +} +#banner-donate-button:hover { + background-color: #38bc38; +} +#banner-donate-button-inner { + bottom: 6px; + display: flex; + justify-content: center; + left: 8px; + position: absolute; + right: 8px; + top: 6px; +} +#banner-spacer { + display: none; + height: 150px; + position: relative; + top: 0; +} diff --git a/src/modules/donation-banner.js b/src/modules/donation-banner.js new file mode 100644 index 0000000..bb35e86 --- /dev/null +++ b/src/modules/donation-banner.js @@ -0,0 +1,112 @@ +/* jshint esversion:6 */ + +const Cu = Components.utils; + +// ### Import Mozilla Services +Cu.import("resource://gre/modules/Services.jsm"); + +// A list of locales for which the banner has been translated. +const kBannerLocales = [ + "bg", + "da", + "el", + "en", + "es", + "fr", + "fr_CA", + "is", + "it", + "nb", + "tr", +]; + +// A list of donation page locales (at least redirects should exist). +const kDonationPageLocales = [ + "ar", + "de", + "en", + "es", + "fa", + "fr", + "it", + "ja", + "ko", + "nl", + "pl", + "pt", + "ru", + "tr", + "vi", + "zh", +]; + +const kPropertiesURL = "chrome://torbutton/locale/aboutTor.properties"; +const gStringBundle = Services.strings.createBundle(kPropertiesURL); + +// Check if we should show the banner, depends on +// browser locale, current date, and how many times +// we have already shown the banner. +const shouldShowBanner = function ({ locale, shortLocale }) { + try { + // If our override test pref is true, then just show the banner regardless. + if (Services.prefs.getBoolPref("extensions.torbutton.testBanner", false)) { + return true; + } + // Don't show a banner if update is needed. + let updateNeeded = Services.prefs.getBoolPref("extensions.torbutton.updateNeeded"); + if (updateNeeded) { + return false; + } + // Only show banner when we have that locale and if a donation redirect exists. + if (kBannerLocales.indexOf(locale) === -1 || + kDonationPageLocales.indexOf(shortLocale) === -1) { + return false; + } + // Only show banner between 2017 Oct 23 and 2018 Jan 25. + let now = new Date(); + let start = new Date(2017, 9, 23); + let end = new Date(2018, 0, 26); + let shownCountPref = "extensions.torbutton.donation_banner2017.shown_count"; + if (now < start || now > end) { + // Clean up pref if not in use. + Services.prefs.clearUserPref(shownCountPref); + return false; + } + // Only show banner 50 times. + let count = 0; + if (Services.prefs.prefHasUserValue(shownCountPref)) { + count = Services.prefs.getIntPref(shownCountPref); + } + if (count >= 50) { + return false; + } + Services.prefs.setIntPref(shownCountPref, count+1); + return true; + } catch (e) { + return false; + } +}; + +// Read data needed for displaying banner on page. +var bannerData = function () { + // Read short locale. + let locale = Services.prefs.getCharPref("general.useragent.locale"); + let shortLocale = locale.match(/[a-zA-Z]+/)[0].toLowerCase(); + if (!shouldShowBanner({ locale, shortLocale })) { + return null; + } + // Load tag lines. + let taglines = []; + for (let index = 0; index < 5; ++index) { + let tagline = gStringBundle.GetStringFromName( + "aboutTor.donationBanner.tagline" + (index + 1)); + taglines.push(tagline); + } + // Read slogan and donate button text. + let slogan = gStringBundle.GetStringFromName("aboutTor.donationBanner.slogan"); + let donate = gStringBundle.GetStringFromName("aboutTor.donationBanner.donate"); + return JSON.stringify({ taglines, slogan, donate, shortLocale }); +}; + +// Export utility functions for external use. +var EXPORTED_SYMBOLS = ["bannerData"];

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] fixup! Bug 16010: Fixing sandbox compile issues
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 2354d122644d82df54d655ece5b42bdfa4cf38f8 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 21 20:48:42 2017 +0000 fixup! Bug 16010: Fixing sandbox compile issues --- .../sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h b/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h index ed45f22bf0ff..e488712e4cdf 100644 --- a/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h +++ b/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h @@ -150,7 +150,7 @@ struct Opcode { // flag. unsigned int flag_dest_; unsigned int flag_source_; - unsigned flag_aux_; + unsigned int flag_aux_; // We indicate the mnemonic for debugging purposes const char* mnemonic_;

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] We don't take the SANDBOX_EXPORTS path and fix compile issues along our way
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 0b5dfeae5d09168e020acd2f630c5352674075ab Author: Georg Koppen <gk(a)torproject.org> Date: Mon Sep 18 19:06:56 2017 +0000 We don't take the SANDBOX_EXPORTS path and fix compile issues along our way --- security/sandbox/chromium/sandbox/win/src/interception.h | 4 ++-- security/sandbox/moz.build | 2 +- security/sandbox/win/src/sandboxbroker/moz.build | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/security/sandbox/chromium/sandbox/win/src/interception.h b/security/sandbox/chromium/sandbox/win/src/interception.h index 850e4eef54c6..ceff4b62d1a0 100644 --- a/security/sandbox/chromium/sandbox/win/src/interception.h +++ b/security/sandbox/chromium/sandbox/win/src/interception.h @@ -268,7 +268,7 @@ class InterceptionManager { #define ADD_NT_INTERCEPTION(service, id, num_params) \ AddToPatchedFunctions(kNtdllName, #service, \ sandbox::INTERCEPTION_SERVICE_CALL, \ - MAKE_SERVICE_NAME(service), id) + (void*)MAKE_SERVICE_NAME(service), id) #define INTERCEPT_NT(manager, service, id, num_params) \ manager->ADD_NT_INTERCEPTION(service, id, num_params) @@ -279,7 +279,7 @@ class InterceptionManager { // we are guaranteed that our IAT has been initialized. #define INTERCEPT_EAT(manager, dll, function, id, num_params) \ manager->AddToPatchedFunctions(dll, #function, sandbox::INTERCEPTION_EAT, \ - MAKE_SERVICE_NAME(function), id) + (void*)MAKE_SERVICE_NAME(function), id) #endif // SANDBOX_EXPORTS } // namespace sandbox diff --git a/security/sandbox/moz.build b/security/sandbox/moz.build index 1420d6498af9..7b9cb01e4e87 100644 --- a/security/sandbox/moz.build +++ b/security/sandbox/moz.build @@ -154,7 +154,7 @@ elif CONFIG['OS_ARCH'] == 'WINNT': 'chromium/sandbox/win/src/Wow64.cc', ] - for var in ('UNICODE', '_UNICODE', 'NS_NO_XPCOM', 'SANDBOX_EXPORTS', + for var in ('UNICODE', '_UNICODE', 'NS_NO_XPCOM', '_CRT_RAND_S', 'CHROMIUM_SANDBOX_BUILD'): DEFINES[var] = True diff --git a/security/sandbox/win/src/sandboxbroker/moz.build b/security/sandbox/win/src/sandboxbroker/moz.build index 4a9d01cc5fa5..4df77d232f38 100644 --- a/security/sandbox/win/src/sandboxbroker/moz.build +++ b/security/sandbox/win/src/sandboxbroker/moz.build @@ -12,7 +12,7 @@ EXPORTS += [ 'sandboxBroker.h', ] -for var in ('UNICODE', '_UNICODE', 'SANDBOX_EXPORTS'): +for var in ('UNICODE', '_UNICODE'): DEFINES[var] = True LOCAL_INCLUDES += [

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] fixup! TB3: Tor Browser's official .mozconfigs.
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 6cafd21960e74a78317330c8559f643e4beac165 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 11 08:09:56 2017 +0000 fixup! TB3: Tor Browser's official .mozconfigs. Enabling sandbox compiling for Windows platform --- .mozconfig-mingw | 3 --- 1 file changed, 3 deletions(-) diff --git a/.mozconfig-mingw b/.mozconfig-mingw index af305737e647..dfb33264d8a9 100644 --- a/.mozconfig-mingw +++ b/.mozconfig-mingw @@ -18,9 +18,6 @@ ac_add_options --enable-tor-browser-update ac_add_options --enable-signmar ac_add_options --enable-verify-mar -# We can't build the sandbox code with mingw-w64: -# https://bugzilla.mozilla.org/show_bug.cgi?id=1042426 -ac_add_options --disable-sandbox # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --disable-crashreporter

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 16010: Fixing sandbox compile issues
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 99e8c2c94986940de47d5f50a4b863cb6127df3d Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 11 08:08:39 2017 +0000 Bug 16010: Fixing sandbox compile issues --- dom/media/gmp/rlz/GMPDeviceBinding.cpp | 2 +- js/xpconnect/src/XPCShellImpl.cpp | 2 +- security/sandbox/chromium-shim/base/win/sdkdecls.h | 2 +- .../sandbox/chromium/base/strings/utf_string_conversion_utils.cc | 4 ++-- security/sandbox/chromium/base/threading/platform_thread_win.cc | 2 ++ security/sandbox/chromium/base/time/time_win.cc | 2 +- security/sandbox/chromium/base/win/pe_image.h | 2 +- security/sandbox/chromium/base/win/scoped_handle.h | 2 +- security/sandbox/chromium/sandbox/win/src/acl.h | 2 +- security/sandbox/chromium/sandbox/win/src/app_container.cc | 6 +++--- security/sandbox/chromium/sandbox/win/src/broker_services.cc | 2 +- security/sandbox/chromium/sandbox/win/src/crosscall_params.h | 3 +++ security/sandbox/chromium/sandbox/win/src/handle_closer.cc | 2 +- security/sandbox/chromium/sandbox/win/src/interception.cc | 8 ++++---- security/sandbox/chromium/sandbox/win/src/interception.h | 1 + security/sandbox/chromium/sandbox/win/src/interception_internal.h | 1 + security/sandbox/chromium/sandbox/win/src/resolver.cc | 2 +- security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc | 8 ++++++++ security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h | 2 ++ security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc | 2 +- security/sandbox/chromium/sandbox/win/src/service_resolver.cc | 2 +- .../chromium/sandbox/win/src/sidestep/mini_disassembler_types.h | 6 +++--- security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc | 8 ++++++-- security/sandbox/chromium/sandbox/win/src/target_process.cc | 4 ++-- toolkit/xre/nsAppRunner.cpp | 2 +- 25 files changed, 50 insertions(+), 29 deletions(-) diff --git a/dom/media/gmp/rlz/GMPDeviceBinding.cpp b/dom/media/gmp/rlz/GMPDeviceBinding.cpp index c8aee2bcd898..f3e3747e04c2 100644 --- a/dom/media/gmp/rlz/GMPDeviceBinding.cpp +++ b/dom/media/gmp/rlz/GMPDeviceBinding.cpp @@ -62,7 +62,7 @@ GetStackAfterCurrentFrame(uint8_t** aOutTop, uint8_t** aOutBottom) { // "Top" of the free space on the stack is directly after the memory // holding our return address. - uint8_t* top = (uint8_t*)_AddressOfReturnAddress(); + uint8_t* top = (uint8_t*)__builtin_return_address(0);//_AddressOfReturnAddress(); // Look down the stack until we find the guard page... MEMORY_BASIC_INFORMATION memInfo = {0}; diff --git a/js/xpconnect/src/XPCShellImpl.cpp b/js/xpconnect/src/XPCShellImpl.cpp index d86b5c5d3e3d..bedcb9132fef 100644 --- a/js/xpconnect/src/XPCShellImpl.cpp +++ b/js/xpconnect/src/XPCShellImpl.cpp @@ -45,7 +45,7 @@ #include "mozilla/widget/AudioSession.h" #include <windows.h> #if defined(MOZ_SANDBOX) -#include "SandboxBroker.h" +#include "sandboxBroker.h" #endif #endif diff --git a/security/sandbox/chromium-shim/base/win/sdkdecls.h b/security/sandbox/chromium-shim/base/win/sdkdecls.h index e999ab967b72..127bfaabf5e9 100644 --- a/security/sandbox/chromium-shim/base/win/sdkdecls.h +++ b/security/sandbox/chromium-shim/base/win/sdkdecls.h @@ -115,7 +115,7 @@ QueryThreadCycleTime( #define PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_RESERVED (0x00000003 << 28) #define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_MASK (0x00000003ui64 << 32) #define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_DEFER (0x00000000ui64 << 32) -#define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON (0x00000001ui64 << 32) +#define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON (0x00000001uLL << 32) #define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_OFF (0x00000002ui64 << 32) #define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_RESERVED (0x00000003ui64 << 32) diff --git a/security/sandbox/chromium/base/strings/utf_string_conversion_utils.cc b/security/sandbox/chromium/base/strings/utf_string_conversion_utils.cc index 3101a6028883..710fbd83a358 100644 --- a/security/sandbox/chromium/base/strings/utf_string_conversion_utils.cc +++ b/security/sandbox/chromium/base/strings/utf_string_conversion_utils.cc @@ -122,7 +122,7 @@ void PrepareForUTF8Output(const CHAR* src, // Instantiate versions we know callers will need. template void PrepareForUTF8Output(const wchar_t*, size_t, std::string*); -template void PrepareForUTF8Output(const char16*, size_t, std::string*); +//template void PrepareForUTF8Output(const char16*, size_t, std::string*); template<typename STRING> void PrepareForUTF16Or32Output(const char* src, @@ -143,6 +143,6 @@ void PrepareForUTF16Or32Output(const char* src, // Instantiate versions we know callers will need. template void PrepareForUTF16Or32Output(const char*, size_t, std::wstring*); -template void PrepareForUTF16Or32Output(const char*, size_t, string16*); +//template void PrepareForUTF16Or32Output(const char*, size_t, string16*); } // namespace base diff --git a/security/sandbox/chromium/base/threading/platform_thread_win.cc b/security/sandbox/chromium/base/threading/platform_thread_win.cc index d5bd9bed08e7..9750d99ed5fe 100644 --- a/security/sandbox/chromium/base/threading/platform_thread_win.cc +++ b/security/sandbox/chromium/base/threading/platform_thread_win.cc @@ -38,11 +38,13 @@ void SetNameInternal(PlatformThreadId thread_id, const char* name) { info.dwThreadID = thread_id; info.dwFlags = 0; +#if 0 __try { RaiseException(kVCThreadNameException, 0, sizeof(info)/sizeof(DWORD), reinterpret_cast<DWORD_PTR*>(&info)); } __except(EXCEPTION_CONTINUE_EXECUTION) { } +#endif } struct ThreadParams { diff --git a/security/sandbox/chromium/base/time/time_win.cc b/security/sandbox/chromium/base/time/time_win.cc index dc968ad63980..96ec6e2592cb 100644 --- a/security/sandbox/chromium/base/time/time_win.cc +++ b/security/sandbox/chromium/base/time/time_win.cc @@ -356,7 +356,7 @@ TimeDelta RolloverProtectedNow() { // we keep last_seen_now stay correctly in sync. DWORD now = g_tick_function(); if (now < g_last_seen_now) - g_rollover_ms += 0x100000000I64; // ~49.7 days. + g_rollover_ms += 0x100000000LL; // ~49.7 days. g_last_seen_now = now; return TimeDelta::FromMilliseconds(now + g_rollover_ms); } diff --git a/security/sandbox/chromium/base/win/pe_image.h b/security/sandbox/chromium/base/win/pe_image.h index 4c36bcf850e6..66897186d075 100644 --- a/security/sandbox/chromium/base/win/pe_image.h +++ b/security/sandbox/chromium/base/win/pe_image.h @@ -17,7 +17,7 @@ // The Windows 8 SDK defines FACILITY_VISUALCPP in winerror.h. #undef FACILITY_VISUALCPP #endif -#include <DelayIMP.h> +#include <delayimp.h> namespace base { namespace win { diff --git a/security/sandbox/chromium/base/win/scoped_handle.h b/security/sandbox/chromium/base/win/scoped_handle.h index 404ab669385a..a5d9a5fe1c23 100644 --- a/security/sandbox/chromium/base/win/scoped_handle.h +++ b/security/sandbox/chromium/base/win/scoped_handle.h @@ -18,7 +18,7 @@ #include <intrin.h> #define BASE_WIN_GET_CALLER _ReturnAddress() #elif defined(COMPILER_GCC) -#define BASE_WIN_GET_CALLER __builtin_extract_return_addr(\\ +#define BASE_WIN_GET_CALLER __builtin_extract_return_addr(\ __builtin_return_address(0)) #endif diff --git a/security/sandbox/chromium/sandbox/win/src/acl.h b/security/sandbox/chromium/sandbox/win/src/acl.h index b5021e7be865..098bc576c75c 100644 --- a/security/sandbox/chromium/sandbox/win/src/acl.h +++ b/security/sandbox/chromium/sandbox/win/src/acl.h @@ -5,7 +5,7 @@ #ifndef SANDBOX_SRC_ACL_H_ #define SANDBOX_SRC_ACL_H_ -#include <AccCtrl.h> +#include <accctrl.h> #include <windows.h> #include "base/memory/scoped_ptr.h" diff --git a/security/sandbox/chromium/sandbox/win/src/app_container.cc b/security/sandbox/chromium/sandbox/win/src/app_container.cc index a51f09208239..a9919a1cac22 100644 --- a/security/sandbox/chromium/sandbox/win/src/app_container.cc +++ b/security/sandbox/chromium/sandbox/win/src/app_container.cc @@ -4,7 +4,7 @@ #include "sandbox/win/src/app_container.h" -#include <Sddl.h> +#include <sddl.h> #include <stddef.h> #include <vector> @@ -27,10 +27,10 @@ PSID ConvertSid(const base::string16& sid) { template <typename T> T BindFunction(const char* name) { HMODULE module = GetModuleHandle(sandbox::kKerneldllName); - void* function = GetProcAddress(module, name); + void* function = (void*)GetProcAddress(module, name); if (!function) { module = GetModuleHandle(sandbox::kKernelBasedllName); - function = GetProcAddress(module, name); + function = (void*)GetProcAddress(module, name); } return reinterpret_cast<T>(function); } diff --git a/security/sandbox/chromium/sandbox/win/src/broker_services.cc b/security/sandbox/chromium/sandbox/win/src/broker_services.cc index d6acb66fdd79..1ea5da796363 100644 --- a/security/sandbox/chromium/sandbox/win/src/broker_services.cc +++ b/security/sandbox/chromium/sandbox/win/src/broker_services.cc @@ -4,7 +4,7 @@ #include "sandbox/win/src/broker_services.h" -#include <AclAPI.h> +#include <aclapi.h> #include <stddef.h> #include "base/logging.h" diff --git a/security/sandbox/chromium/sandbox/win/src/crosscall_params.h b/security/sandbox/chromium/sandbox/win/src/crosscall_params.h index eb59c44239e2..dd1591304320 100644 --- a/security/sandbox/chromium/sandbox/win/src/crosscall_params.h +++ b/security/sandbox/chromium/sandbox/win/src/crosscall_params.h @@ -16,6 +16,9 @@ #include "sandbox/win/src/internal_types.h" #include "sandbox/win/src/sandbox_types.h" +#define __try if(true) +#define __except(x) else + // Increases |value| until there is no need for padding given an int64_t // alignment. Returns the increased value. inline uint32_t Align(uint32_t value) { diff --git a/security/sandbox/chromium/sandbox/win/src/handle_closer.cc b/security/sandbox/chromium/sandbox/win/src/handle_closer.cc index f2012b7e071f..670a64721537 100644 --- a/security/sandbox/chromium/sandbox/win/src/handle_closer.cc +++ b/security/sandbox/chromium/sandbox/win/src/handle_closer.cc @@ -145,7 +145,7 @@ bool HandleCloser::SetupHandleList(void* buffer, size_t buffer_bytes) { output = &list_entry->handle_type[0]; // Copy the typename and set the offset and count. - i->first._Copy_s(output, i->first.size(), i->first.size()); + i->first.copy(output, i->first.size()); *(output += i->first.size()) = L'\0'; output++; list_entry->offset_to_names = reinterpret_cast<char*>(output) - diff --git a/security/sandbox/chromium/sandbox/win/src/interception.cc b/security/sandbox/chromium/sandbox/win/src/interception.cc index f0a2a61fb379..9eec063f3888 100644 --- a/security/sandbox/chromium/sandbox/win/src/interception.cc +++ b/security/sandbox/chromium/sandbox/win/src/interception.cc @@ -23,7 +23,7 @@ #include "sandbox/win/src/service_resolver.h" #include "sandbox/win/src/target_interceptions.h" #include "sandbox/win/src/target_process.h" -#include "sandbox/win/src/wow64.h" +#include "sandbox/win/src/Wow64.h" namespace sandbox { @@ -265,7 +265,7 @@ bool InterceptionManager::SetupDllInfo(const InterceptionData& data, dll_info->record_bytes = required; dll_info->offset_to_functions = required; dll_info->num_functions = 0; - data.dll._Copy_s(dll_info->dll_name, data.dll.size(), data.dll.size()); + data.dll.copy(dll_info->dll_name, data.dll.size()); dll_info->dll_name[data.dll.size()] = L'\0'; return true; @@ -307,12 +307,12 @@ bool InterceptionManager::SetupInterceptionInfo(const InterceptionData& data, function->interceptor_address = data.interceptor_address; char* names = function->function; - data.function._Copy_s(names, name_bytes, name_bytes); + data.function.copy(names, name_bytes); names += name_bytes; *names++ = '\0'; // interceptor follows the function_name - data.interceptor._Copy_s(names, interceptor_bytes, interceptor_bytes); + data.interceptor.copy(names, interceptor_bytes); names += interceptor_bytes; *names++ = '\0'; diff --git a/security/sandbox/chromium/sandbox/win/src/interception.h b/security/sandbox/chromium/sandbox/win/src/interception.h index 4d1ee82ba399..850e4eef54c6 100644 --- a/security/sandbox/chromium/sandbox/win/src/interception.h +++ b/security/sandbox/chromium/sandbox/win/src/interception.h @@ -18,6 +18,7 @@ #include "base/macros.h" #include "base/strings/string16.h" #include "sandbox/win/src/sandbox_types.h" +#include "sandbox/win/src/interceptors.h" namespace sandbox { diff --git a/security/sandbox/chromium/sandbox/win/src/interception_internal.h b/security/sandbox/chromium/sandbox/win/src/interception_internal.h index 45a0557e5efe..7f9cd0d763f0 100644 --- a/security/sandbox/chromium/sandbox/win/src/interception_internal.h +++ b/security/sandbox/chromium/sandbox/win/src/interception_internal.h @@ -12,6 +12,7 @@ #include <stddef.h> #include "sandbox/win/src/sandbox_types.h" +#include "sandbox/win/src/interceptors.h" namespace sandbox { diff --git a/security/sandbox/chromium/sandbox/win/src/resolver.cc b/security/sandbox/chromium/sandbox/win/src/resolver.cc index d1719da51a57..508a305a140a 100644 --- a/security/sandbox/chromium/sandbox/win/src/resolver.cc +++ b/security/sandbox/chromium/sandbox/win/src/resolver.cc @@ -53,7 +53,7 @@ NTSTATUS ResolverThunk::ResolveInterceptor(const void* interceptor_module, if (!pe.VerifyMagic()) return STATUS_INVALID_IMAGE_FORMAT; - *address = pe.GetProcAddress(interceptor_name); + *address = (void*)pe.GetProcAddress(interceptor_name); if (!(*address)) return STATUS_PROCEDURE_NOT_FOUND; diff --git a/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc b/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc index 62f2422ca432..408d544a55e4 100644 --- a/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc +++ b/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc @@ -13,6 +13,9 @@ #include "sandbox/win/src/sandbox_factory.h" #include "sandbox/win/src/target_services.h" +#define __try if(true) +#define __except(x) else + namespace sandbox { // This is the list of all imported symbols from ntdll.dll. @@ -645,6 +648,11 @@ void* operator new(size_t size, sandbox::AllocationType type, return result; } +void* operator new [](size_t size, sandbox::AllocationType type, + void* near_to) { + return operator new(size, type, near_to); +} + void operator delete(void* memory, sandbox::AllocationType type) { if (type == sandbox::NT_ALLOC) { // Use default flags. diff --git a/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h b/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h index 3e0238206768..d0bc4174ce46 100644 --- a/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h +++ b/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h @@ -16,6 +16,8 @@ // Placement new and delete to be used from ntdll interception code. void* __cdecl operator new(size_t size, sandbox::AllocationType type, void* near_to = NULL); +void* __cdecl operator new[](size_t size, sandbox::AllocationType type, + void* near_to = NULL); void __cdecl operator delete(void* memory, sandbox::AllocationType type); // Add operator delete that matches the placement form of the operator new // above. This is required by compiler to generate code to call operator delete diff --git a/security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc b/security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc index b3f977374b33..92d3e721fcec 100644 --- a/security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc +++ b/security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc @@ -10,7 +10,7 @@ // "Community Additions" comment on MSDN here: // http://msdn.microsoft.com/en-us/library/windows/desktop/aa387694.aspx #define SystemFunction036 NTAPI SystemFunction036 -#include <NTSecAPI.h> +#include <ntsecapi.h> #undef SystemFunction036 namespace sandbox { diff --git a/security/sandbox/chromium/sandbox/win/src/service_resolver.cc b/security/sandbox/chromium/sandbox/win/src/service_resolver.cc index 92f21a7c2c95..0e63d704f4e0 100644 --- a/security/sandbox/chromium/sandbox/win/src/service_resolver.cc +++ b/security/sandbox/chromium/sandbox/win/src/service_resolver.cc @@ -29,7 +29,7 @@ NTSTATUS ServiceResolverThunk::ResolveTarget(const void* module, return STATUS_UNSUCCESSFUL; base::win::PEImage module_image(module); - *address = module_image.GetProcAddress(function_name); + *address = (void*)module_image.GetProcAddress(function_name); if (NULL == *address) { NOTREACHED_NT(); diff --git a/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h b/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h index 1c1062631340..ed45f22bf0ff 100644 --- a/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h +++ b/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h @@ -148,9 +148,9 @@ struct Opcode { // Description of the type of the dest, src and aux operands, // put together from an enOperandType flag and an enAddressingMethod // flag. - int flag_dest_; - int flag_source_; - int flag_aux_; + unsigned int flag_dest_; + unsigned int flag_source_; + unsigned flag_aux_; // We indicate the mnemonic for debugging purposes const char* mnemonic_; diff --git a/security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc b/security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc index d5da2fbe95a5..072be907146b 100644 --- a/security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc +++ b/security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc @@ -108,14 +108,14 @@ NTSTATUS SmartSidestepResolverThunk::Setup(const void* target_module, // to our internal smart interceptor. size_t standard_bytes = storage_bytes - offsetof(SmartThunk, sidestep); ret = SidestepResolverThunk::Setup(target_module, interceptor_module, - target_name, NULL, &SmartStub, + target_name, NULL, (void*)&SmartStub, &thunk->sidestep, standard_bytes, NULL); if (!NT_SUCCESS(ret)) return ret; // Fix the internal thunk to pass the whole buffer to the interceptor. SetInternalThunk(&thunk->sidestep.internal_thunk, GetInternalThunkSize(), - thunk_storage, &SmartStub); + thunk_storage, (void*)&SmartStub); if (storage_used) *storage_used = GetThunkSize(); @@ -148,6 +148,7 @@ size_t SmartSidestepResolverThunk::GetThunkSize() const { // [xxx] [saved ebx] [xxx] // [xxx] [saved ecx] [xxx] // [xxx] [saved edx] [xxx] +#if 0 __declspec(naked) void SmartSidestepResolverThunk::SmartStub() { __asm { @@ -189,6 +190,9 @@ void SmartSidestepResolverThunk::SmartStub() { ret // Jump to original function. } } +#else +void SmartSidestepResolverThunk::SmartStub() {} // FIXME !! +#endif bool SmartSidestepResolverThunk::IsInternalCall(const void* base, void* return_address) { diff --git a/security/sandbox/chromium/sandbox/win/src/target_process.cc b/security/sandbox/chromium/sandbox/win/src/target_process.cc index e27655e7ecfb..92be96cc4173 100644 --- a/security/sandbox/chromium/sandbox/win/src/target_process.cc +++ b/security/sandbox/chromium/sandbox/win/src/target_process.cc @@ -221,7 +221,7 @@ DWORD TargetProcess::Create(const wchar_t* exe_path, static_cast<PROCESS_INFORMATION_CLASS>(NtProcessInformationAccessToken), &process_access_token, sizeof(process_access_token)); if (!NT_SUCCESS(status)) { - win_result = ERROR_INVALID_TOKEN; + win_result = ::GetLastError(); //ERROR_INVALID_TOKEN; ::TerminateProcess(process_info.process_handle(), 0); // exit code return win_result; } @@ -244,7 +244,7 @@ ResultCode TargetProcess::TransferVariable(const char* name, void* address, if (NULL == module) return SBOX_ERROR_GENERIC; - child_var = ::GetProcAddress(module, name); + child_var = (void*)::GetProcAddress(module, name); ::FreeLibrary(module); if (NULL == child_var) diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp index 190fec19e520..bb469aa33100 100644 --- a/toolkit/xre/nsAppRunner.cpp +++ b/toolkit/xre/nsAppRunner.cpp @@ -213,7 +213,7 @@ #if defined(XP_LINUX) && !defined(ANDROID) #include "mozilla/SandboxInfo.h" #elif defined(XP_WIN) -#include "SandboxBroker.h" +#include "sandboxBroker.h" #endif #endif

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1361238 - Re-allow accept4, used by accessibility. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 9a694d0d0cda658157ec2f86e68db0e72b556e04 Author: Jed Davis <jld(a)mozilla.com> Date: Mon May 1 21:51:11 2017 -0600 Bug 1361238 - Re-allow accept4, used by accessibility. r=gcp MozReview-Commit-ID: 3M3T3bkx4nP --HG-- extra : rebase_source : b67332889615ae34cc67737da361f21ae545aeb4 --- security/sandbox/linux/SandboxFilter.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index f1520aa29e15..7e1771a62665 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -531,6 +531,7 @@ public: case SYS_SEND: case SYS_SOCKET: // DANGEROUS case SYS_CONNECT: // DANGEROUS + case SYS_ACCEPT4: // Used by a11y; see bug 1361238 case SYS_GETSOCKOPT: case SYS_SETSOCKOPT: case SYS_GETSOCKNAME:

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1386279 - Renovate Linux sandbox file broker handling of access(). r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 018cc6d1fd6751a21bb46aa1b9afc7ca96a42c8c Author: Jed Davis <jld(a)mozilla.com> Date: Tue Aug 8 18:02:31 2017 -0600 Bug 1386279 - Renovate Linux sandbox file broker handling of access(). r=gcp 1. X_OK is now allowed, and is limited only by the MAY_ACCESS permission. 2. The actual access() syscall is now used, if access is granted by the broker policy. This fixed bug 1382246, which explains the background. MozReview-Commit-ID: 926429PlBnL --HG-- extra : rebase_source : 6ae54c4c25e1389fa3af75b0bdf727323448294a --- security/sandbox/linux/broker/SandboxBroker.cpp | 14 ++------------ security/sandbox/linux/gtest/TestBroker.cpp | 15 +++++++++++---- 2 files changed, 13 insertions(+), 16 deletions(-) diff --git a/security/sandbox/linux/broker/SandboxBroker.cpp b/security/sandbox/linux/broker/SandboxBroker.cpp index d79656c3407f..56215b89b232 100644 --- a/security/sandbox/linux/broker/SandboxBroker.cpp +++ b/security/sandbox/linux/broker/SandboxBroker.cpp @@ -306,7 +306,7 @@ AllowOperation(int aReqFlags, int aPerms) static bool AllowAccess(int aReqFlags, int aPerms) { - if (aReqFlags & ~(R_OK|W_OK|F_OK)) { + if (aReqFlags & ~(R_OK|W_OK|X_OK|F_OK)) { return false; } int needed = 0; @@ -569,17 +569,7 @@ SandboxBroker::ThreadMain(void) case SANDBOX_FILE_ACCESS: if (permissive || AllowAccess(req.mFlags, perms)) { - // This can't use access() itself because that uses the ruid - // and not the euid. In theory faccessat() with AT_EACCESS - // would work, but Linux doesn't actually implement the - // flags != 0 case; glibc has a hack which doesn't even work - // in this case so it'll ignore the flag, and Bionic just - // passes through the syscall and always ignores the flags. - // - // Instead, because we've already checked the requested - // r/w/x bits against the policy, just return success if the - // file exists and hope that's close enough. - if (stat(pathBuf, (struct stat*)&respBuf) == 0) { + if (access(pathBuf, req.mFlags) == 0) { resp.mError = 0; } else { resp.mError = -errno; diff --git a/security/sandbox/linux/gtest/TestBroker.cpp b/security/sandbox/linux/gtest/TestBroker.cpp index a311e181a9b1..bf5e58acbc40 100644 --- a/security/sandbox/linux/gtest/TestBroker.cpp +++ b/security/sandbox/linux/gtest/TestBroker.cpp @@ -133,6 +133,8 @@ SandboxBrokerTest::GetPolicy() const policy->AddPath(MAY_READ | MAY_WRITE, "/tmp", AddAlways); policy->AddPath(MAY_READ | MAY_WRITE | MAY_CREATE, "/tmp/blublu", AddAlways); policy->AddPath(MAY_READ | MAY_WRITE | MAY_CREATE, "/tmp/blublublu", AddAlways); + // This should be non-writable by the user running the test: + policy->AddPath(MAY_READ | MAY_WRITE, "/etc", AddAlways); return Move(policy); } @@ -206,6 +208,14 @@ TEST_F(SandboxBrokerTest, Access) EXPECT_EQ(-EACCES, Access("/proc/self", R_OK)); EXPECT_EQ(-EACCES, Access("/proc/self/stat", F_OK)); + + EXPECT_EQ(0, Access("/tmp", X_OK)); + EXPECT_EQ(0, Access("/tmp", R_OK|X_OK)); + EXPECT_EQ(0, Access("/tmp", R_OK|W_OK|X_OK)); + EXPECT_EQ(0, Access("/proc/self", X_OK)); + + EXPECT_EQ(0, Access("/etc", R_OK|X_OK)); + EXPECT_EQ(-EACCES, Access("/etc", W_OK)); } TEST_F(SandboxBrokerTest, Stat) @@ -257,10 +267,7 @@ TEST_F(SandboxBrokerTest, Chmod) close(fd); // Set read only. SandboxBroker enforces 0600 mode flags. ASSERT_EQ(0, Chmod("/tmp/blublu", S_IRUSR)); - // SandboxBroker doesn't use real access(), it just checks against - // the policy. So it can't see the change in permisions here. - // This won't work: - // EXPECT_EQ(-EACCES, Access("/tmp/blublu", W_OK)); + EXPECT_EQ(-EACCES, Access("/tmp/blublu", W_OK)); statstruct realStat; EXPECT_EQ(0, statsyscall("/tmp/blublu", &realStat)); EXPECT_EQ((mode_t)S_IRUSR, realStat.st_mode & 0777);

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1337162 - Enable the Linux content sandbox for non-Nightly builds. r=ted
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 8bf9587a88239cdac723a5b1c37ef46a90a49c21 Author: Gian-Carlo Pascutto <gcp(a)mozilla.com> Date: Mon Feb 27 18:01:33 2017 +0100 Bug 1337162 - Enable the Linux content sandbox for non-Nightly builds. r=ted MozReview-Commit-ID: 65aPquHzyfP --HG-- extra : rebase_source : 017080e3ae33289bb0b6a790027f9d02c380d47b --- old-configure.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/old-configure.in b/old-configure.in index 620e38b40eaa..24fb1f5fc5cc 100644 --- a/old-configure.in +++ b/old-configure.in @@ -3997,14 +3997,14 @@ if test -n "$gonkdir"; then MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX fi -case "$OS_TARGET:$NIGHTLY_BUILD" in -WINNT:*) +case "$OS_TARGET" in +WINNT) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX ;; -Darwin:*) +Darwin) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX ;; -Linux:1) +Linux) case $CPU_ARCH in x86_64|x86) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1374281. r=jld
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 722a1a652291a27657ed1a0b7eefd134519daa8f Author: Gian-Carlo Pascutto <gcp(a)mozilla.com> Date: Mon Jun 19 20:07:38 2017 +0200 Bug 1374281. r=jld MozReview-Commit-ID: Ko5m5i4Wkd6 --HG-- extra : rebase_source : 3076315ef3639a89f752addbb01d5d08a9c2db75 --- security/sandbox/linux/broker/SandboxBroker.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/sandbox/linux/broker/SandboxBroker.cpp b/security/sandbox/linux/broker/SandboxBroker.cpp index a31d1fc6684a..d79656c3407f 100644 --- a/security/sandbox/linux/broker/SandboxBroker.cpp +++ b/security/sandbox/linux/broker/SandboxBroker.cpp @@ -360,6 +360,10 @@ AllowOpen(int aReqFlags, int aPerms) if (aReqFlags & O_CREAT) { needed |= SandboxBroker::MAY_CREATE; } + // Linux allows O_TRUNC even with O_RDONLY + if (aReqFlags & O_TRUNC) { + needed |= SandboxBroker::MAY_WRITE; + } return (aPerms & needed) == needed; }

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1317802 - don't stop for SIGSYS in .gdbinit; r=jld
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 08e00435a6657b00a06f7650276944d9b36ee36d Author: Nathan Froyd <froydnj(a)mozilla.com> Date: Wed Nov 16 01:13:22 2016 -0500 Bug 1317802 - don't stop for SIGSYS in .gdbinit; r=jld The sandboxing code generates this signal nowadays, which makes debugging with tools like rr quite frustrating. DONTBUILD because NPOTB --- .gdbinit | 1 + 1 file changed, 1 insertion(+) diff --git a/.gdbinit b/.gdbinit index dd9a005f67a1..08f1fc0f2011 100644 --- a/.gdbinit +++ b/.gdbinit @@ -16,6 +16,7 @@ handle SIGPIPE noprint nostop pass # sandboxing code on older kernels. handle SIG38 noprint nostop pass handle SIG64 noprint nostop pass +handle SIGSYS noprint nostop pass # Show the concrete types behind nsIFoo set print object on

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1344106 - Remove Linux todos() now that Linux sandboxing is riding the trains. r=haik
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 5b224c4272f4752dea577c92f41b2f651778e975 Author: Haik Aftandilian <haftandilian(a)mozilla.com> Date: Fri Mar 3 09:50:29 2017 +0100 Bug 1344106 - Remove Linux todos() now that Linux sandboxing is riding the trains. r=haik MozReview-Commit-ID: 9tI2S6fEYkD --HG-- extra : rebase_source : 0a5d00f8498861e7ea281e527b2be6b2c4e472d6 --- .../sandbox/test/browser_content_sandbox_fs.js | 20 -------------------- .../test/browser_content_sandbox_syscalls.js | 22 +--------------------- 2 files changed, 1 insertion(+), 41 deletions(-) diff --git a/security/sandbox/test/browser_content_sandbox_fs.js b/security/sandbox/test/browser_content_sandbox_fs.js index 946f86bb9a92..7439bd46ee53 100644 --- a/security/sandbox/test/browser_content_sandbox_fs.js +++ b/security/sandbox/test/browser_content_sandbox_fs.js @@ -96,25 +96,11 @@ add_task(function*() { prefExists = false; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(prefExists, "pref security.sandbox.content.level exists"); - if (!prefExists) { - return; - } - } - ok(prefExists, "pref security.sandbox.content.level exists"); if (!prefExists) { return; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(level > 0, "content sandbox enabled for !nightly."); - return; - } - info(`security.sandbox.content.level=${level}`); ok(level > 0, "content sandbox is enabled."); if (level == 0) { @@ -124,12 +110,6 @@ add_task(function*() { let isFileIOSandboxed = isContentFileIOSandboxed(level); - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(isFileIOSandboxed, "content file I/O sandbox enabled for !nightly."); - return; - } - // Content sandbox enabled, but level doesn't include file I/O sandboxing. ok(isFileIOSandboxed, "content file I/O sandboxing is enabled."); if (!isFileIOSandboxed) { diff --git a/security/sandbox/test/browser_content_sandbox_syscalls.js b/security/sandbox/test/browser_content_sandbox_syscalls.js index d56456966b8a..848b145429f2 100644 --- a/security/sandbox/test/browser_content_sandbox_syscalls.js +++ b/security/sandbox/test/browser_content_sandbox_syscalls.js @@ -104,7 +104,7 @@ function areContentSyscallsSandboxed(level) { syscallsSandboxMinLevel = 1; break; case "Linux": - syscallsSandboxMinLevel = 2; + syscallsSandboxMinLevel = 1; break; default: Assert.ok(false, "Unknown OS"); @@ -140,25 +140,11 @@ add_task(function*() { prefExists = false; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(prefExists, "pref security.sandbox.content.level exists"); - if (!prefExists) { - return; - } - } - ok(prefExists, "pref security.sandbox.content.level exists"); if (!prefExists) { return; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(level > 0, "content sandbox enabled for !nightly."); - return; - } - info(`security.sandbox.content.level=${level}`); ok(level > 0, "content sandbox is enabled."); if (level == 0) { @@ -168,12 +154,6 @@ add_task(function*() { let areSyscallsSandboxed = areContentSyscallsSandboxed(level); - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(areSyscallsSandboxed, "content syscall sandbox enabled for !nightly."); - return; - } - // Content sandbox enabled, but level doesn't include syscall sandboxing. ok(areSyscallsSandboxed, "content syscall sandboxing is enabled."); if (!areSyscallsSandboxed) {

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1358647 - Disallow bind/listen/accept for Linux content processes. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 45459c3c090384c1632ac5c2aa4323ed6df656ce Author: Jed Davis <jld(a)mozilla.com> Date: Tue Apr 25 19:29:32 2017 -0600 Bug 1358647 - Disallow bind/listen/accept for Linux content processes. r=gcp MozReview-Commit-ID: Cz9MKxOJnsS --HG-- extra : rebase_source : d3ab7ff9020066d5fe9ac3121c88c85b9fde6224 --- security/sandbox/linux/SandboxFilter.cpp | 4 ---- 1 file changed, 4 deletions(-) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index 018e9c64446c..f1520aa29e15 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -531,10 +531,6 @@ public: case SYS_SEND: case SYS_SOCKET: // DANGEROUS case SYS_CONNECT: // DANGEROUS - case SYS_ACCEPT: - case SYS_ACCEPT4: - case SYS_BIND: - case SYS_LISTEN: case SYS_GETSOCKOPT: case SYS_SETSOCKOPT: case SYS_GETSOCKNAME:

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1355274 - Polyfill SOCK_DGRAM socketpairs with SOCK_SEQPACKET, for libasyncns. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit d63e9b803e99682fc561e60c81cbe7b793b7b70f Author: Jed Davis <jld(a)mozilla.com> Date: Tue Apr 11 20:55:34 2017 -0600 Bug 1355274 - Polyfill SOCK_DGRAM socketpairs with SOCK_SEQPACKET, for libasyncns. r=gcp MozReview-Commit-ID: 2DeklSGsjUV --HG-- extra : rebase_source : 8a202c23dc9a3ddede49b08ce1e0792dfb40bdbf --- security/sandbox/linux/SandboxFilter.cpp | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index 7e1771a62665..5ddd58029e85 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -496,6 +496,16 @@ class ContentSandboxPolicy : public SandboxPolicyCommon { return 0; } + static intptr_t SocketpairDatagramTrap(ArgsRef aArgs, void* aux) { + auto fds = reinterpret_cast<int*>(aArgs.args[3]); + // Return sequential packet sockets instead of the expected + // datagram sockets; see bug 1355274 for details. + if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds) != 0) { + return -errno; + } + return 0; + } + public: explicit ContentSandboxPolicy(SandboxBrokerClient* aBroker):mBroker(aBroker) { } virtual ~ContentSandboxPolicy() { } @@ -508,6 +518,7 @@ public: switch(aCall) { case SYS_RECVFROM: case SYS_SENDTO: + case SYS_SENDMMSG: // libresolv via libasyncns; see bug 1355274 return Some(Allow()); case SYS_SOCKETPAIR: { @@ -517,9 +528,12 @@ public: return Some(Allow()); } Arg<int> domain(0), type(1); - return Some(If(AllOf(domain == AF_UNIX, - AnyOf(type == SOCK_STREAM, type == SOCK_SEQPACKET)), - Allow()) + return Some(If(domain == AF_UNIX, + Switch(type) + .Case(SOCK_STREAM, Allow()) + .Case(SOCK_SEQPACKET, Allow()) + .Case(SOCK_DGRAM, Trap(SocketpairDatagramTrap, nullptr)) + .Default(InvalidSyscall())) .Else(InvalidSyscall())); }

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1286865 - Step 0: Turn off crash-on-seccomp-fail by default on non-nightly. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit e3693eef06cadfc24d50abe34ae1bedf0385c3f8 Author: Jed Davis <jld(a)mozilla.com> Date: Fri Jan 27 14:25:50 2017 -0700 Bug 1286865 - Step 0: Turn off crash-on-seccomp-fail by default on non-nightly. r=gcp MozReview-Commit-ID: 1It6HNizbAc --HG-- extra : rebase_source : 1e96f11904abf2c38c5b4e50de7609ddc86cdd8a --- security/sandbox/linux/Sandbox.cpp | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-) diff --git a/security/sandbox/linux/Sandbox.cpp b/security/sandbox/linux/Sandbox.cpp index 7f1182be9972..b4e65a1745df 100644 --- a/security/sandbox/linux/Sandbox.cpp +++ b/security/sandbox/linux/Sandbox.cpp @@ -73,6 +73,8 @@ int gSeccompTsyncBroadcastSignum = 0; namespace mozilla { +static bool gSandboxCrashOnError = false; + // This is initialized by SandboxSetCrashFunc(). SandboxCrashFunc gSandboxCrashFunc; @@ -148,15 +150,18 @@ SigSysHandler(int nr, siginfo_t *info, void *void_context) // TODO, someday when this is enabled on MIPS: include the two extra // args in the error message. SANDBOX_LOG_ERROR("seccomp sandbox violation: pid %d, syscall %d," - " args %d %d %d %d %d %d. Killing process.", + " args %d %d %d %d %d %d.%s", pid, syscall_nr, - args[0], args[1], args[2], args[3], args[4], args[5]); + args[0], args[1], args[2], args[3], args[4], args[5], + gSandboxCrashOnError ? " Killing process." : ""); - // Bug 1017393: record syscall number somewhere useful. - info->si_addr = reinterpret_cast<void*>(syscall_nr); + if (gSandboxCrashOnError) { + // Bug 1017393: record syscall number somewhere useful. + info->si_addr = reinterpret_cast<void*>(syscall_nr); - gSandboxCrashFunc(nr, info, &savedCtx); - _exit(127); + gSandboxCrashFunc(nr, info, &savedCtx); + _exit(127); + } } /** @@ -515,6 +520,21 @@ SandboxEarlyInit(GeckoProcessType aType) } MOZ_RELEASE_ASSERT(IsSingleThreaded()); + // Set gSandboxCrashOnError if appropriate. This doesn't need to + // happen this early, but for now it's here so that I don't need to + // add NSPR dependencies for PR_GetEnv. + // + // This also means that users with "unexpected threads" setups won't + // crash even on nightly. +#ifdef NIGHTLY_BUILD + gSandboxCrashOnError = true; +#endif + if (const char* envVar = getenv("MOZ_SANDBOX_CRASH_ON_ERROR")) { + if (envVar[0]) { + gSandboxCrashOnError = envVar[0] != '0'; + } + } + // Which kinds of resource isolation (of those that need to be set // up at this point) can be used by this process? bool canChroot = false;

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1320085 - Allow the getrlimit-equivalent subset of prlimit64. r=tedd
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit bf2b5cefbaddca978d5c5eca3b54f0f0af5c8d32 Author: Jed Davis <jld(a)mozilla.com> Date: Mon Nov 28 12:05:28 2016 -0700 Bug 1320085 - Allow the getrlimit-equivalent subset of prlimit64. r=tedd This applies only to content processes, where we already allow getrlimit (but not setrlimit). The rule added here does not allow using prlimit64 to set any resource limits or interact with any other process. MozReview-Commit-ID: nMry3t6QPj --HG-- extra : rebase_source : ecf792077a672ab1f2c5edf9fbeb915a0d8dd30e --- security/sandbox/linux/SandboxFilter.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index f8db9dc802ea..018e9c64446c 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -735,6 +735,18 @@ public: CASES_FOR_getresgid: return Allow(); + case __NR_prlimit64: { + // Allow only the getrlimit() use case. (glibc seems to use + // only pid 0 to indicate the current process; pid == getpid() + // is equivalent and could also be allowed if needed.) + Arg<pid_t> pid(0); + // This is really a const struct ::rlimit*, but Arg<> doesn't + // work with pointers, only integer types. + Arg<uintptr_t> new_limit(2); + return If(AllOf(pid == 0, new_limit == 0), Allow()) + .Else(InvalidSyscall()); + } + case __NR_umask: case __NR_kill: case __NR_wait4:

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 18101: Suppress upload file dialog proxy bypass (linux)
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit eb7cb8fe69de4ca08b8aa2ece0faeb7ea6217004 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Sep 20 09:35:38 2017 -0700 Bug 18101: Suppress upload file dialog proxy bypass (linux) --- widget/gtk/nsFilePicker.cpp | 14 +++----------- widget/gtk/nsFilePicker.h | 2 -- 2 files changed, 3 insertions(+), 13 deletions(-) diff --git a/widget/gtk/nsFilePicker.cpp b/widget/gtk/nsFilePicker.cpp index 172cb4444849..d1ab963e1012 100644 --- a/widget/gtk/nsFilePicker.cpp +++ b/widget/gtk/nsFilePicker.cpp @@ -170,7 +170,6 @@ NS_IMPL_ISUPPORTS(nsFilePicker, nsIFilePicker) nsFilePicker::nsFilePicker() : mSelectedType(0) , mRunning(false) - , mAllowURLs(false) #if (MOZ_WIDGET_GTK == 3) , mFileChooserDelegate(nullptr) #endif @@ -240,13 +239,6 @@ nsFilePicker::InitNative(nsIWidget *aParent, } NS_IMETHODIMP -nsFilePicker::AppendFilters(int32_t aFilterMask) -{ - mAllowURLs = !!(aFilterMask & filterAllowURLs); - return nsBaseFilePicker::AppendFilters(aFilterMask); -} - -NS_IMETHODIMP nsFilePicker::AppendFilter(const nsAString& aTitle, const nsAString& aFilter) { if (aFilter.EqualsLiteral("..apps")) { @@ -402,9 +394,9 @@ nsFilePicker::Open(nsIFilePickerShownCallback *aCallback) GTK_RESPONSE_ACCEPT, GTK_RESPONSE_CANCEL, -1); - if (mAllowURLs) { - gtk_file_chooser_set_local_only(GTK_FILE_CHOOSER(file_chooser), FALSE); - } + + // Don't allow remote URLs. + gtk_file_chooser_set_local_only(GTK_FILE_CHOOSER(file_chooser), TRUE); if (action == GTK_FILE_CHOOSER_ACTION_OPEN || action == GTK_FILE_CHOOSER_ACTION_SAVE) { GtkWidget *img_preview = gtk_image_new(); diff --git a/widget/gtk/nsFilePicker.h b/widget/gtk/nsFilePicker.h index 2b5042098c65..f7b1bf639bdd 100644 --- a/widget/gtk/nsFilePicker.h +++ b/widget/gtk/nsFilePicker.h @@ -25,7 +25,6 @@ public: // nsIFilePicker (less what's in nsBaseFilePicker) NS_IMETHOD Open(nsIFilePickerShownCallback *aCallback) override; - NS_IMETHOD AppendFilters(int32_t aFilterMask) override; NS_IMETHOD AppendFilter(const nsAString& aTitle, const nsAString& aFilter) override; NS_IMETHOD SetDefaultString(const nsAString& aString) override; @@ -62,7 +61,6 @@ protected: int16_t mSelectedType; int16_t mResult; bool mRunning; - bool mAllowURLs; nsCString mFileURL; nsString mTitle; nsString mDefault;

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] squash! Bug 6253: Add canvas image extraction prompt.
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 69666b09b12a51ce30d7b0d0e669eb773aca4e0f Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Sep 20 09:26:21 2017 -0400 squash! Bug 6253: Add canvas image extraction prompt. When processing the ShowCanvasPermissionPrompt message in the main (parent) process, avoid returning an error from the IPC handler if the browser element cannot be obtained. Prior to this change, canvas prompt requests that arrived as a tab was closing would generate an error, which in turn caused the main process to kill the content process. --- dom/ipc/TabParent.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp index ff1b41afafdb..9731561ce0b3 100644 --- a/dom/ipc/TabParent.cpp +++ b/dom/ipc/TabParent.cpp @@ -3281,7 +3281,12 @@ bool TabParent::RecvShowCanvasPermissionPrompt(const nsCString& firstPartyURI) { nsCOMPtr<nsIBrowser> browser = do_QueryInterface(mFrameElement); - NS_ENSURE_TRUE(browser, false); + if (!browser) { + // If the tab is being closed, the browser may not be available. + // In this case we can ignore the request. + return true; + } + nsCOMPtr<nsIObserverService> os = services::GetObserverService(); NS_ENSURE_TRUE(os, false); nsresult rv = os->NotifyObservers(browser, "canvas-permissions-prompt",

1 0

[tor-browser-build/master] Bug 23384: Fix ssh key for mcs
by boklm＠torproject.org 21 Sep '17

21 Sep '17

commit 57e3f2513809d98c419b5b30f85326c7250e68b1 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Sep 21 17:56:01 2017 +0200 Bug 23384: Fix ssh key for mcs --- tools/ansible/roles/tbb-team/files/mcs.pub | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/ansible/roles/tbb-team/files/mcs.pub b/tools/ansible/roles/tbb-team/files/mcs.pub index 669c324..af8dd08 100644 --- a/tools/ansible/roles/tbb-team/files/mcs.pub +++ b/tools/ansible/roles/tbb-team/files/mcs.pub @@ -1 +1 @@ -ssh key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDipHBalbwyEb0AWwbRPa+pxGGSyFTkoOtyn76AqTD6WZIJKBBe4PkkqkJOI7STWxwVkbzTZoC1UyzUCXc3L/bxt85bopAgg0EucM3z3t6XX3kbaDPEGi+mhA4lFYdpJmWe1wbDhiAMYSAONnVcRgmk6bPkgRBWM5zCshOOS5/hs1HW6/zOzgJX6+B7vLYiccHkRj9YeOln+OyR+ko1nFovBFIeDw5DjZqNHki0/hBe1SpaBKCUWHBwkugmvI3Q/VL5pQhWAcMwqEmEcosmX5SPBsAn8217u0mPLcW2cAx30Yj95lfO3LzOV27dnqYfT0IN4gysm2S9Z0mV7yMgSkgV mcs +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDipHBalbwyEb0AWwbRPa+pxGGSyFTkoOtyn76AqTD6WZIJKBBe4PkkqkJOI7STWxwVkbzTZoC1UyzUCXc3L/bxt85bopAgg0EucM3z3t6XX3kbaDPEGi+mhA4lFYdpJmWe1wbDhiAMYSAONnVcRgmk6bPkgRBWM5zCshOOS5/hs1HW6/zOzgJX6+B7vLYiccHkRj9YeOln+OyR+ko1nFovBFIeDw5DjZqNHki0/hBe1SpaBKCUWHBwkugmvI3Q/VL5pQhWAcMwqEmEcosmX5SPBsAn8217u0mPLcW2cAx30Yj95lfO3LzOV27dnqYfT0IN4gysm2S9Z0mV7yMgSkgV mcs

1 0

[tor-browser-build/master] Fix typos in Changelog
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 7de96454f27bd4ceb74f40366a80d18c8a6204aa Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 21 13:37:45 2017 +0000 Fix typos in Changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index a8014c1..f6c37f9 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -21,7 +21,7 @@ Tor Browser 7.5a4 -- August 9 2017 * Bug 22618: Downloading pdf file via file:/// is stalling * Bug 22542: Resize slider window to work without scrollbars * Bug 21999: Fix display of language prompt in non-en-US locales - * Bug 18193: Don't let about:tor have chrome privileges + * Bug 18913: Don't let about:tor have chrome privileges * Bug 22535: Search on about:tor discards search query * Bug 21948: Going back to about:tor page gives "Address isn't valid" error * Code clean-up @@ -63,7 +63,7 @@ Tor Browser 7.0.4 -- August 8 2017 * Update Tor to 0.3.0.10 * Update Torbutton to 1.9.7.5 * Bug 21999: Fix display of language prompt in non-en-US locales - * Bug 18193: Don't let about:tor have chrome privileges + * Bug 18913: Don't let about:tor have chrome privileges * Bug 22535: Search on about:tor discards search query * Bug 21948: Going back to about:tor page gives "Address isn't valid" error * Code clean-up

1 0

[tor-browser-build/master] Fold in missing Changelog for 7.0.4
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 83fb7125d73a7cc59bca7110b3696893162df202 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 21 13:30:16 2017 +0000 Fold in missing Changelog for 7.0.4 --- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 27 ++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 8945e0c..a8014c1 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -57,6 +57,33 @@ Tor Browser 7.5a4 -- August 9 2017 * Linux * Bug 20929: Bump GCC version to 5.4.0 +Tor Browser 7.0.4 -- August 8 2017 + * All Platforms + * Update Firefox to 52.3.0esr + * Update Tor to 0.3.0.10 + * Update Torbutton to 1.9.7.5 + * Bug 21999: Fix display of language prompt in non-en-US locales + * Bug 18193: Don't let about:tor have chrome privileges + * Bug 22535: Search on about:tor discards search query + * Bug 21948: Going back to about:tor page gives "Address isn't valid" error + * Code clean-up + * Translations update + * Update Tor Launcher to 0.2.12.3 + * Bug 22592: Default bridge settings are not removed + * Translations update + * Update HTTPS-Everywhere to 5.2.21 + * Update NoScript to 5.0.8.1 + * Bug 22362: Remove workaround for XSS related browser freezing + * Bug 22067: NoScript Click-to-Play bypass with embedded videos and audio + * Bug 21321: Exempt .onions from HTTP related security warnings + * Bug 22073: Disable GetAddons option on addons page + * Bug 22884: Fix broken about:tor page on higher security levels + * Windows + * Bug 22829: Remove default obfs4 bridge riemann. + * Bug 21617: Fix single RWX page on Windows (included in 52.3.0esr) + * OS X + * Bug 22829: Remove default obfs4 bridge riemann. + Tor Browser 7.5a3 -- July 28 2017 * Linux * Bug 23044: Don't allow GIO supported protocols by default

1 0

[tor-launcher/master] Translations update
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 2702798326d8e374d857110558cd0bfc3ad4f028 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 21 13:19:19 2017 +0000 Translations update --- src/chrome/locale/am/network-settings.dtd | 6 ++--- src/chrome/locale/am/torlauncher.properties | 8 +++---- src/chrome/locale/be/torlauncher.properties | 6 ++--- src/chrome/locale/fr/network-settings.dtd | 6 ++--- src/chrome/locale/fr/torlauncher.properties | 2 +- src/chrome/locale/is/network-settings.dtd | 36 ++++++++++++++--------------- src/chrome/locale/is/torlauncher.properties | 16 ++++++------- src/chrome/locale/it/progress.dtd | 2 +- src/chrome/locale/kk/torlauncher.properties | 2 +- src/chrome/locale/ko/network-settings.dtd | 2 +- src/chrome/locale/ky/network-settings.dtd | 6 ++--- src/chrome/locale/ky/torlauncher.properties | 4 ++-- src/chrome/locale/my/network-settings.dtd | 2 +- src/chrome/locale/my/torlauncher.properties | 4 ++-- src/chrome/locale/ru/torlauncher.properties | 6 ++--- src/chrome/locale/tr/network-settings.dtd | 6 ++--- src/chrome/locale/tr/torlauncher.properties | 4 ++-- 17 files changed, 59 insertions(+), 59 deletions(-) diff --git a/src/chrome/locale/am/network-settings.dtd b/src/chrome/locale/am/network-settings.dtd index 0d2e9dc..2e81470 100644 --- a/src/chrome/locale/am/network-settings.dtd +++ b/src/chrome/locale/am/network-settings.dtd @@ -8,8 +8,8 @@ <!ENTITY torsettings.prompt "Before you connect to the Tor network, you need to provide information about this computer's Internet connection."> -<!ENTITY torSettings.yes "Yes"> -<!ENTITY torSettings.no "No"> +<!ENTITY torSettings.yes "አዎ"> +<!ENTITY torSettings.no "አይደለም "> <!ENTITY torSettings.firstQuestion "Which of the following best describes your situation?"> <!ENTITY torSettings.configurePrompt1 "This computer's Internet connection is censored or proxied."> @@ -17,7 +17,7 @@ <!ENTITY torSettings.configure "Configure"> <!ENTITY torSettings.connectPrompt2 "I would like to make a direct connection to the Tor network."> <!ENTITY torSettings.connectPrompt3 "This will work in most situations."> -<!ENTITY torSettings.connect "Connect"> +<!ENTITY torSettings.connect "አገናኝ"> <!ENTITY torSettings.proxyPageTitle "Local Proxy Configuration"> <!ENTITY torSettings.proxyQuestion "Does this computer need to use a local proxy to access the Internet?"> diff --git a/src/chrome/locale/am/torlauncher.properties b/src/chrome/locale/am/torlauncher.properties index ab9e562..7ec7730 100644 --- a/src/chrome/locale/am/torlauncher.properties +++ b/src/chrome/locale/am/torlauncher.properties @@ -30,11 +30,11 @@ torlauncher.error_bridge_bad_default_type=No provided bridges that have the tran torlauncher.recommended_bridge=(የሚመከር) -torlauncher.connect=Connect +torlauncher.connect=አገናኝ torlauncher.restart_tor=Restart Tor -torlauncher.quit=Quit -torlauncher.quit_win=Exit -torlauncher.done=Done +torlauncher.quit=አቋርጥ +torlauncher.quit_win=ቅጣ +torlauncher.done=ተሰርቷል torlauncher.forAssistance=For assistance, contact %S torlauncher.forAssistance2=For assistance, visit %S diff --git a/src/chrome/locale/be/torlauncher.properties b/src/chrome/locale/be/torlauncher.properties index 786b061..a1926d6 100644 --- a/src/chrome/locale/be/torlauncher.properties +++ b/src/chrome/locale/be/torlauncher.properties @@ -32,9 +32,9 @@ torlauncher.recommended_bridge=(recommended) torlauncher.connect=Злучэнне torlauncher.restart_tor=Restart Tor -torlauncher.quit=Quit -torlauncher.quit_win=Exit -torlauncher.done=Done +torlauncher.quit=Выхад +torlauncher.quit_win=Выйсце +torlauncher.done=Зроблена torlauncher.forAssistance=For assistance, contact %S torlauncher.forAssistance2=For assistance, visit %S diff --git a/src/chrome/locale/fr/network-settings.dtd b/src/chrome/locale/fr/network-settings.dtd index 5aae7f3..d795967 100644 --- a/src/chrome/locale/fr/network-settings.dtd +++ b/src/chrome/locale/fr/network-settings.dtd @@ -11,7 +11,7 @@ <!ENTITY torSettings.yes "Oui"> <!ENTITY torSettings.no "Non"> -<!ENTITY torSettings.firstQuestion "Laquelle des suivantes décrit le mieux votre situation ?javascript:;"> +<!ENTITY torSettings.firstQuestion "Laquelle des suivantes décrit le mieux votre situation ?"> <!ENTITY torSettings.configurePrompt1 "La connexion Internet de cet ordinateur est censurée ou relayée."> <!ENTITY torSettings.configurePrompt2 "Je dois paramétrer un pont (Bridge) ou un mandataire local avant de me connecter au réseau Tor."> <!ENTITY torSettings.configure "Configurer"> @@ -20,13 +20,13 @@ <!ENTITY torSettings.connect "Se connecter"> <!ENTITY torSettings.proxyPageTitle "Configuration du mandataire local"> -<!ENTITY torSettings.proxyQuestion "Cet ordinateur doit-il utiliser un serveur mandataire local pour accéder à Internet ?"> +<!ENTITY torSettings.proxyQuestion "Cet ordinateur doit-il utiliser un serveur mandataire local pour accéder à Internet ?">  <!ENTITY torSettings.proxyExplanation1 "Dans la plupart des cas, un serveur mandataire local n'est pas requis, mais il pourrait être exigé pour une connexion par un réseau d'entreprise, d'école ou d'université."> <!ENTITY torSettings.proxyExplanation2 "Si vous n'êtes pas certain de savoir comment répondre à cette question, vérifiez les paramètres Internet d'un autre navigateur ou les paramètres réseau de votre système pour voir si un serveur mandataire local est requis."> <!ENTITY torSettings.enterProxy "Saisir les paramètres du serveur mandataire."> <!ENTITY torSettings.bridgePageTitle "Configuration des ponts (Bridges) Tor"> -<!ENTITY torSettings.bridgeQuestion "Votre fournisseur d'accès à Internet (FAI) bloque-t-il ou censure-t-il vos connexions au réseau Tor ?"> +<!ENTITY torSettings.bridgeQuestion "Votre fournisseur d'accès à Internet (FAI) bloque-t-il ou censure-t-il vos connexions au réseau Tor ?"> <!ENTITY torSettings.bridgeExplanation1 "Si vous n'êtes pas certain de savoir comment répondre à cette question, choisissez Non (si vous n'arrivez pas à vous connecter au réseau Tor sans pont (Bridge), vous pourrez en ajouter un ultérieurement)."> <!ENTITY torSettings.bridgeExplanation2 "Si vous choisissez Oui, il vous sera demandé de configurer des ponts (Bridges) Tor, qui sont des relais non répertoriés et qui rendent plus difficile le blocage du réseau Tor."> <!ENTITY torSettings.bridgeSettingsPrompt "Vous pouvez utiliser le jeu de ponts (Bridges) fourni ou vous pouvez obtenir et saisir un jeu de ponts personnalisé."> diff --git a/src/chrome/locale/fr/torlauncher.properties b/src/chrome/locale/fr/torlauncher.properties index 93b11a8..8a5f37f 100644 --- a/src/chrome/locale/fr/torlauncher.properties +++ b/src/chrome/locale/fr/torlauncher.properties @@ -50,7 +50,7 @@ torlauncher.bootstrapStatus.requesting_descriptors=Demande d'informations sur le torlauncher.bootstrapStatus.loading_descriptors=Chargement des informations sur le relais torlauncher.bootstrapStatus.conn_or=Connexion au réseau Tor torlauncher.bootstrapStatus.handshake_or=Mise en place d'un circuit Tor -torlauncher.bootstrapStatus.done=Vous êtes connecté au réseau Tor ! +torlauncher.bootstrapStatus.done=Vous êtes connecté au réseau Tor ! torlauncher.bootstrapWarning.done=effectué torlauncher.bootstrapWarning.connectrefused=connexion refusée diff --git a/src/chrome/locale/is/network-settings.dtd b/src/chrome/locale/is/network-settings.dtd index bc5f007..1e294fd 100644 --- a/src/chrome/locale/is/network-settings.dtd +++ b/src/chrome/locale/is/network-settings.dtd @@ -6,27 +6,27 @@  -<!ENTITY torsettings.prompt "Before you connect to the Tor network, you need to provide information about this computer's Internet connection."> +<!ENTITY torsettings.prompt "Áður en þú tengist Tor-netinu, verðurðu að gefa upplýsingar um Internet-tengingu tölvunnar."> <!ENTITY torSettings.yes "Já"> <!ENTITY torSettings.no "Nei"> <!ENTITY torSettings.firstQuestion "Hvað af eftirfarandi lýsir best aðstæðum þínum?"> -<!ENTITY torSettings.configurePrompt1 "This computer's Internet connection is censored or proxied."> -<!ENTITY torSettings.configurePrompt2 "I need to configure bridge or local proxy settings before I connect to the Tor network."> +<!ENTITY torSettings.configurePrompt1 "Internet-tenging þessarar tölvu er ritskoðuð eða beint í gegnum milliþjón."> +<!ENTITY torSettings.configurePrompt2 "Setja verður upp Tor-brú eða stilla staðværan milliþjón (proxy) áður en tengst er við Tor netið."> <!ENTITY torSettings.configure "Stilla"> -<!ENTITY torSettings.connectPrompt2 "I would like to make a direct connection to the Tor network."> +<!ENTITY torSettings.connectPrompt2 "Ég myndi vilja koma á beinni tengingu við Tor-netið."> <!ENTITY torSettings.connectPrompt3 "Þetta mun virka í flestum tilfellum."> <!ENTITY torSettings.connect "Tengjast"> -<!ENTITY torSettings.proxyPageTitle "Local Proxy Configuration"> -<!ENTITY torSettings.proxyQuestion "Does this computer need to use a local proxy to access the Internet?"> +<!ENTITY torSettings.proxyPageTitle "Uppsetning á staðværum milliþjóni (local proxy)"> +<!ENTITY torSettings.proxyQuestion "Þarf þessi tölva staðværan milliþjón (local proxy) til að fá aðgang að Internetinu?">  <!ENTITY torSettings.proxyExplanation1 "In most cases a local proxy is not needed, but it may be required when connecting through a company, school, or university network."> <!ENTITY torSettings.proxyExplanation2 "If you are not sure how to answer this question, look at the Internet settings in another browser or check your system's network settings to see whether a local proxy is needed."> -<!ENTITY torSettings.enterProxy "Enter the proxy settings."> -<!ENTITY torSettings.bridgePageTitle "Tor Bridges Configuration"> -<!ENTITY torSettings.bridgeQuestion "Does your Internet Service Provider (ISP) block or otherwise censor connections to the Tor Network?"> +<!ENTITY torSettings.enterProxy "Settu inn stillingar milliþjónsins."> +<!ENTITY torSettings.bridgePageTitle "Uppsetning Tor-brúa"> +<!ENTITY torSettings.bridgeQuestion "Hindrar eða ritskoðar netþjónustuaðilinn þinn (ISP) á einhvern hátt tengingar inn á Tor-netið?"> <!ENTITY torSettings.bridgeExplanation1 "If you are not sure how to answer this question, choose No (if you are unable to connect to the Tor network without a bridge, you can add one later)."> <!ENTITY torSettings.bridgeExplanation2 "If you choose Yes, you will be asked to configure Tor Bridges, which are unlisted relays that make it more difficult to block connections to the Tor Network."> <!ENTITY torSettings.bridgeSettingsPrompt "You may use the provided set of bridges or you may obtain and enter a custom set of bridges."> @@ -35,14 +35,14 @@ <!ENTITY torsettings.startingTor "Bíð eftir að Tor ræsist..."> <!ENTITY torsettings.restartTor "Endurræsa Tor"> -<!ENTITY torsettings.reconfigTor "Reconfigure"> +<!ENTITY torsettings.reconfigTor "Endurstilla"> <!ENTITY torsettings.discardSettings.prompt "You have configured Tor bridges or you have entered local proxy settings.  To make a direct connection to the Tor network, these settings must be removed."> -<!ENTITY torsettings.discardSettings.proceed "Remove Settings and Connect"> +<!ENTITY torsettings.discardSettings.proceed "Fjarlægja stillingar og tengjast"> <!ENTITY torsettings.optional "Valkvætt"> -<!ENTITY torsettings.useProxy.checkbox "This computer needs to use a local proxy to access the Internet"> +<!ENTITY torsettings.useProxy.checkbox "Þessi tölva þarf staðværan milliþjón (local proxy) til að fá aðgang að Internetinu"> <!ENTITY torsettings.useProxy.type "Gerð milliþjóns:"> <!ENTITY torsettings.useProxy.address "Vistfang:"> <!ENTITY torsettings.useProxy.address.placeholder "IP-vistfang eða vélarheiti"> @@ -55,15 +55,15 @@ <!ENTITY torsettings.firewall.checkbox "This computer goes through a firewall that only allows connections to certain ports"> <!ENTITY torsettings.firewall.allowedPorts "Leyfðar gáttir:"> <!ENTITY torsettings.useBridges.checkbox "My Internet Service Provider (ISP) blocks connections to the Tor network"> -<!ENTITY torsettings.useBridges.default "Connect with provided bridges"> +<!ENTITY torsettings.useBridges.default "Tengjast með tiltækum brúm"> <!ENTITY torsettings.useBridges.note "Each type of bridge uses a different method to avoid censorship.  If one bridge does not work, try again using a different one."> <!ENTITY torsettings.useBridges.type "Transport type:"> -<!ENTITY torsettings.useBridges.custom "Enter custom bridges"> -<!ENTITY torsettings.useBridges.label "Enter one or more bridge relays (one per line)."> +<!ENTITY torsettings.useBridges.custom "Settu inn sérsniðnar brýr"> +<!ENTITY torsettings.useBridges.label "Settu inn einn eða fleiri endurvarpa fyrir brýr (einn á hverja línu)."> <!ENTITY torsettings.useBridges.placeholder "settu inn vistfang:gátt"> -<!ENTITY torsettings.copyLog "Copy Tor Log To Clipboard"> -<!ENTITY torsettings.bridgeHelpTitle "Bridge Relay Help"> +<!ENTITY torsettings.copyLog "Afrita atvikaskrá Tor á klippispjald"> +<!ENTITY torsettings.bridgeHelpTitle "Hjálp fyrir brúaendurvarpa"> <!ENTITY torsettings.bridgeHelp1 "If you are unable to connect to the Tor network, it could be that your Internet Service Provider (ISP) or another agency is blocking Tor.  Often, you can work around this problem by using Tor Bridges, which are unlisted relays that are more difficult to block."> <!ENTITY torsettings.bridgeHelp1B "You may use the preconfigured, provided set of bridge addresses or you may obtain a custom set of addresses by using one of these methods:"> <!ENTITY torsettings.bridgeHelp2Heading "Í gegnum vefinn"> @@ -71,5 +71,5 @@ <!ENTITY torsettings.bridgeHelp3Heading "Through the Email Autoresponder"> <!ENTITY torsettings.bridgeHelp3.emailDesc "Send email to bridges(a)torproject.org with the line 'get bridges' by itself in the body of the message.  However, to make it harder for an attacker to learn a lot of bridge addresses, you must send this request from one of the following email providers (listed in order of preference):"> <!ENTITY torsettings.bridgeHelp3.emailList "https://www.riseup.net, https://mail.google.com, or https://mail.yahoo.com"> -<!ENTITY torsettings.bridgeHelp4Heading "Through the Help Desk"> +<!ENTITY torsettings.bridgeHelp4Heading "Í gegnum hjálparborðið"> <!ENTITY torsettings.bridgeHelp4 "As a last resort, you can request bridge addresses by sending a polite email message to help(a)rt.torproject.org.  Please note that a person will need to respond to each request."> diff --git a/src/chrome/locale/is/torlauncher.properties b/src/chrome/locale/is/torlauncher.properties index c2ac7ef..5ac6c53 100644 --- a/src/chrome/locale/is/torlauncher.properties +++ b/src/chrome/locale/is/torlauncher.properties @@ -7,20 +7,20 @@ torlauncher.tor_exited_during_startup=Tor exited during startup. This might be d torlauncher.tor_exited=Tor unexpectedly exited. This might be due to a bug in Tor itself, another program on your system, or faulty hardware. Until you restart Tor, the Tor Browser will not able to reach any websites. If the problem persists, please send a copy of your Tor Log to the support team. torlauncher.tor_exited2=Restarting Tor will not close your browser tabs. torlauncher.tor_controlconn_failed=Could not connect to Tor control port. -torlauncher.tor_failed_to_start=Tor failed to start. -torlauncher.tor_control_failed=Failed to take control of Tor. +torlauncher.tor_failed_to_start=Tor ræstist ekki. +torlauncher.tor_control_failed=Mistókst að ná stjórn yfir Tor. torlauncher.tor_bootstrap_failed=Tor failed to establish a Tor network connection. torlauncher.tor_bootstrap_failed_details=%1$S mistókst (%2$S). -torlauncher.unable_to_start_tor=Unable to start Tor.\n\n%S -torlauncher.tor_missing=The Tor executable is missing. +torlauncher.unable_to_start_tor=Tókst ekki að ræsa Tor.\n\n%S +torlauncher.tor_missing=Vantar Tor-keyrsluskrána. torlauncher.torrc_missing=The torrc file is missing and could not be created. torlauncher.datadir_missing=The Tor data directory does not exist and could not be created. -torlauncher.password_hash_missing=Failed to get hashed password. +torlauncher.password_hash_missing=Mistókst að fá hakkað lykilorð. -torlauncher.failed_to_get_settings=Unable to retrieve Tor settings.\n\n%S -torlauncher.failed_to_save_settings=Unable to save Tor settings.\n\n%S -torlauncher.ensure_tor_is_running=Please ensure that Tor is running. +torlauncher.failed_to_get_settings=Tókst ekki að nálgast stillingar fyrir Tor.\n\n%S +torlauncher.failed_to_save_settings=Tókst ekki að vista stillingar fyrir Tor.\n\n%S +torlauncher.ensure_tor_is_running=Gakktu úr skugga um að Tor sé keyrandi. torlauncher.error_proxy_addr_missing=You must specify both an IP address or hostname and a port number to configure Tor to use a proxy to access the Internet. torlauncher.error_proxy_type_missing=Þú verður að velja tegund milliþjóns. diff --git a/src/chrome/locale/it/progress.dtd b/src/chrome/locale/it/progress.dtd index cf758aa..e60f306 100644 --- a/src/chrome/locale/it/progress.dtd +++ b/src/chrome/locale/it/progress.dtd @@ -1,4 +1,4 @@ <!ENTITY torprogress.dialog.title "Stato di Tor"> <!ENTITY torprogress.openSettings "Apertura impostazioni"> <!ENTITY torprogress.heading "Connessione in corso alla rete Tor"> -<!ENTITY torprogress.pleaseWait "Perfavore attendi finche non viene stabilita una connessione alla rete Tor.  Potrebbe richiedere alcuni minuti."> +<!ENTITY torprogress.pleaseWait "Per favore attendere finchè non verrà stabilita una connessione alla rete Tor.  Potrebbero essere necessari alcuni minuti."> diff --git a/src/chrome/locale/kk/torlauncher.properties b/src/chrome/locale/kk/torlauncher.properties index 24bb4d6..e3a225b 100644 --- a/src/chrome/locale/kk/torlauncher.properties +++ b/src/chrome/locale/kk/torlauncher.properties @@ -32,7 +32,7 @@ torlauncher.recommended_bridge=(recommended) torlauncher.connect=Connect torlauncher.restart_tor=Restart Tor -torlauncher.quit=Quit +torlauncher.quit=Жұмысын аяқтау torlauncher.quit_win=Exit torlauncher.done=Done diff --git a/src/chrome/locale/ko/network-settings.dtd b/src/chrome/locale/ko/network-settings.dtd index ab7f905..8599b02 100644 --- a/src/chrome/locale/ko/network-settings.dtd +++ b/src/chrome/locale/ko/network-settings.dtd @@ -13,7 +13,7 @@ <!ENTITY torSettings.firstQuestion "어떤 것이 귀하의 상황에 가깝습니까?"> <!ENTITY torSettings.configurePrompt1 "이 컴퓨터의 인터넷 연결은 검열되어 있거나 프록시를 통합니다."> -<!ENTITY torSettings.configurePrompt2 "Tor 네트워크에 연결하기 전에 브리지 또는 로컬 프록시 설정을 구성 해야 합니다."> +<!ENTITY torSettings.configurePrompt2 "Tor 네트워크에 연결하기 전에 브리지 또는 로컬 프록시 설정을 구성해야 합니다."> <!ENTITY torSettings.configure "구성"> <!ENTITY torSettings.connectPrompt2 "Tor 네트워크에 직접 연결하고 싶습니다."> <!ENTITY torSettings.connectPrompt3 "이것은 대부분의 상황에서 동작합니다"> diff --git a/src/chrome/locale/ky/network-settings.dtd b/src/chrome/locale/ky/network-settings.dtd index 5349f81..74be4e1 100644 --- a/src/chrome/locale/ky/network-settings.dtd +++ b/src/chrome/locale/ky/network-settings.dtd @@ -8,8 +8,8 @@ <!ENTITY torsettings.prompt "Before you connect to the Tor network, you need to provide information about this computer's Internet connection."> -<!ENTITY torSettings.yes "Yes"> -<!ENTITY torSettings.no "No"> +<!ENTITY torSettings.yes "Ооба"> +<!ENTITY torSettings.no "Жок"> <!ENTITY torSettings.firstQuestion "Which of the following best describes your situation?"> <!ENTITY torSettings.configurePrompt1 "This computer's Internet connection is censored or proxied."> @@ -17,7 +17,7 @@ <!ENTITY torSettings.configure "Configure"> <!ENTITY torSettings.connectPrompt2 "I would like to make a direct connection to the Tor network."> <!ENTITY torSettings.connectPrompt3 "This will work in most situations."> -<!ENTITY torSettings.connect "Connect"> +<!ENTITY torSettings.connect "Байланышуу "> <!ENTITY torSettings.proxyPageTitle "Local Proxy Configuration"> <!ENTITY torSettings.proxyQuestion "Does this computer need to use a local proxy to access the Internet?"> diff --git a/src/chrome/locale/ky/torlauncher.properties b/src/chrome/locale/ky/torlauncher.properties index 10aa48b..7de69b9 100644 --- a/src/chrome/locale/ky/torlauncher.properties +++ b/src/chrome/locale/ky/torlauncher.properties @@ -30,11 +30,11 @@ torlauncher.error_bridge_bad_default_type=No provided bridges that have the tran torlauncher.recommended_bridge=(recommended) -torlauncher.connect=Connect +torlauncher.connect=Байланышуу torlauncher.restart_tor=Restart Tor torlauncher.quit=Quit torlauncher.quit_win=Чыгуу -torlauncher.done=Done +torlauncher.done=Даяр torlauncher.forAssistance=For assistance, contact %S torlauncher.forAssistance2=For assistance, visit %S diff --git a/src/chrome/locale/my/network-settings.dtd b/src/chrome/locale/my/network-settings.dtd index 94deb90..8f58545 100644 --- a/src/chrome/locale/my/network-settings.dtd +++ b/src/chrome/locale/my/network-settings.dtd @@ -17,7 +17,7 @@ <!ENTITY torSettings.configure "Configure"> <!ENTITY torSettings.connectPrompt2 "I would like to make a direct connection to the Tor network."> <!ENTITY torSettings.connectPrompt3 "This will work in most situations."> -<!ENTITY torSettings.connect "Connect"> +<!ENTITY torSettings.connect "ချိတ်ဆက်ရန်"> <!ENTITY torSettings.proxyPageTitle "Local Proxy Configuration"> <!ENTITY torSettings.proxyQuestion "Does this computer need to use a local proxy to access the Internet?"> diff --git a/src/chrome/locale/my/torlauncher.properties b/src/chrome/locale/my/torlauncher.properties index ffb6021..eef9cb1 100644 --- a/src/chrome/locale/my/torlauncher.properties +++ b/src/chrome/locale/my/torlauncher.properties @@ -30,11 +30,11 @@ torlauncher.error_bridge_bad_default_type=No provided bridges that have the tran torlauncher.recommended_bridge=(အကြံပြုထားသည်) -torlauncher.connect=Connect +torlauncher.connect=ချိတ်ဆက်ရန် torlauncher.restart_tor=Restart Tor torlauncher.quit=ထွက်ရန် torlauncher.quit_win=ထွက်ရန် -torlauncher.done=Done +torlauncher.done=ပြီးပါပြီ torlauncher.forAssistance=For assistance, contact %S torlauncher.forAssistance2=For assistance, visit %S diff --git a/src/chrome/locale/ru/torlauncher.properties b/src/chrome/locale/ru/torlauncher.properties index aabbcaf..442f81b 100644 --- a/src/chrome/locale/ru/torlauncher.properties +++ b/src/chrome/locale/ru/torlauncher.properties @@ -16,10 +16,10 @@ torlauncher.unable_to_start_tor=Невозможно запустить Tor.\n\n torlauncher.tor_missing=Исполняемый файл Tor отсутствует. torlauncher.torrc_missing=torrc файл отсутствует и не может быть создан. torlauncher.datadir_missing=Директория данных Tor не существует и не может быть создана. -torlauncher.password_hash_missing=Не удаётся получить хэшированный пароль. +torlauncher.password_hash_missing=Не удается получить хэшированный пароль. -torlauncher.failed_to_get_settings=Не удаётся загрузить настройки Tor.\n\n%S -torlauncher.failed_to_save_settings=Не удаётся сохранить настройки Tor.\n\n%S +torlauncher.failed_to_get_settings=Не удается загрузить настройки Tor.\n\n%S +torlauncher.failed_to_save_settings=Не удается сохранить настройки Tor.\n\n%S torlauncher.ensure_tor_is_running=Убедитесь, что Tor запущен. torlauncher.error_proxy_addr_missing=Вы должны указать IP-адрес или имя хоста и порт, чтобы настроить Tor и использовать прокси для доступа в Интернет. diff --git a/src/chrome/locale/tr/network-settings.dtd b/src/chrome/locale/tr/network-settings.dtd index 48ead46..2d99d30 100644 --- a/src/chrome/locale/tr/network-settings.dtd +++ b/src/chrome/locale/tr/network-settings.dtd @@ -29,7 +29,7 @@ <!ENTITY torSettings.bridgeQuestion "İnternet Servis Sağlayıcınız (ISS) Tor Ağına olan bağlantıları engelliyor ya da sansürlüyor mu?"> <!ENTITY torSettings.bridgeExplanation1 "Bu sorunun yanıtından emin değilseniz, Hayır seçin (bir köprü olmadan Tor ağına bağlanamıyorsanız, daha sonra ekleyebilirsiniz)."> <!ENTITY torSettings.bridgeExplanation2 "Evet olarak seçerseniz, Tor Ağı bağlantılarını engellemeyi zorlaştıran listelenmemiş aktarıcılar olan Tor Köprülerini ayarlamanız istenir."> -<!ENTITY torSettings.bridgeSettingsPrompt "Sağlanan köprüleri kullanabilir ya da özel köprüler edinip yazabilirsiniz."> +<!ENTITY torSettings.bridgeSettingsPrompt "Hazır köprüleri kullanabilir ya da özel köprüler edinip yazabilirsiniz.">  @@ -55,7 +55,7 @@ <!ENTITY torsettings.firewall.checkbox "Bu bilgisayar yalnız belirli bağlantı noktalarına bağlanmaya izin veren bir güvenlik duvarı kullanıyor"> <!ENTITY torsettings.firewall.allowedPorts "İzin Verilen Bağlantı Noktaları:"> <!ENTITY torsettings.useBridges.checkbox "İnternet Servis Sağlayıcım (ISS) Tor ağına olan bağlantıları engelliyor"> -<!ENTITY torsettings.useBridges.default "Sağlanan köprüler ile bağlan"> +<!ENTITY torsettings.useBridges.default "Hazır köprüler ile bağlan"> <!ENTITY torsettings.useBridges.note "Her bir köprü türünde engellemeyi aşmak için farklı yöntemler kullanılır.  Bir köprü çalışmazsa farklı bir tanesini deneyin."> <!ENTITY torsettings.useBridges.type "Aktarım tür:"> <!ENTITY torsettings.useBridges.custom "Özel köprüler yazın"> @@ -65,7 +65,7 @@ <!ENTITY torsettings.copyLog "Tor Günlüğünü Panoya Kopyala"> <!ENTITY torsettings.bridgeHelpTitle "Köprü Aktarıcı Yardımı"> <!ENTITY torsettings.bridgeHelp1 "Tor ağına bağlanamıyorsanız, kullandığınız İnternet Servis Sağlayıcısı (ISS) ya da başka bir kurum Tor 'u engelliyor olabilir. Bu sorunu çoğunlukla, engellenmesi daha zor olan listelenmeyen aktarıcılar, Tor Köprülerini kullanarak çözebilirsiniz."> -<!ENTITY torsettings.bridgeHelp1B "Önceden ayarlanmış, sunulan köprü adreslerini kullanabilir ya da şu üç yöntemden biriyle özel adresler edinebilirsiniz:"> +<!ENTITY torsettings.bridgeHelp1B "Önceden ayarlanmış hazır köprü adreslerini kullanabilir ya da şu üç yöntemden biriyle özel adresler edinebilirsiniz:"> <!ENTITY torsettings.bridgeHelp2Heading "Web yoluyla"> <!ENTITY torsettings.bridgeHelp2 "Bir web tarayıcısı kullanarak https://bridges.torproject.org adresini ziyaret edin"> <!ENTITY torsettings.bridgeHelp3Heading "Otomatik e-posta yanıtı yoluyla"> diff --git a/src/chrome/locale/tr/torlauncher.properties b/src/chrome/locale/tr/torlauncher.properties index d0f43b2..e2a343d 100644 --- a/src/chrome/locale/tr/torlauncher.properties +++ b/src/chrome/locale/tr/torlauncher.properties @@ -25,8 +25,8 @@ torlauncher.ensure_tor_is_running=Lütfen Tor'un çalıştığından emin olun. torlauncher.error_proxy_addr_missing=İnternet'e bir vekil sunucu üzerinden bağlanmak için bir IP adresi ya da sunucu adı ile bağlantı noktası numarasının yazılması gereklidir. torlauncher.error_proxy_type_missing=Vekil sunucu türünü seçmelisiniz. torlauncher.error_bridges_missing=Bir ya da birkaç köprü belirtmelisiniz. -torlauncher.error_default_bridges_type_missing=Sağlanan köprüler için bir aktarım türü seçmelisiniz. -torlauncher.error_bridge_bad_default_type=Sağlanan köprüler %S aktarım türü için kullanılamıyor. Lütfen ayarlarınızı değiştirin. +torlauncher.error_default_bridges_type_missing=Hazır köprüler için bir aktarım türü seçmelisiniz. +torlauncher.error_bridge_bad_default_type=Hazır köprüler %S aktarım türü için kullanılamıyor. Lütfen ayarlarınızı değiştirin. torlauncher.recommended_bridge=(önerilir)

1 0

[tor-browser-build/master] Bug 23384: Add user mcs on build-sunet-a.torproject.net
by boklm＠torproject.org 21 Sep '17

21 Sep '17

commit 99894080a6fd28f95666422877038a69c8df5433 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Sep 21 13:07:30 2017 +0200 Bug 23384: Add user mcs on build-sunet-a.torproject.net --- tools/ansible/roles/tbb-team/defaults/main.yml | 1 + tools/ansible/roles/tbb-team/files/mcs.pub | 1 + 2 files changed, 2 insertions(+) diff --git a/tools/ansible/roles/tbb-team/defaults/main.yml b/tools/ansible/roles/tbb-team/defaults/main.yml index 475acca..fff2def 100644 --- a/tools/ansible/roles/tbb-team/defaults/main.yml +++ b/tools/ansible/roles/tbb-team/defaults/main.yml @@ -2,3 +2,4 @@ tbb_team_members: - boklm - gk + - mcs diff --git a/tools/ansible/roles/tbb-team/files/mcs.pub b/tools/ansible/roles/tbb-team/files/mcs.pub new file mode 100644 index 0000000..669c324 --- /dev/null +++ b/tools/ansible/roles/tbb-team/files/mcs.pub @@ -0,0 +1 @@ +ssh key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDipHBalbwyEb0AWwbRPa+pxGGSyFTkoOtyn76AqTD6WZIJKBBe4PkkqkJOI7STWxwVkbzTZoC1UyzUCXc3L/bxt85bopAgg0EucM3z3t6XX3kbaDPEGi+mhA4lFYdpJmWe1wbDhiAMYSAONnVcRgmk6bPkgRBWM5zCshOOS5/hs1HW6/zOzgJX6+B7vLYiccHkRj9YeOln+OyR+ko1nFovBFIeDw5DjZqNHki0/hBe1SpaBKCUWHBwkugmvI3Q/VL5pQhWAcMwqEmEcosmX5SPBsAn8217u0mPLcW2cAx30Yj95lfO3LzOV27dnqYfT0IN4gysm2S9Z0mV7yMgSkgV mcs

1 0