April 2017 - tor-commits - lists.torproject.org

[sandboxed-tor-browser/master] Bug 21764: Use bubblewrap's `--die-with-parent` when supported.
by yawning＠torproject.org 13 Apr '17

13 Apr '17

commit 66aaf6fea4293fdb0f9f233ea612e3b53efc4172 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Thu Apr 13 07:58:01 2017 +0000 Bug 21764: Use bubblewrap's `--die-with-parent` when supported. Tor Browser nightly (ESR52, e10s) doesn't exit cleanly when SIGINT is sent to `sandboxed-tor-browser` without this. Unfortunately the option requires bubblewrap >= 0.1.8, but at least exiting firefox normally works fine with older bubblewrap. --- ChangeLog | 1 + .../internal/sandbox/hugbox.go | 86 +++++++++++++--------- 2 files changed, 51 insertions(+), 36 deletions(-) diff --git a/ChangeLog b/ChangeLog index 92ce6c0..d634264 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,5 @@ Changes in version 0.0.5 - UNRELEASED: + * Bug 21764: Use bubblewrap's `--die-with-parent` when supported. * Fix e10s Web Content crash on systems with grsec kernels. * Add `prlimit64` to the firefox system call whitelist. diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go index 118b7a7..dd2e51a 100644 --- a/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go @@ -91,9 +91,10 @@ type hugbox struct { // Internal options, not to be *modified* except via helpers, unless you // know what you are doing. - bwrapPath string - args []string - fileData [][]byte + bwrapPath string + bwrapVersion *bwrapVersion + args []string + fileData [][]byte runtimeDir string // Set at creation time. } @@ -244,6 +245,12 @@ func (h *hugbox) run() (*Process, error) { h.file("/etc/passwd", []byte(passwdBody)) h.file("/etc/group", []byte(groupBody)) + dieWithParent := h.bwrapVersion.atLeast(0, 1, 8) + if dieWithParent { + Debugf("sandbox: bubblewrap supports `--die-with-parent`.") + fdArgs = append(fdArgs, "--die-with-parent") + } + if h.fakeDbus { h.setupDbus() } @@ -421,23 +428,47 @@ func newHugbox() (*hugbox, error) { return nil, fmt.Errorf("sandbox: unable to find bubblewrap binary") } - // Bubblewrap <= 0.1.2-2 (in Debian terms, 0.1.3 for the rest of us), is - // a really bad idea because I'm a retard, and didn't expect bubblewrap - // to be ptrace-able when I contributed support for the hostname. - // - // There is a CVE for it. Sensible people have made 0.1.3 available, - // including jessie-backports. Ubuntu is still shipping an old version. - // Sucks to be them. - if ok, err := bubblewrapAtLeast(h.bwrapPath, 0, 1, 3); err != nil { + // Query and cache the bubblewrap version. + var err error + if h.bwrapVersion, err = getBwrapVersion(h.bwrapPath); err != nil { return nil, err - } else if !ok { - return nil, fmt.Errorf("sandbox: bubblewrap appears to be older than 0.1.3, you MUST upgrade.") + } else { + Debugf("sandbox: bubblewrap '%v' detected.", h.bwrapVersion) + + // Bubblewrap <= 0.1.2-2 (in Debian terms, 0.1.3 for the rest of us), + // is a really bad idea because I'm a retard, and didn't expect + // bubblewrap to be ptrace-able when I contributed support for setting + // the hostname. + if !h.bwrapVersion.atLeast(0, 1, 3) { + return nil, fmt.Errorf("sandbox: bubblewrap appears to be older than 0.1.3, you MUST upgrade.") + } } return h, nil } -func getBubblewrapVersion(f string) (int, int, int, error) { +type bwrapVersion struct { + maj, min, pl int +} + +func (v *bwrapVersion) atLeast(maj, min, pl int) bool { + if v.maj > maj { + return true + } + if v.maj == maj && v.min > min { + return true + } + if v.maj == maj && v.min == min && v.pl >= pl { + return true + } + return false +} + +func (v *bwrapVersion) String() string { + return fmt.Sprintf("%d.%d.%d", v.maj, v.min, v.pl) +} + +func getBwrapVersion(f string) (*bwrapVersion, error) { cmd := &exec.Cmd{ Path: f, Args: []string{f, "--version"}, @@ -448,7 +479,7 @@ func getBubblewrapVersion(f string) (int, int, int, error) { } out, err := cmd.CombinedOutput() if err != nil { - return 0, 0, 0, fmt.Errorf("sandbox: failed to query bubblewrap version: %v", string(out)) + return nil, fmt.Errorf("sandbox: failed to query bubblewrap version: %v", string(out)) } vStr := strings.TrimPrefix(string(out), "bubblewrap ") vStr = strings.TrimSpace(vStr) @@ -456,37 +487,20 @@ func getBubblewrapVersion(f string) (int, int, int, error) { // Split into major/minor/pl. v := strings.Split(vStr, ".") if len(v) < 3 { - return 0, 0, 0, fmt.Errorf("unable to determine bubblewrap version") + return nil, fmt.Errorf("unable to determine bubblewrap version") } + // Parse the version. var iVers [3]int for i := 0; i < 3; i++ { iv, err := strconv.Atoi(v[i]) if err != nil { - return 0, 0, 0, fmt.Errorf("unable to determine bubblewrap version: %v", err) + return nil, fmt.Errorf("unable to parse bubblewrap version: %v", err) } iVers[i] = iv } - return iVers[0], iVers[1], iVers[2], nil -} - -func bubblewrapAtLeast(f string, maj, min, pl int) (bool, error) { - iMaj, iMin, iPl, err := getBubblewrapVersion(f) - if err != nil { - return false, err - } - - if iMaj > maj { - return true, nil - } - if iMaj == maj && iMin > min { - return true, nil - } - if iMaj == maj && iMin == min && iPl >= pl { - return true, nil - } - return false, nil + return &bwrapVersion{maj: iVers[0], min: iVers[1], pl: iVers[2]}, nil } func writeBuffer(w io.WriteCloser, contents []byte) error {

1 0

[tor-browser-bundle/master] Bug 21930: NSS libraries are missing from mar-tools archive
by gk＠torproject.org 13 Apr '17

13 Apr '17

commit c2bae45c6a41923712bf176df6fb9bd1f773d887 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Apr 12 23:15:28 2017 -0400 Bug 21930: NSS libraries are missing from mar-tools archive The Linux sigmar program needs libfreeblpriv3.so and libsoftokn3.so, so include them in the mar-tools archive. --- gitian/descriptors/linux/gitian-firefox.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index d607f6a..c9ced44 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -119,7 +119,7 @@ script: | cp -p obj-*/dist/host/bin/mbsdiff $MARTOOLS/ cp -p obj-*/modules/libmar/tool/signmar $MARTOOLS/ cp -p obj-*/security/nss/cmd/certutil/certutil $MARTOOLS/ - NSS_LIBS="libmozsqlite3.so libnss3.so libnssdbm3.so libnssutil3.so libsmime3.so libssl3.so" + NSS_LIBS="libfreeblpriv3.so libmozsqlite3.so libnss3.so libnssdbm3.so libnssutil3.so libsmime3.so libsoftokn3.so libssl3.so" NSPR_LIBS="libnspr4.so libplc4.so libplds4.so" for LIB in $NSS_LIBS $NSPR_LIBS; do cp -p obj-*/dist/bin/$LIB $MARTOOLS/

1 0

[sandboxed-tor-browser/master] Fix e10s Web Content crash on systems with grsec kernels.
by yawning＠torproject.org 12 Apr '17

12 Apr '17

commit a9a3ab621ed72fb1c836d9e224be7b42f4445b90 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Apr 12 22:19:26 2017 +0000 Fix e10s Web Content crash on systems with grsec kernels. The `plugin-container` binary needs to be able to make RWX mappings, or Web Content workers get killed by the kernel. --- ChangeLog | 1 + .../internal/sandbox/application.go | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3e55844..1007ae3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,5 @@ Changes in version 0.0.5 - UNRELEASED: + * Fix e10s Web Content crash on systems with grsec kernels. Changes in version 0.0.4 - 2017-04-12: * Bug 21928: Force a reinstall if an existing hardened bundle is present. diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go index 427c3b1..bf2914a 100644 --- a/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go @@ -190,8 +190,15 @@ func RunTorBrowser(cfg *config.Config, manif *config.Manifest, tor *tor.Tor) (pr // Tor Browser currently is incompatible with PaX MPROTECT, apply the // override if needed. realFirefoxPath := filepath.Join(realBrowserHome, "firefox") - if err = applyPaXAttributes(manif, realFirefoxPath); err != nil { - return nil, err + needsPaXPaths := []string{ + realFirefoxPath, + filepath.Join(realBrowserHome, "plugin-container"), + } + for _, p := range needsPaXPaths { + err := applyPaXAttributes(manif, p) + if err != nil { + log.Printf("sandbox: Failed to apply PaX attributes to `%v`: %v", p, err) + } } extraLdLibraryPath := "" @@ -329,11 +336,12 @@ func applyPaXAttributes(manif *config.Manifest, f string) error { const paxAttr = "user.pax.flags" sz, _ := syscall.Getxattr(f, paxAttr, nil) + _, n := filepath.Split(f) // Strip off the attribute if this is a non-grsec kernel. if !IsGrsecKernel() { if sz > 0 { - log.Printf("sandbox: Removing Tor Browser PaX attributes.") + log.Printf("sandbox: Removing PaX attributes: %v", n) syscall.Removexattr(f, paxAttr) } return nil @@ -346,12 +354,12 @@ func applyPaXAttributes(manif *config.Manifest, f string) error { return err } if bytes.Contains(dest, paxOverride) { - log.Printf("sandbox: Tor Browser PaX attributes already set.") + log.Printf("sandbox: PaX attributes already set: %v", n) return nil } } - log.Printf("sandbox: Applying Tor Browser PaX attributes.") + log.Printf("sandbox: Applying PaX attributes: %v", n) return syscall.Setxattr(f, paxAttr, paxOverride, 0) }

1 0

[sandboxed-tor-browser/master] Add `prlimit64` to the firefox system call whitelist.
by yawning＠torproject.org 12 Apr '17

12 Apr '17

commit 161de9f58ff7c8783cb019e7c806047976a45eb7 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Apr 12 22:21:09 2017 +0000 Add `prlimit64` to the firefox system call whitelist. ESR52 calls it, and I don't have the time to check every instance to see if returning ENOSYS is acceptable. --- ChangeLog | 1 + data/torbrowser-amd64.seccomp | 1 + 2 files changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 1007ae3..92ce6c0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,6 @@ Changes in version 0.0.5 - UNRELEASED: * Fix e10s Web Content crash on systems with grsec kernels. + * Add `prlimit64` to the firefox system call whitelist. Changes in version 0.0.4 - 2017-04-12: * Bug 21928: Force a reinstall if an existing hardened bundle is present. diff --git a/data/torbrowser-amd64.seccomp b/data/torbrowser-amd64.seccomp index 11e42e5..17be3d7 100644 --- a/data/torbrowser-amd64.seccomp +++ b/data/torbrowser-amd64.seccomp @@ -151,6 +151,7 @@ getuid: 1 geteuid: 1 getgid: 1 getegid: 1 +prlimit64: 1 rt_sigaction: 1 rt_sigprocmask: 1 rt_sigreturn: 1

1 0

[tor-browser-bundle/maint-6.5] Release preparations for 6.5.1
by gk＠torproject.org 12 Apr '17

12 Apr '17

commit 6e7d7a00118e4416f341ce0ff160a427f1319534 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 12 20:13:35 2017 +0000 Release preparations for 6.5.1 Version updates, changelog update, and config.yml changes --- Bundle-Data/Docs/ChangeLog.txt | 11 +++++++++++ gitian/versions | 12 ++++++------ tools/update-responses/config.yml | 10 +++++----- 3 files changed, 22 insertions(+), 11 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 5438022..c8d6fcc 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,14 @@ +Tor Browser 6.5.2 -- April 19 2017 + * All Platforms + * Update Firefox to 45.9.0esr + * Update HTTPS-Everywhere to 5.2.14 + * Update NoScript to 5.0.2 + * Bug 21555+16450: Don't remove Authorization header on subdomains (e.g. Twitter) + * Bug 21917: Add new obfs4 bridges + * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend + * Windows + * Bug 21795: Fix Tor Browser crashing on github.com + Tor Browser 6.5.1 -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr diff --git a/gitian/versions b/gitian/versions index df49b55..1557a98 100755 --- a/gitian/versions +++ b/gitian/versions @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.8.0esr +FIREFOX_VERSION=45.9.0esr TORBROWSER_UPDATE_CHANNEL=release -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.5-2-build1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.5-1-build1 TOR_TAG=tor-0.2.9.10 TORLAUNCHER_TAG=0.2.10.3 TORBUTTON_TAG=1.9.6.14 -HTTPSE_TAG=5.2.11 +HTTPSE_TAG=5.2.14 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -47,7 +47,7 @@ GITIAN_TAG=tor-browser-builder-4-1 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build3 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=r247539 @@ -68,7 +68,7 @@ NSIS_VER=2.51 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.5.3-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.2-fx+sm.xpi TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -102,7 +102,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=ce9779a3a5a2574b958f8e4d079a99d43a8f84193bef52c587c704ed81c2fbbd +NOSCRIPT_HASH=31ba7743699deefb606bcc49197d26d926f6b4e3d3526cd2f8a339f857a04fb1 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 2db2570..c43932f 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,13 +20,13 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 6.5a6 - release: 6.5.1 + release: 6.5.2 versions: - 6.5.1: - platformVersion: 45.8.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-651-released + 6.5.2: + platformVersion: 45.9.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-652-released incremental_from: - - 6.5 + - 6.5.1 migrate_archs: osx32: osx64 migrate_langs:

1 0

[sandboxed-tor-browser/master] Bump the version to 0.0.5-dev, so I can do development again.
by yawning＠torproject.org 12 Apr '17

12 Apr '17

commit c4f61e08570bdc2fcd4af676e30567ef2d64b124 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Apr 12 19:57:35 2017 +0000 Bump the version to 0.0.5-dev, so I can do development again. --- ChangeLog | 2 ++ data/version | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 8089660..3e55844 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,5 @@ +Changes in version 0.0.5 - UNRELEASED: + Changes in version 0.0.4 - 2017-04-12: * Bug 21928: Force a reinstall if an existing hardened bundle is present. * Bug 21929: Remove hardened/ASAN related code. diff --git a/data/version b/data/version index 81340c7..ccf3e96 100644 --- a/data/version +++ b/data/version @@ -1 +1 @@ -0.0.4 +0.0.5-dev

1 0

[sandboxed-tor-browser/master] Do the release ritual for sandboxed-tor-browser-0.0.4.
by yawning＠torproject.org 12 Apr '17

12 Apr '17

commit 392f800725baa39c860c77136cf42d54a204bd30 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Apr 12 19:54:29 2017 +0000 Do the release ritual for sandboxed-tor-browser-0.0.4. --- ChangeLog | 2 +- data/version | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index f289b6d..8089660 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -Changes in version 0.0.4 - UNRELEASED: +Changes in version 0.0.4 - 2017-04-12: * Bug 21928: Force a reinstall if an existing hardened bundle is present. * Bug 21929: Remove hardened/ASAN related code. * Bug 21927: Remove the ability to install/update the hardened bundle. diff --git a/data/version b/data/version index c08daab..81340c7 100644 --- a/data/version +++ b/data/version @@ -1 +1 @@ -0.0.4-dev +0.0.4

1 0

[sandboxed-tor-browser/master] Bug 21928: Force a reinstall if an existing hardened bundle is present.
by yawning＠torproject.org 12 Apr '17

12 Apr '17

commit aeb2c854b90370fce26e36188186efb48e2eb8e0 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Apr 12 19:35:00 2017 +0000 Bug 21928: Force a reinstall if an existing hardened bundle is present. If an existing hardened bundle is detected, a `Cancel`/`Ok` prompt is displayed, and on the user clicking `Ok` the install process is started. --- ChangeLog | 1 + src/cmd/sandboxed-tor-browser/internal/ui/gtk/ui.go | 20 ++++++++++++++++++++ src/cmd/sandboxed-tor-browser/internal/ui/ui.go | 9 ++++++++- 3 files changed, 29 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index e623392..f289b6d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,5 @@ Changes in version 0.0.4 - UNRELEASED: + * Bug 21928: Force a reinstall if an existing hardened bundle is present. * Bug 21929: Remove hardened/ASAN related code. * Bug 21927: Remove the ability to install/update the hardened bundle. * Bug 21244: Update the MAR signing key for 7.0. diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/gtk/ui.go b/src/cmd/sandboxed-tor-browser/internal/ui/gtk/ui.go index 7a6624c..55ee89a 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/gtk/ui.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/gtk/ui.go @@ -70,6 +70,17 @@ func (ui *gtkUI) Run() error { log.Printf("ui: libnotify wasn't found, no desktop notifications possible") } + if ui.WasHardened { + log.Printf("ui: Previous `hardened` bundle detected") + + ok := ui.ask("The hardened bundle has been discontinued, and the installation of a supported bundle is required.\n\nWARNING: The install process will delete the existing bundle, including bookmarks and downloads. Backup all data you wish to preserve before continuing.") + if !ok { + log.Printf("ui: User denied `hardened` bundle overwrite") + return nil + } + log.Printf("ui: User confirmed `hardened` bundle overwrite") + } + if ui.NeedsInstall() || ui.ForceInstall { for { if !ui.installDialog.run() { @@ -330,6 +341,15 @@ func (ui *gtkUI) bitch(format string, a ...interface{}) { ui.forceRedraw() } +func (ui *gtkUI) ask(format string, a ...interface{}) bool { + md := gtk3.MessageDialogNew(ui.mainWindow, gtk3.DIALOG_MODAL, gtk3.MESSAGE_QUESTION, gtk3.BUTTONS_OK_CANCEL, format, a...) + result := md.Run() + md.Hide() + ui.forceRedraw() + + return result == int(gtk3.RESPONSE_OK) +} + func (ui *gtkUI) notifyUpdate(update *installer.UpdateEntry) { if update == nil { panic("ui: notifyUpdate called with no update metadata") diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go index c3882ad..899104b 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go @@ -67,7 +67,7 @@ const ( // bridges. DefaultBridgeTransport = "obfs4" - // chanHardened = "hardened" + chanHardened = "hardened" ) func usage() { @@ -111,6 +111,7 @@ type Common struct { NoKillTor bool AdvancedConfig bool PrintVersion bool + WasHardened bool } // Init initializes the common interface state. @@ -145,6 +146,12 @@ func (c *Common) Init() error { return err } } + + // #21928: Force a reinstall if an existing hardened bundle is present. + if c.Manif.Channel == chanHardened { + c.ForceInstall = true + c.WasHardened = true + } } return c.Cfg.Sync() }

1 0

[tor-browser-bundle/master] Bug 21887: Fix broken error pages on higher security levels
by gk＠torproject.org 12 Apr '17

12 Apr '17

commit 5d2f77c0c56a62199fab2034ba14686867808b82 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 12 14:05:16 2017 +0000 Bug 21887: Fix broken error pages on higher security levels We need to allow JavaScript on `about:neterror` pages explicitly. Otherwise are those pages on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 3ccab99..09f3f8e 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 3ccab99..09f3f8e 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 3ccab99..09f3f8e 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about:"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[sandboxed-tor-browser/master] Bug 21929: Remove hardened/ASAN related code.
by yawning＠torproject.org 12 Apr '17

12 Apr '17

commit 5d784358fcdbfad980b737824ed1565b237cc148 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Apr 12 18:33:01 2017 +0000 Bug 21929: Remove hardened/ASAN related code. The removes the bulk of the `hardened`/ASAN related code, as it is no longer relevant. The tor-sans-obfs4 seccomp rules probably can tighten the permitted mmap arguments a bit, but that can wait till I have more time. --- ChangeLog | 1 + data/tor-common-amd64.seccomp | 4 --- data/torbrowser-amd64.seccomp | 4 --- .../internal/sandbox/application.go | 35 ++++++++-------------- .../internal/sandbox/hugbox.go | 2 +- .../internal/ui/config/config.go | 3 +- .../sandboxed-tor-browser/internal/ui/launch.go | 5 ---- src/cmd/sandboxed-tor-browser/internal/ui/ui.go | 18 +---------- 8 files changed, 17 insertions(+), 55 deletions(-) diff --git a/ChangeLog b/ChangeLog index 20cae09..e623392 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,5 @@ Changes in version 0.0.4 - UNRELEASED: + * Bug 21929: Remove hardened/ASAN related code. * Bug 21927: Remove the ability to install/update the hardened bundle. * Bug 21244: Update the MAR signing key for 7.0. * Bug 21536: Remove asn's scramblesuit bridge from Tor Browser. diff --git a/data/tor-common-amd64.seccomp b/data/tor-common-amd64.seccomp index 5bc0428..c324843 100644 --- a/data/tor-common-amd64.seccomp +++ b/data/tor-common-amd64.seccomp @@ -96,10 +96,6 @@ unshare: 1 rt_sigaction: 1 setsid: 1 -# XXX: This is only required for ASAN builds, so this should be included at -# runtime. -readlink: 1 - # # System calls allowed with filtering. # diff --git a/data/torbrowser-amd64.seccomp b/data/torbrowser-amd64.seccomp index a2c2817..11e42e5 100644 --- a/data/torbrowser-amd64.seccomp +++ b/data/torbrowser-amd64.seccomp @@ -181,10 +181,6 @@ uname: 1 unshare: 1 wait4: 1 -# XXX: This is only required for ASAN builds, so this should be included at -# runtime. -setrlimit: 1 - # # System calls allowed with filtering. # diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go index fa773d4..427c3b1 100644 --- a/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go @@ -139,10 +139,16 @@ func RunTorBrowser(cfg *config.Config, manif *config.Manifest, tor *tor.Tor) (pr // h.setenv("LD_LIBRARY_PATH", filepath.Join(browserHome, "TorBrowser", "Tor")) h.setenv("FONTCONFIG_PATH", filepath.Join(browserHome, "TorBrowser", "Data", "fontconfig")) h.setenv("FONTCONFIG_FILE", "fonts.conf") - if manif.Channel == "hardened" { - h.setenv("ASAN_OPTIONS", "detect_leaks=0") - h.setenv("NSS_DISABLE_HW_AES", "1") // For selfrando. - } + + // This used to be for `hardened` but may eventually be required for + // `alpha`, though according to trac, newer versions of selfrando fix the + // problem. + // + // https://trac.torproject.org/projects/tor/ticket/20683#comment:13 + // + // if manif.Channel == "alpha" { + // h.setenv("NSS_DISABLE_HW_AES", "1") // For selfrando. + // } // GNOME systems will puke with a read-only home, so instead of setting // $HOME to point to inside the browser bundle, setup a bunch of @@ -176,19 +182,6 @@ func RunTorBrowser(cfg *config.Config, manif *config.Manifest, tor *tor.Tor) (pr h.assetFile(stubPath, "tbb_stub.so") ldPreload := stubPath - if manif.Channel == "hardened" { - // ASAN wants to be the first entry on LD_PRELOAD, so placate it. - matches, err := filepath.Glob(filepath.Join(realBrowserHome, "TorBrowser", "Tor") + "/libasan.so*") - if err != nil { - return nil, err - } - if len(matches) < 1 { - log.Printf("sandbox: Failed to find 'libasan.so.*'") - } else { - _, f := filepath.Split(matches[0]) - ldPreload = f + ":" + ldPreload - } - } h.setenv("LD_PRELOAD", ldPreload) // Hardware accelerated OpenGL will not work, and never will. @@ -520,13 +513,11 @@ func RunTor(cfg *config.Config, manif *config.Manifest, torrc []byte) (process * // `/proc/sys/net/core/somaxconn` - obfs4proxy, Go runtime uses this to // determine listener backlog, but will default to `128` on errors. // - // Hardened builds are special cased because asan crashes the binary - // if it can't read `/proc/self/maps`. + // `/proc/self/maps` - ASAN. If it's ever enabled again, this mandates + // `/proc`. // // See: https://bugs.torproject.org/20773 - if manif.Channel != "hardened" { - h.mountProc = false - } + h.mountProc = false if err = os.MkdirAll(cfg.TorDataDir, DirMode); err != nil { return diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go index fb51e41..118b7a7 100644 --- a/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/hugbox.go @@ -166,7 +166,7 @@ func (h *hugbox) run() (*Process, error) { Stdout: h.stdout, Stderr: h.stderr, SysProcAttr: &syscall.SysProcAttr{ - Setsid: true, + Setsid: true, Pdeathsig: h.pdeathSig, }, } diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/config/config.go b/src/cmd/sandboxed-tor-browser/internal/ui/config/config.go index 44b6633..332c4b5 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/config/config.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/config/config.go @@ -293,8 +293,7 @@ type Config struct { // "linux64"). Architecture string `json:"-"` - // Channel is the Tor Browser channel to install ("release", "alpha", - // "hardened"). + // Channel is the Tor Browser channel to install ("release", "alpha") Channel string `json:"channel,omitempty"` // Locale is the Tor Browser locale to install ("en-US", "ja"). diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/launch.go b/src/cmd/sandboxed-tor-browser/internal/ui/launch.go index e929fa7..046e2b8 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/launch.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/launch.go @@ -55,11 +55,6 @@ func (c *Common) DoLaunch(async *Async, checkUpdates bool) { return } - if c.Manif.Channel == chanHardened && sandbox.IsGrsecKernel() { - async.Err = fmt.Errorf("The 'hardened' release is incompatible with grsec.") - return - } - // Start tor if required. log.Printf("launch: Connecting to the Tor network.") async.UpdateProgress("Connecting to the Tor network.") diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go index 1de7e8c..c3882ad 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go @@ -67,7 +67,7 @@ const ( // bridges. DefaultBridgeTransport = "obfs4" - chanHardened = "hardened" + // chanHardened = "hardened" ) func usage() { @@ -133,16 +133,6 @@ func (c *Common) Init() error { } c.Cfg.Sanitize() - if sandbox.IsGrsecKernel() { - channels := []string{} - for _, v := range BundleChannels[c.Cfg.Architecture] { - if v != "hardened" { - channels = append(channels, v) - } - } - BundleChannels[c.Cfg.Architecture] = channels - } - if c.Manif != nil { if err = c.Manif.Sync(); err != nil { return err @@ -464,12 +454,6 @@ func init() { panic(err) } - // Cowardly refuse to allow the user to install the hardeened bundle on - // grsec kernels. - if sandbox.IsGrsecKernel() { - delete(BundleLocales, chanHardened) - } - Bridges = make(map[string][]string) if d, err := data.Asset("bridges.json"); err != nil { panic(err)

1 0