November 2016 - tor-commits - lists.torproject.org

[sandboxed-tor-browser/master] On second thought, locking the private browsing pref is silly.
by yawning＠torproject.org 28 Nov '16

28 Nov '16

commit 1a281b3309d58c0ee865525f8e730d86ffb4ba3a Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Nov 28 08:34:58 2016 +0000 On second thought, locking the private browsing pref is silly. People should be allowed to toggle this, assuming they understand the consequences. --- data/installer/mozilla.cfg | 3 --- 1 file changed, 3 deletions(-) diff --git a/data/installer/mozilla.cfg b/data/installer/mozilla.cfg index 81f5e9a..0943a24 100644 --- a/data/installer/mozilla.cfg +++ b/data/installer/mozilla.cfg @@ -16,6 +16,3 @@ lockPref("extensions.torbutton.versioncheck_enabled", false); // Disable extension auto update. lockPref("extensions.update.enabled", false); lockPref("extensions.update.autoUpdateDefault", false); - -// Force private browsing mode to remain set. -lockPref("browser.privatebrowsing.autostart", true);

1 0

[sandboxed-tor-browser/master] Bug #20773: Mount `/proc` in the tor container for hardened.
by yawning＠torproject.org 28 Nov '16

28 Nov '16

commit 09b66528f6013c0ca5ee9be20ad91cadb3e901aa Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Nov 28 08:22:03 2016 +0000 Bug #20773: Mount `/proc` in the tor container for hardened. Asan requires `/proc/self/maps` to run. Fun fun fun. --- src/cmd/sandboxed-tor-browser/internal/sandbox/application.go | 9 +++++++-- src/cmd/sandboxed-tor-browser/internal/ui/ui.go | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go index 22c43ee..26baeef 100644 --- a/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go @@ -441,7 +441,7 @@ func stageUpdate(updateDir, installDir string, mar []byte) error { } // RunTor launches sandboxeed Tor. -func RunTor(cfg *config.Config, torrc []byte) (cmd *exec.Cmd, err error) { +func RunTor(cfg *config.Config, manif *config.Manifest, torrc []byte) (cmd *exec.Cmd, err error) { defer func() { if r := recover(); r != nil { err = fmt.Errorf("%v", r) @@ -473,8 +473,13 @@ func RunTor(cfg *config.Config, torrc []byte) (cmd *exec.Cmd, err error) { // `/proc/sys/net/core/somaxconn` - obfs4proxy, Go runtime uses this to // determine listener backlog, but will default to `128` on errors. // + // Hardened builds are special cased because asan crashes the binary + // if it can't read `/proc/self/maps`. + // // See: https://bugs.torproject.org/20773 - h.mountProc = false + if manif.Channel != "hardened" { + h.mountProc = false + } if err = os.MkdirAll(cfg.TorDataDir, DirMode); err != nil { return diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go index 80588de..b2ca8ee 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go @@ -282,7 +282,7 @@ func (c *Common) launchTor(async *Async, onlySystem bool) (dialFunc, error) { os.Remove(filepath.Join(c.Cfg.TorDataDir, "control_port")) async.UpdateProgress("Launching Tor executable.") - cmd, err := sandbox.RunTor(c.Cfg, torrc) + cmd, err := sandbox.RunTor(c.Cfg, c.Manif, torrc) if err != nil { async.Err = err return nil, err

1 0

[translation/tails-greeter-2] Update translations for tails-greeter-2
by translation＠torproject.org 28 Nov '16

28 Nov '16

commit 6cbe0fbc3b01804368b8908f46c04f58af07ae5c Author: Translation commit bot <translation(a)torproject.org> Date: Mon Nov 28 08:18:10 2016 +0000 Update translations for tails-greeter-2 --- hr_HR/hr_HR.po | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/hr_HR/hr_HR.po b/hr_HR/hr_HR.po index 07f58f0..df5da27 100644 --- a/hr_HR/hr_HR.po +++ b/hr_HR/hr_HR.po @@ -20,7 +20,7 @@ msgstr "" #: ../data/greeter.ui.h:1 msgid "Administration Password" -msgstr "" +msgstr "Administratorska lozinka" #: ../data/greeter.ui.h:2 msgid "" @@ -28,22 +28,25 @@ msgid "" "tasks. Otherwise, the administration password is disabled for better " "security." msgstr "" +"Postavite administratorsku lozinku ako trebate izvoditi administratorske " +"zadatke. U suprotnom, administratorska lozinka će biti onemogućena zbog " +"bolje sigurnosti." #: ../data/greeter.ui.h:3 msgid "Enter an administration password" -msgstr "" +msgstr "Unesite administratorsku lozinku" #: ../data/greeter.ui.h:4 msgid "Confirm" -msgstr "" +msgstr "Potvrdi" #: ../data/greeter.ui.h:5 msgid "Confirm your administration password" -msgstr "" +msgstr "Potvrdite svoju administratorsku lozinku" #: ../data/greeter.ui.h:6 msgid "Disable" -msgstr "" +msgstr "Onemogući" #: ../data/greeter.ui.h:7 msgid "Windows Camouflage" @@ -54,14 +57,16 @@ msgid "" "This option makes Tails look like Microsoft Windows 10. This can be useful " "to avoid attracting suspiction in public places." msgstr "" +"Ova opcija maskira Tails da izgleda kao Windows 10. Ta opcija može biti " +"korisna kako bi izbjegli sumnju na javnim mjestima." #: ../data/greeter.ui.h:9 msgid "Microsoft Windows 10 camouflage" -msgstr "" +msgstr "Microsoft Windows 10 kamuflaža" #: ../data/greeter.ui.h:10 msgid "MAC Address Spoofing" -msgstr "" +msgstr "Maskiranje MAC adrese" #: ../data/greeter.ui.h:11 msgid ""

1 0

[sandboxed-tor-browser/master] Don't attempt to use the flatpak-bwrap to statisfy bubblewrap for now.
by yawning＠torproject.org 28 Nov '16

28 Nov '16

commit 1bdce61925564ca0c688377c196268ce97b5402b Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Nov 28 06:11:43 2016 +0000 Don't attempt to use the flatpak-bwrap to statisfy bubblewrap for now. WHile the idea is nice in theory, `flatpak-bwrap --version` reports the flatpak version, so I'd need to keep a covnersion table or something to ensure I can do accurate bwrap version/feature detection. --- src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go | 1 - 1 file changed, 1 deletion(-) diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go index 6f7528e..0707c57 100644 --- a/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go @@ -388,7 +388,6 @@ func newHugbox() (*hugbox, error) { // Look for the bwrap binary in sensible locations. bwrapPaths := []string{ "/usr/bin/bwrap", - "/usr/lib/flatpak/flatpak-bwrap", // Arch Linux "flatpak" package. } for _, v := range bwrapPaths { if FileExists(v) {

1 0

[sandboxed-tor-browser/master] Bug #20804: Temporarily kludge around the async/UI issue.
by yawning＠torproject.org 27 Nov '16

27 Nov '16

commit 22c94991236e6dff096e29fbb6e74c5a1d20c912 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Nov 28 02:56:54 2016 +0000 Bug #20804: Temporarily kludge around the async/UI issue. The ui code's async stuff (and all the code that uses it) is kind of a kludgy mess, and is race codnition prone particularly when handling cancelation. Work around the issue for now, till I have time to fix it properly by increasing channel capacity a tad. --- src/cmd/sandboxed-tor-browser/internal/ui/async/async.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/async/async.go b/src/cmd/sandboxed-tor-browser/internal/ui/async/async.go index 83bbcae..5a894d2 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/async/async.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/async/async.go @@ -98,9 +98,13 @@ func (async *Async) Grab(client *grab.Client, url string, hzFn func(string)) []b // NewAsync creates a new Async structure. func NewAsync() *Async { + // XXX; Temporarily work around bug #20804, by oversizing + // the channels a bit. Things end up getting stuck on channel + // writes because it's kludged together, this should ensure that + // the writes succeed. async := new(Async) - async.Cancel = make(chan interface{}) - async.Done = make(chan interface{}) + async.Cancel = make(chan interface{}, 2) + async.Done = make(chan interface{}, 2) async.ToUI = make(chan interface{}) return async }

1 0

[sandboxed-tor-browser/master] Remove the old `control_port` file before launcing a tor.
by yawning＠torproject.org 27 Nov '16

27 Nov '16

commit 0ba177e4136ea2459741a5de283d6ada6c3b8d63 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Nov 28 02:38:22 2016 +0000 Remove the old `control_port` file before launcing a tor. --- src/cmd/sandboxed-tor-browser/internal/ui/ui.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go index b25e397..80588de 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go @@ -279,6 +279,8 @@ func (c *Common) launchTor(async *Async, onlySystem bool) (dialFunc, error) { return nil, err } + os.Remove(filepath.Join(c.Cfg.TorDataDir, "control_port")) + async.UpdateProgress("Launching Tor executable.") cmd, err := sandbox.RunTor(c.Cfg, torrc) if err != nil {

1 0

[sandboxed-tor-browser/master] Clean up tor's socket files on Shutdown().
by yawning＠torproject.org 27 Nov '16

27 Nov '16

commit 7a215efea0d6277d24c700b2b4e629a93b1cac45 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Nov 28 02:25:37 2016 +0000 Clean up tor's socket files on Shutdown(). --- src/cmd/sandboxed-tor-browser/internal/tor/tor.go | 11 ++++++++++- src/cmd/sandboxed-tor-browser/internal/ui/install.go | 2 +- src/cmd/sandboxed-tor-browser/internal/ui/launch.go | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/src/cmd/sandboxed-tor-browser/internal/tor/tor.go b/src/cmd/sandboxed-tor-browser/internal/tor/tor.go index 64a9fd9..58b34d0 100644 --- a/src/cmd/sandboxed-tor-browser/internal/tor/tor.go +++ b/src/cmd/sandboxed-tor-browser/internal/tor/tor.go @@ -62,10 +62,13 @@ type Tor struct { socksNet string socksAddr string + ctrlAddr string ctrlSurrogate *ctrlProxy socksSurrogate *socksProxy socksPassthrough *passthroughProxy + + unlinkOnExit []string } // IsSystem returns if the tor instance is a OS service not being actively @@ -176,6 +179,10 @@ func (t *Tor) Shutdown() { t.socksPassthrough.close() t.socksPassthrough = nil } + + for _, fn := range t.unlinkOnExit { + os.Remove(fn) + } } // SocksSurrogatePath returns the socks port surrogate AF_UNIX path. @@ -266,7 +273,9 @@ func NewSandboxedTor(cfg *config.Config, cmd *exec.Cmd) *Tor { t.cmd = cmd t.socksNet = "unix" t.socksAddr = filepath.Join(cfg.TorDataDir, "socks") + t.ctrlAddr = filepath.Join(cfg.TorDataDir, "control") t.ctrlEvents = make(chan *bulb.Response, 16) + t.unlinkOnExit = []string{t.socksAddr, t.ctrlAddr} return t } @@ -307,7 +316,7 @@ func (t *Tor) DoBootstrap(cfg *config.Config, async *Async) (err error) { // Dial the control port. async.UpdateProgress("Connecting to the Tor Control Port.") - if t.ctrl, err = bulb.Dial("unix", filepath.Join(cfg.TorDataDir, "control")); err != nil { + if t.ctrl, err = bulb.Dial("unix", t.ctrlAddr); err != nil { return err } diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/install.go b/src/cmd/sandboxed-tor-browser/internal/ui/install.go index 208e019..16bde15 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/install.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/install.go @@ -43,7 +43,7 @@ func (c *Common) DoInstall(async *Async) { async.Err = nil defer func() { if len(async.Cancel) > 0 { - <- async.Cancel + <-async.Cancel } if async.Err != nil { log.Printf("install: Failing with error: %v", async.Err) diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/launch.go b/src/cmd/sandboxed-tor-browser/internal/ui/launch.go index 56c0f54..6a86dba 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/launch.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/launch.go @@ -32,7 +32,7 @@ func (c *Common) DoLaunch(async *Async, checkUpdates bool) { async.Err = nil defer func() { if len(async.Cancel) > 0 { - <- async.Cancel + <-async.Cancel } if async.Err != nil { log.Printf("launch: Failing with error: %v", async.Err)

1 0

[sandboxed-tor-browser/master] Handle bubblewrap crashing/exiting mid-setup.
by yawning＠torproject.org 27 Nov '16

27 Nov '16

commit 7bb33aba93ad767c13be9776bb0e90eeb771db4f Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Nov 28 02:03:34 2016 +0000 Handle bubblewrap crashing/exiting mid-setup. --- .../internal/sandbox/hugbox.go | 103 ++++++++++++++------- 1 file changed, 70 insertions(+), 33 deletions(-) diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go index 8ecafa1..6f7528e 100644 --- a/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go @@ -28,6 +28,7 @@ import ( "strconv" "strings" "syscall" + "time" "cmd/sandboxed-tor-browser/internal/data" . "cmd/sandboxed-tor-browser/internal/utils" @@ -283,47 +284,83 @@ func (h *hugbox) run() (*exec.Cmd, error) { // Fork/exec. cmd.Start() - // Flush the pending writes. - for i, wrFd := range pendingWriteFds { - d := pendingWrites[i] - if err := writeBuffer(wrFd, d); err != nil { - cmd.Process.Kill() - return nil, err + // Do the rest of the setup in a go routine, and monitor completion and + // a watchdog timer. + doneCh := make(chan error) + bwrapPid := cmd.Process.Pid + hz := time.NewTicker(1 * time.Second) + defer hz.Stop() + + go func() { + // Flush the pending writes. + for i, wrFd := range pendingWriteFds { + d := pendingWrites[i] + if err := writeBuffer(wrFd, d); err != nil { + doneCh <- err + return + } + cmd.ExtraFiles = cmd.ExtraFiles[1:] } - cmd.ExtraFiles = cmd.ExtraFiles[1:] - } - // Write the seccomp rules. - if h.seccompFn != nil { - // This should be the one and only remaining extra file. - if len(cmd.ExtraFiles) != 2 { - panic("sandbox: unexpected extra files when writing seccomp rules") - } else if seccompWrFd == nil { - panic("sandbox: missing fd when writing seccomp rules") + // Write the seccomp rules. + if h.seccompFn != nil { + // This should be the one and only remaining extra file. + if len(cmd.ExtraFiles) != 2 { + panic("sandbox: unexpected extra files when writing seccomp rules") + } else if seccompWrFd == nil { + panic("sandbox: missing fd when writing seccomp rules") + } + if err := h.seccompFn(seccompWrFd); err != nil { + doneCh <- err + return + } + cmd.ExtraFiles = cmd.ExtraFiles[1:] + } else if seccompWrFd != nil { + panic("sandbox: seccomp fd exists when there are no rules to be written") } - if err := h.seccompFn(seccompWrFd); err != nil { - cmd.Process.Kill() - return nil, err + + // Read back the child pid. + decoder := json.NewDecoder(infoRdFd) + info := &bwrapInfo{} + if err := decoder.Decode(info); err != nil { + doneCh <- err + return } - cmd.ExtraFiles = cmd.ExtraFiles[1:] - } else if seccompWrFd != nil { - panic("sandbox: seccomp fd exists when there are no rules to be written") - } - // Read back the child pid. - decoder := json.NewDecoder(infoRdFd) - info := &bwrapInfo{} - if err := decoder.Decode(info); err != nil { - return nil, err - } + Debugf("sandbox: bwrap pid is: %v", cmd.Process.Pid) + Debugf("sandbox: child pid is: %v", info.Pid) - Debugf("sandbox: bwrap pid is: %v", cmd.Process.Pid) - Debugf("sandbox: child pid is: %v", info.Pid) + // This is more useful to us, since it's fork of bubblewrap that will + // execvp. + cmd.Process.Pid = info.Pid + + doneCh <- nil + }() - // This is more useful to us. - cmd.Process.Pid = info.Pid + err := fmt.Errorf("sandbox: timeout waiting for bubblewrap to start") +timeoutLoop: + for nTicks := 0; nTicks < 10; { // 10 second timeout, probably excessive. + select { + case err = <-doneCh: + if err == nil { + return cmd, nil + } + break timeoutLoop + case <-hz.C: + var wstatus syscall.WaitStatus + _, err = syscall.Wait4(bwrapPid, &wstatus, syscall.WNOHANG, nil) + if err != nil { + break timeoutLoop + } else if wstatus.Exited() { + err = fmt.Errorf("sandbox: bubblewrap exited unexpectedly") + break timeoutLoop + } + nTicks++ + } + } - return cmd, nil + cmd.Process.Kill() + return nil, err } type bwrapInfo struct {

1 0

[sandboxed-tor-browser/master] Consume the cancel channel in various async tasks on return.
by yawning＠torproject.org 27 Nov '16

27 Nov '16

commit 2c013e8d052854760fab439651e721bd371f22eb Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Sun Nov 27 21:03:11 2016 +0000 Consume the cancel channel in various async tasks on return. This should make the various progress dialog cancel buttons more responsive. --- src/cmd/sandboxed-tor-browser/internal/ui/install.go | 3 +++ src/cmd/sandboxed-tor-browser/internal/ui/launch.go | 3 +++ 2 files changed, 6 insertions(+) diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/install.go b/src/cmd/sandboxed-tor-browser/internal/ui/install.go index bc062f2..208e019 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/install.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/install.go @@ -42,6 +42,9 @@ func (c *Common) DoInstall(async *Async) { var err error async.Err = nil defer func() { + if len(async.Cancel) > 0 { + <- async.Cancel + } if async.Err != nil { log.Printf("install: Failing with error: %v", async.Err) } else { diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/launch.go b/src/cmd/sandboxed-tor-browser/internal/ui/launch.go index bb80ceb..56c0f54 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/launch.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/launch.go @@ -31,6 +31,9 @@ import ( func (c *Common) DoLaunch(async *Async, checkUpdates bool) { async.Err = nil defer func() { + if len(async.Cancel) > 0 { + <- async.Cancel + } if async.Err != nil { log.Printf("launch: Failing with error: %v", async.Err) if c.tor != nil {

1 0

[sandboxed-tor-browser/master] Add/fix a few more calls to the tor seccomp whitelist.
by yawning＠torproject.org 27 Nov '16

27 Nov '16

commit e2944e6c38892567b9f0f4af09e0ecb02c0ec300 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Sun Nov 27 20:48:18 2016 +0000 Add/fix a few more calls to the tor seccomp whitelist. --- data/tor-whitelist.seccomp | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/data/tor-whitelist.seccomp b/data/tor-whitelist.seccomp index 72b6694..35e35db 100644 --- a/data/tor-whitelist.seccomp +++ b/data/tor-whitelist.seccomp @@ -6,6 +6,7 @@ SIG_BLOCK=1 SIG_SETMASK=2 MREMAP_MAYMOVE=1 PF_LOCAL=AF_LOCAL +POLLIN=1 # The tor stage 1 set. access: 1 @@ -21,6 +22,7 @@ pipe: 1 fcntl: 1 fstat: 1 # fstat64: 1 +getdents: 1 getdents64: 1 getegid: 1 # getegid32: 1 @@ -76,7 +78,7 @@ flock: arg1 == (LOCK_EX | LOCK_NB) || arg1 == LOCK_UN # FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME || FUTEX_WAKE_PRIVATE || FUTEX_WAIT_PRIVATE futex: arg1 == 393 || arg1 == 128 || arg1 == 129 mremap: arg3 == MREMAP_MAYMOVE -poll: arg1 == 2 && arg2 == 10 +poll: arg1 == POLLIN && arg2 == 10 socket: arg0 == AF_UNIX || arg0 == AF_INET || arg0 == AF_INET6 || arg0 == AF_NETLINK setsockopt: arg1 == SOL_SOCKET && (arg2 == SO_REUSEADDR || arg2 == SO_SNDBUF || arg2 == SO_RCVBUF) getsockopt: arg1 == SOL_SOCKET && arg2 == SO_ERROR @@ -112,6 +114,6 @@ getpid: 1 kill: 1 execve: 1 restart_syscall: 1 - -# Things we may eventually need, that are disabled for now. -# * set_tid_address - If tor ever uses pthread_join() +set_tid_address: 1 +chdir: 1 +umask: arg0 == 022

1 0