May 2017 - tor-commits - lists.torproject.org

[tor/maint-0.2.9] Add getpid() to the seccomp2 sandbox.
by nickm＠torproject.org 08 May '17

08 May '17

commit 99e943998dcfd1263301224104ef98596325f9f2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 26 12:56:06 2017 -0400 Add getpid() to the seccomp2 sandbox. We hadn't needed this before, because most getpid() callers on Linux were looking at the vDSO version of getpid(). I don't know why at least one version of OpenSSL seems to be ignoring the vDSO, but this change should fix it. Fixes bug 21943; bugfix on 0.2.5.1-alpha when the sandbox was introduced. --- src/common/sandbox.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index ebc843e..95c9f83 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -155,6 +155,7 @@ static int filter_nopar_gen[] = { #ifdef __NR_getgid32 SCMP_SYS(getgid32), #endif + SCMP_SYS(getpid), #ifdef __NR_getrlimit SCMP_SYS(getrlimit), #endif

1 0

[tor/maint-0.2.9] Merge branch 'bug21943_029' into maint-0.2.9
by nickm＠torproject.org 08 May '17

08 May '17

commit 0df22e8f5f5c4e1a329f2930f6eb9ecde1cf9848 Merge: 5ff0b51 1cdad97 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:40:14 2017 -0400 Merge branch 'bug21943_029' into maint-0.2.9 changes/bug21943 | 6 ++++++ src/common/sandbox.c | 1 + 2 files changed, 7 insertions(+)

1 0

[tor/master] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 08 May '17

08 May '17

commit d792d2a14ddb7d2ff62dea8ed7d15416b1254348 Merge: f587691 0df22e8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:40:26 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug21943 | 6 ++++++ src/common/sandbox.c | 1 + 2 files changed, 7 insertions(+)

1 0

[tor/master] Add a changes file for 21943.
by nickm＠torproject.org 08 May '17

08 May '17

commit 1cdad9782d31f10e8e622a642b49f39deebc3737 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:39:59 2017 -0400 Add a changes file for 21943. --- changes/bug21943 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changes/bug21943 b/changes/bug21943 new file mode 100644 index 0000000..dbe2c72 --- /dev/null +++ b/changes/bug21943 @@ -0,0 +1,6 @@ + o Minor bugfixes (Linux seccomp2 sandbox): + - The getpid() system call is now permitted under the Linux seccomp2 + sandbox, to avoid crashing with versions of OpenSSL (and other + libraries) that attempt to learn the process's PID by using the + syscall rather than the VDSO code. Fixes bug 21943; bugfix on + 0.2.5.1-alpha.

1 0

[tor/master] Add getpid() to the seccomp2 sandbox.
by nickm＠torproject.org 08 May '17

08 May '17

commit 99e943998dcfd1263301224104ef98596325f9f2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 26 12:56:06 2017 -0400 Add getpid() to the seccomp2 sandbox. We hadn't needed this before, because most getpid() callers on Linux were looking at the vDSO version of getpid(). I don't know why at least one version of OpenSSL seems to be ignoring the vDSO, but this change should fix it. Fixes bug 21943; bugfix on 0.2.5.1-alpha when the sandbox was introduced. --- src/common/sandbox.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index ebc843e..95c9f83 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -155,6 +155,7 @@ static int filter_nopar_gen[] = { #ifdef __NR_getgid32 SCMP_SYS(getgid32), #endif + SCMP_SYS(getpid), #ifdef __NR_getrlimit SCMP_SYS(getrlimit), #endif

1 0

[tor/master] Merge branch 'bug21943_029' into maint-0.2.9
by nickm＠torproject.org 08 May '17

08 May '17

commit 0df22e8f5f5c4e1a329f2930f6eb9ecde1cf9848 Merge: 5ff0b51 1cdad97 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:40:14 2017 -0400 Merge branch 'bug21943_029' into maint-0.2.9 changes/bug21943 | 6 ++++++ src/common/sandbox.c | 1 + 2 files changed, 7 insertions(+)

1 0

[tor/master] Merge branch 'maint-0.3.0'
by nickm＠torproject.org 08 May '17

08 May '17

commit 35025ee51ff9204271fcfc787a99334082e531a1 Merge: 03fdf23 d792d2a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:40:41 2017 -0400 Merge branch 'maint-0.3.0' changes/bug21943 | 6 ++++++ src/common/sandbox.c | 1 + 2 files changed, 7 insertions(+)

1 0

[translation/tor-browser-manual_completed] Update translations for tor-browser-manual_completed
by translation＠torproject.org 08 May '17

08 May '17

commit 8a82b2fb2548e90790d27ca8b76b00e258b9ccb4 Author: Translation commit bot <translation(a)torproject.org> Date: Mon May 8 16:48:30 2017 +0000 Update translations for tor-browser-manual_completed --- zh_TW/zh_TW.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zh_TW/zh_TW.po b/zh_TW/zh_TW.po index ba88c26..a20385e 100644 --- a/zh_TW/zh_TW.po +++ b/zh_TW/zh_TW.po @@ -635,7 +635,7 @@ msgstr "" msgid "" "Tor Browser can also be started from the command line by running the " "following command from inside the Tor Browser directory:" -msgstr "洋蔥路由瀏覽器的啟動，也可從洋蔥路由瀏覽器目錄中的命令列模式，以下面這個指令來達成：" +msgstr "也可以用命令列模式在洋蔥路由瀏覽器的目錄中，執行下面這個指令來啟動它：" #: known-issues.page:66 #, no-wrap

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 08 May '17

08 May '17

commit 6a59e427415ec200330471d4492779b31d6bc719 Author: Translation commit bot <translation(a)torproject.org> Date: Mon May 8 16:48:26 2017 +0000 Update translations for tor-browser-manual --- zh_TW/zh_TW.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zh_TW/zh_TW.po b/zh_TW/zh_TW.po index ba88c26..a20385e 100644 --- a/zh_TW/zh_TW.po +++ b/zh_TW/zh_TW.po @@ -635,7 +635,7 @@ msgstr "" msgid "" "Tor Browser can also be started from the command line by running the " "following command from inside the Tor Browser directory:" -msgstr "洋蔥路由瀏覽器的啟動，也可從洋蔥路由瀏覽器目錄中的命令列模式，以下面這個指令來達成：" +msgstr "也可以用命令列模式在洋蔥路由瀏覽器的目錄中，執行下面這個指令來啟動它：" #: known-issues.page:66 #, no-wrap

1 0

[tor-browser-build/master] Bug 22115: use i386 containers for the win32 build
by boklm＠torproject.org 08 May '17

08 May '17

commit bb32ec91b538ab17d309b645787149ff376d58e9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 8 18:44:29 2017 +0200 Bug 22115: use i386 containers for the win32 build --- projects/firefox/build | 1 + projects/gcc/config | 3 +++ projects/mingw-w64/config | 1 + projects/tor-browser/build | 13 ------------- projects/tor-browser/config | 12 ++---------- rbm.conf | 8 +++++++- 6 files changed, 14 insertions(+), 24 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index 1cf9be1..f445454 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -1,4 +1,5 @@ #!/bin/bash +[% c("var/setarch") -%] [% c("var/set_default_env") -%] [% IF c("var/windows") -%] mkdir -p /var/tmp/dist diff --git a/projects/gcc/config b/projects/gcc/config index 676d1fb..d740a93 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -38,6 +38,9 @@ targets: windows-i686: var: configure_opt: --disable-multilib --enable-languages=c,c++ + arch_deps: + - libc6-dev + - zlib1g-dev linux-i686: var: configure_opt: --enable-multilib --enable-languages=c,c++ --with-system-zlib diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 21d498a..5e2c748 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -13,6 +13,7 @@ var: - libmpc-dev - g++-mingw-w64-i686 setup: | + [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] export PATH="/var/tmp/dist/mingw-w64/helpers:/var/tmp/dist/mingw-w64/bin:$PATH" diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 7134367..084ec7d 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -201,19 +201,6 @@ popd [% IF c("var/windows") %] - # We need to install a recent version of python-pefile so that it works - # in a x86_64 container: - # https://github.com/TheTorProject/tor-messenger-build/pull/10 - tar xf $rootdir/[% c('input_files_by_name/python-future') %] - cd $(echo [% c('input_files_by_name/python-future') %] | sed s/\.tar\.gz$//) - python setup.py install --user - cd .. - - tar xf $rootdir/[% c('input_files_by_name/python-pefile') %] - cd $(echo [% c('input_files_by_name/python-pefile') %] | sed s/\.tar\.gz$//) - python setup.py install --user - cd .. - tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/nsis') %] export PATH="/var/tmp/dist/nsis/bin:$PATH" diff --git a/projects/tor-browser/config b/projects/tor-browser/config index c4c2521..805d7b6 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -27,8 +27,8 @@ targets: windows-i686: var: mar_osname: win32 - container: - suite: utopic + arch_deps: + - python-pefile input_files: - project: container-image @@ -70,11 +70,3 @@ input_files: enable: '[% c("var/windows") %]' - filename: pe_checksum_fix.py enable: '[% c("var/windows") %]' - - name: python-future - URL: https://pypi.python.org/packages/00/2b/8d082ddfed935f3608cc61140df6dcbf0ede… - sha256sum: e39ced1ab767b5936646cedba8bcce582398233d6a627067d4c6a454c90cfedb - enable: '[% c("var/windows") %]' - - name: python-pefile - URL: https://pypi.python.org/packages/92/c0/8589ce9734ffdba258bd3e5acd4afb2e3586… - sha256sum: f24021085b5c3ef7b0898bb1f1d93eecd3839e03512769e22b0c5a10d9095f7b - enable: '[% c("var/windows") %]' diff --git a/rbm.conf b/rbm.conf index 2060132..969922c 100644 --- a/rbm.conf +++ b/rbm.conf @@ -153,7 +153,7 @@ targets: osname: windows-i686 container: suite: precise - arch: amd64 + arch: i386 configure_opt: '--host=i686-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' CFLAGS: '[% c("var/flag_mwindows") %] -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security' LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs' @@ -168,6 +168,12 @@ targets: - zip - unzip faketime_path: /usr/lib/faketime/libfaketime.so.1 + setarch: | + if test -z "$RBM_SETARCH" + then + export RBM_SETARCH=1 + exec setarch i686 ./build + fi torbrowser-osx-x86_64: - osx-x86_64

1 0