February 2021 - tor-commits - lists.torproject.org

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 26 Feb '21

26 Feb '21

commit fb571878ed3265ef894918e7d79abb420c8e610b Author: Translation commit bot <translation(a)torproject.org> Date: Fri Feb 26 09:15:20 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+ka.po | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/contents+ka.po b/contents+ka.po index 11448eabf9..ba70421a09 100644 --- a/contents+ka.po +++ b/contents+ka.po @@ -13048,6 +13048,10 @@ msgid "" "services/setup/), be careful of letting your web server reveal identifying " "information about you, your computer, or your location." msgstr "" +"- როგორც აღნიშნულია [აქ](https://community.torproject.org/onion-" +"services/setup/), გამოიჩინეთ წინდახედულობა, როცა ვებსერვერს უმჟღავნებთ " +"ამოსაცნობ მონაცემებს თქვენ შესახებ, თქვენი კომპიუტერის ან თქვენი მდებარეობის" +" თაობაზე." #: https//community.torproject.org/onion-services/advanced/opsec/ #: (content/onion-services/advanced/opsec/contents+en.lrpage.body) @@ -13070,7 +13074,7 @@ msgstr "" #: https//community.torproject.org/onion-services/advanced/opsec/ #: (content/onion-services/advanced/opsec/contents+en.lrpage.body) msgid "This leaks information to an observant adversary." -msgstr "" +msgstr "ეს უმჟღავნებს მონაცემებს ჩასაფრებულ მოწინააღმდეგეებს." #: https//community.torproject.org/onion-services/advanced/opsec/ #: (content/onion-services/advanced/opsec/contents+en.lrpage.body) @@ -13098,6 +13102,9 @@ msgid "" "The most prominent attacks are building a profile of the onion service's " "availability and matching induced traffic patterns." msgstr "" +"ყველაზე ხშირია შეტევებისთვის დახასიათების შედგენა Onion-მომსახურების " +"ხელმისაწვდომობის შესახებ, მონაცემების გატარებაზე ხელოვნურ ზეგავლენასთან " +"თანხლებით." #: https//community.torproject.org/onion-services/advanced/opsec/ #: (content/onion-services/advanced/opsec/contents+en.lrpage.body) @@ -13180,12 +13187,16 @@ msgstr "" msgid "" "* The webpage defining the Onion-Location header must be served over HTTPS." msgstr "" +"* ვებგვერდი, რომლითაც განისაზღვრება Onion-მდებარეობის თავსართი, " +"უზრუნველყოფილი უნდა იყოს HTTPS-ით." #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body) msgid "" "* The webpage defining the Onion-Location header must not be an onion site." msgstr "" +"* ვებგვერდი, რომლითაც განისაზღვრება Onion-მდებარეობის თავსართი, არ უნდა " +"წარმოადგენდეს Onion-საიტს." #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body) @@ -13213,6 +13224,9 @@ msgid "" "To configure this header in Apache 2.2 or above, you will need to enable a " "`headers` and `rewrite` modules and edit the website Virtual Host file." msgstr "" +"ამ თავსართის გასამართად Apache 2.2 და ზედა ვერსიებში, საჭიროა ჩართოთ " +"`headers` და `rewrite` მოდულები, ამასთან ჩაასწოროთ ვებსაიტის Virtual Host " +"ფაილი." #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body) @@ -13244,6 +13258,7 @@ msgstr "" msgid "" "Header set Onion-Location \"http://your-onion-address.onion%{REQUEST_URI}s\"" msgstr "" +"Header set Onion-Location \"http://your-onion-address.onion%{REQUEST_URI}s\"" #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body) @@ -13253,6 +13268,10 @@ msgid "" "URI](https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html), such as " "\"/index.html\"." msgstr "" +"სადაც `your-onion-address.onion` არის Onion-მომსახურების მისამართი, რომელიც " +"გსურთ გადამისამართდეს და `{REQUEST_URI}` არის [მიმართულების აღმნიშვნელი " +"მოთხოვნილი URI-ს](https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html), " +"როგორიცაა \"/index.html\"." #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body) @@ -13316,6 +13335,8 @@ msgid "" "To test if Onion-Location is working, fetch the website HTTP headers, for " "example:" msgstr "" +"შესამოწმებლად, მუშაობს თუ არა Onion-მდებარეობა, გამოითხოვეთ ვებსაიტის HTTP-" +"თავსართები, მაგალითად:" #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body) @@ -13333,6 +13354,8 @@ msgid "" "Or open the website in Tor Browser and a purple pill will appear in the " "address bar." msgstr "" +"ან გახსენით ვებსაიტი Tor-ბრაუზერი და იისფერი ნიშანი გამოჩნდება მისამართების " +"ველში." #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body) @@ -13353,6 +13376,8 @@ msgstr "" msgid "" "**Step 1.** Create an Onion service by setting the following in `torrc`:" msgstr "" +"**ნაბიჯი 1.** შექმენით Onion-მომსახურება შემდეგი პარამეტრების გამართვით " +"ფაილში `torrc`:" #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body) @@ -13574,6 +13599,8 @@ msgid "" "To test if the Onion-Location is working, fetch the web site HTTP headers, " "for example:" msgstr "" +"შესამოწმებლად, მუშაობს თუ არა Onion-მდებარეობა, გამოითხოვეთ ვებსაიტის HTTP-" +"თავსართები, მაგალითად:" #: https//community.torproject.org/onion-services/advanced/onion-location/ #: (content/onion-services/advanced/onion-location/contents+en.lrpage.body)

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 26 Feb '21

26 Feb '21

commit 80f3d45949c3eb1a243f271ea0b0e25febe2b252 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Feb 26 08:45:15 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+ka.po | 41 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/contents+ka.po b/contents+ka.po index d1e6ea2e53..11448eabf9 100644 --- a/contents+ka.po +++ b/contents+ka.po @@ -12128,6 +12128,8 @@ msgid "" "This could result in law enforcement raiding your home, seizing your " "computer, and suspecting you of criminal activity." msgstr "" +"შედეგად კი ამას შეიძლება მოჰყვეს სამართალდამცველების თქვენს სახლში შემოჭრა, " +"კომპიუტერის ჩამორთმევა და თქვენი მიჩნევა დანაშაულებრივი ქმედების მონაწილედ." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body) @@ -12135,6 +12137,8 @@ msgid "" "For that reason, it's best not to run your exit relay in your home or using " "your home Internet connection." msgstr "" +"ამიტომ, კარგი იქნება, თუ გამსვლელ წერტილს არ გაუშვებთ თქვენს სახლში, ანუ " +"თქვენი სახლის ქსელის გამოყენებით." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body) @@ -12143,6 +12147,10 @@ msgid "" "commercial facility that is supportive of Tor. Have a separate IP address " "for your exit relay, and don't route your own traffic through it." msgstr "" +"ამ საფრთხეების გათვალისწინებით, სასურველია გამსვლელი გადამცემის კომერციული " +"ორგანიზაციის მეშვეობით გაშვება, რომელიც მხარს უჭერს Tor-ს. ასევე, " +"განცალკევებული IP-მისამართის გამოყოფა გამავალი კვანძისთვის, რომელიც არ " +"იქნება გამოყენებული სხვა კავშირებისთვის." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body) @@ -12162,6 +12170,10 @@ msgid "" "please review Tor’s recommendations, including telling your ISP and " "obtaining a separate IP address for the exit relay." msgstr "" +"თუ მაინც გადაწყვეტთ გამსვლელი კვანძის სახლიდან გაშვებას საფრთხეების " +"მიუხედავად, გთხოვთ, გადახედოთ Tor-ის რჩევებს, მათ შორის ინტერნეტის " +"მომწოდებლისთვის ცალკე გამოყოფილი IP-მისამართის თაობაზე, საგანგებოდ გამსვლელი" +" გადამცემისთვის." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body) @@ -12367,6 +12379,10 @@ msgid "" "Communications Privacy Act, and relay operators outside of the United States" " may be subject to similar data protection laws." msgstr "" +"შეერთებულ შტატებში, ამგვარი მონაცემების ხელშეუხებლობა უზრუნველყოფილია " +"ელექტრონული კომუნიკაციების პირადი მონაცემების დაცვის აქტით, ხოლო შტატების " +"გარეთ გადამცემების გამშვებებს, სავარაუდოდ პასუხისმგებლობა დაეკისრებათ " +"მონაცემთა დაცვის მსგავსი საკანონმდებლო ნორმებით." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body) @@ -12400,6 +12416,10 @@ msgid "" "response templates](/relay/community-resources/tor-abuse-templates/) on the " "Tor Project's website." msgstr "" +"დამატებით, საჩივრებზე და სხვა უწყებებზე პასუხის გაცემის შესახებ, იხილეთ " +"[Tor-ის საჩივრების ხ.დ.კ.](https://support.torproject.org/abuse) და ნაკრები " +"[საჩივრებზე პასუხის ნიმუშებისა](/relay/community-resources/tor-abuse-" +"templates/) Tor-პროექტის ვებსაიტზე." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body) @@ -12895,6 +12915,10 @@ msgid "" "private key directly in the [Tor Browser](https://tb-manual.torproject.org" "/onion-services/) interface." msgstr "" +"თუ აპირებთ შექმნათ საიდუმლო გასაღები Onion-საიტისთვის, მომხმარებელს არ " +"დაჭირდება Tor-ბრაუზერის torrc-ფაილის ჩაწორება. შესაძლებელია საიდუმლო " +"გასაღების პირდაპირ [Tor-ბრაუზერში](https://tb-manual.torproject.org/onion-" +"services/)." #: https//community.torproject.org/onion-services/advanced/client-auth/ #: (content/onion-services/advanced/client-auth/contents+en.lrpage.body) @@ -12921,6 +12945,13 @@ msgid "" "[HiddenServiceAuthorizeClient](https://2019.www.torproject.org/docs/tor-" "manual.html.en#HiddenServiceAuthorizeClient) options in the tor manual." msgstr "" +"ფუნთუშით დამოწმების (Cookie Authentication) ჩასართავად **v2** " +"მომსახურებებისთვის, იხილეთ ჩანაწერები " +"[HidServAuth](https://2019.www.torproject.org/docs/tor-" +"manual.html.en#HidServAuth) და " +"[HiddenServiceAuthorizeClient](https://2019.www.torproject.org/docs/tor-" +"manual.html.en#HiddenServiceAuthorizeClient)-ვარიანტებისთვის " +"სახელმძღვანელოში." #: https//community.torproject.org/onion-services/advanced/client-auth/ #: (content/onion-services/advanced/client-auth/contents+en.lrpage.body) @@ -12944,6 +12975,8 @@ msgid "" "Restart tor and read the cookie from the hostname file of your onion " "service, for example in" msgstr "" +"ხელახლა გაუშვით tor და წააკითხეთ ფუნთუშა ჰოსტის სახელის ფაილიდან თქვენი " +"Onion-მომსახურების, მაგალითად" #: https//community.torproject.org/onion-services/advanced/client-auth/ #: (content/onion-services/advanced/client-auth/contents+en.lrpage.body) @@ -12971,7 +13004,7 @@ msgstr "ახლა უკვე შეგიძლიათ onion-მომს #: https//community.torproject.org/onion-services/advanced/opsec/ #: (content/onion-services/advanced/opsec/contents+en.lrpage.title) msgid "Operational Security" -msgstr "" +msgstr "სამუშაო უსაფრთხოება" #: https//community.torproject.org/onion-services/advanced/opsec/ #: (content/onion-services/advanced/opsec/contents+en.lrpage.subtitle) @@ -12985,6 +13018,9 @@ msgid "" "security](https://trac.torproject.org/projects/tor/wiki/doc/OperationalSecu…" " and system administration to maintain security." msgstr "" +"Onion-მომსახურებების გამშვებები საჭიროა გაეცნონ [სამუშაო " +"უსაფრთხოებისა](https://trac.torproject.org/projects/tor/wiki/doc/Operationa…" +" და სისტემის ზედამხედველობის საკითხებს, დაცულობის უზრუნველსაყოფად." #: https//community.torproject.org/onion-services/advanced/opsec/ #: (content/onion-services/advanced/opsec/contents+en.lrpage.body) @@ -12994,6 +13030,9 @@ msgid "" "document](https://riseup.net/en/security/network-security/tor/onionservices-" "best-practices)." msgstr "" +"უსაფრთხოების გარკვეული წესებისთვის, გთხოვთ იხილოთ Riseup-ის [\"Tor Hidden " +"(Onion) Services Best Practices\" მასალას](https://riseup.net/en/security" +"/network-security/tor/onionservices-best-practices)." #: https//community.torproject.org/onion-services/advanced/opsec/ #: (content/onion-services/advanced/opsec/contents+en.lrpage.body)

1 0

[translation/tpo-web_completed] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web_completed
by translation＠torproject.org 26 Feb '21

26 Feb '21

commit d98147515849206c4da045a0fa160d773eb0a226 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Feb 26 08:18:23 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web_completed --- contents+es.po | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contents+es.po b/contents+es.po index 228a8fbedb..d0252f6e7b 100644 --- a/contents+es.po +++ b/contents+es.po @@ -9,10 +9,10 @@ # Carlos Guerra <contacto(a)guerracarlos.com>, 2019 # Zuhualime Akoochimoya, 2019 # Nicolas Sera-Leyva <nseraleyva(a)internews.org>, 2019 -# Emma Peel, 2020 # David Figuera <dfb(a)fastmail.com>, 2020 # erinm, 2020 # Gus, 2020 +# Emma Peel, 2021 # msgid "" msgstr "" @@ -20,7 +20,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2020-02-24 13:39+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: Gus, 2020\n" +"Last-Translator: Emma Peel, 2021\n" "Language-Team: Spanish (https://www.transifex.com/otf/teams/1519/es/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -1352,7 +1352,7 @@ msgid "" " So will your browsing history." msgstr "" "El Navegador Tor aísla cada sitio web que visitas de manera que rastreadores" -" de terceros y publicidades no pueden seguirte. Las cookies se borran " +" de terceros y publicidad no te puedan seguir. Las cookies se borran " "automáticamente cuando terminas la navegación. Como así también tu historial" " de navegación."

1 0

[translation/tpo-web] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web
by translation＠torproject.org 26 Feb '21

26 Feb '21

commit c9f70e5eefd9f67c3b2019d6973f0021c04f1cab Author: Translation commit bot <translation(a)torproject.org> Date: Fri Feb 26 08:18:17 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web --- contents+es.po | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contents+es.po b/contents+es.po index 228a8fbedb..d0252f6e7b 100644 --- a/contents+es.po +++ b/contents+es.po @@ -9,10 +9,10 @@ # Carlos Guerra <contacto(a)guerracarlos.com>, 2019 # Zuhualime Akoochimoya, 2019 # Nicolas Sera-Leyva <nseraleyva(a)internews.org>, 2019 -# Emma Peel, 2020 # David Figuera <dfb(a)fastmail.com>, 2020 # erinm, 2020 # Gus, 2020 +# Emma Peel, 2021 # msgid "" msgstr "" @@ -20,7 +20,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2020-02-24 13:39+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: Gus, 2020\n" +"Last-Translator: Emma Peel, 2021\n" "Language-Team: Spanish (https://www.transifex.com/otf/teams/1519/es/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -1352,7 +1352,7 @@ msgid "" " So will your browsing history." msgstr "" "El Navegador Tor aísla cada sitio web que visitas de manera que rastreadores" -" de terceros y publicidades no pueden seguirte. Las cookies se borran " +" de terceros y publicidad no te puedan seguir. Las cookies se borran " "automáticamente cuando terminas la navegación. Como así también tu historial" " de navegación."

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 26 Feb '21

26 Feb '21

commit b0794739fa873a797708407822d0382e09dfb8c6 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Feb 26 08:15:22 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+ka.po | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/contents+ka.po b/contents+ka.po index 9a20091f94..d1e6ea2e53 100644 --- a/contents+ka.po +++ b/contents+ka.po @@ -11924,6 +11924,11 @@ msgid "" " as the Tor network, against a range of laws that might otherwise be used to" " hold them legally responsible for what others say and do." msgstr "" +"თუმცაღა არის მნიშვნელოვანი გამონაკლისები გარკვეული სახის დანაშაულსა და " +"ინტელექტუალურ საკუთრების უფლებებთან დაკავშირებით, ნაწილი 230 მაინც იცავს " +"ინტერნეტმომსახურებებს, როგორიცაა Tor-ქსელი, არაერთი ისეთი კანონისგან, " +"რომელიც შესაძლოა გამოყენებული ყოფილიყო მათ დასაკავებლად, სხვების მიერ " +"ჩადენილის ან ნამოქმედარის გამო." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body) @@ -11933,6 +11938,11 @@ msgid "" "claims based on material that is simply transmitted without modification, as" " a Tor relay does." msgstr "" +"კიდევ ერთი ფედერალური კანონი, 17 U.S.C. § 512(a), რომელიც განეკუთვნება " +"ციფრულ ეპოქაში საავტორო უფლებების დაცვის აქტს, პასუხისმგებლობის გამორიცხვის " +"საშუალებას იძლევა იმ შემთხვევაში, თუ საავტორო უფლების დარღვევაზე საჩივარი " +"ეხება ხელშეუხებლად გატარებულ მასალებს, სწორედ ისე, როგორც Tor-გადამცემი " +"ატარებს." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body) @@ -12108,6 +12118,9 @@ msgid "" "possible that officers will mistakenly attribute that traffic as originating" " from your home." msgstr "" +"თუ სამართალდამცავები დაინტერესდებიან თქვენი გამსვლელი წერტილიდან გამავალი " +"კავშირით, შესაძლოა მათმა წარმომადგენლებმა ეს გატარებული მასალები შეცდომით " +"თქვენ მოგაკუთვნონ, ვინაიდან კავშირი თქვენი სახლიდან მომდინარეობს." #: https//community.torproject.org/relay/community-resources/eff-tor-legal-faq/ #: (content/relay-operations/community-resources/eff-tor-legal-faq/contents+en.lrpage.body)

1 0

[translation-tools/master] remove component that was absorbed on other document
by emmapeel＠torproject.org 26 Feb '21

26 Feb '21

commit ce2515f93a795fa2789840a81a41e41a7ff31fbf Author: emma peel <emma.peel(a)riseup.net> Date: Fri Feb 26 06:30:17 2021 +0000 remove component that was absorbed on other document --- config | 1 - 1 file changed, 1 deletion(-) diff --git a/config b/config index f26a5bf..6b167c5 100644 --- a/config +++ b/config @@ -37,7 +37,6 @@ torbutton-torbuttondtd torbutton-torbuttondtd_completed torbutton-aboutdialogdtd torbutton-aboutdialogdtd_completed torbutton-abouttbupdatedtd torbutton-abouttbupdatedtd_completed torbutton-browseronboardingproperties torbutton-browseronboardingproperties_completed -torbutton-securitylevelproperties torbutton-securitylevelproperties_completed torcheck torcheck_completed tor-launcher-properties tor-launcher-properties_completed tor-launcher-network-settings tor-launcher-network-settings_completed

1 0

[torsocks/master] Pass through non-blacklisted syscalls
by jnewsome＠torproject.org 25 Feb '21

25 Feb '21

commit b2c1132dfca74a7dc33f0f3c0617008a16421285 Author: Jim Newsome <jnewsome(a)torproject.org> Date: Fri Feb 5 13:52:35 2021 -0600 Pass through non-blacklisted syscalls --- src/lib/syscall.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/src/lib/syscall.c b/src/lib/syscall.c index f793da7..c941730 100644 --- a/src/lib/syscall.c +++ b/src/lib/syscall.c @@ -470,6 +470,16 @@ static LIBC_SYSCALL_RET_TYPE handle_getdents64(va_list args) #endif /* __linux__ */ +static LIBC_SYSCALL_RET_TYPE handle_passthrough(long n, va_list args) { + long arg1 = va_arg(args, long); + long arg2 = va_arg(args, long); + long arg3 = va_arg(args, long); + long arg4 = va_arg(args, long); + long arg5 = va_arg(args, long); + long arg6 = va_arg(args, long); + return tsocks_libc_syscall(n, arg1, arg2, arg3, arg4, arg5, arg6); +} + /* * Torsocks call for syscall(2) */ @@ -597,14 +607,7 @@ LIBC_SYSCALL_RET_TYPE tsocks_syscall(long int number, va_list args) break; #endif /* __linux__ */ default: - /* - * Because of the design of syscall(), we can't pass a va_list to it so - * we are constraint to use a whitelist scheme and denying the rest. - */ - WARN("[syscall] Unsupported syscall number %ld. Denying the call", - number); - ret = -1; - errno = ENOSYS; + ret = handle_passthrough(number, args); break; }

1 0

[torsocks/master] Merge branch 'default-allow-syscalls'
by jnewsome＠torproject.org 25 Feb '21

25 Feb '21

commit 67cee6c7976b4e103e6f9c3a70e767ffe54368e0 Merge: d4b0a84 800eb9e Author: Jim Newsome <jnewsome(a)torproject.org> Date: Mon Feb 22 13:34:02 2021 -0600 Merge branch 'default-allow-syscalls' Merges tpo/core/torsocks!2 src/lib/syscall.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)

1 0

[torsocks/master] Add debug-log for opaque syscall passthrough
by jnewsome＠torproject.org 25 Feb '21

25 Feb '21

commit 800eb9eb417417129534db7a514d0f1f82773648 Author: Jim Newsome <jnewsome(a)torproject.org> Date: Mon Feb 8 14:38:52 2021 -0600 Add debug-log for opaque syscall passthrough --- src/lib/syscall.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/lib/syscall.c b/src/lib/syscall.c index c941730..c92a74b 100644 --- a/src/lib/syscall.c +++ b/src/lib/syscall.c @@ -607,6 +607,8 @@ LIBC_SYSCALL_RET_TYPE tsocks_syscall(long int number, va_list args) break; #endif /* __linux__ */ default: + DBG("[syscall] Unsupported __syscall number %ld. Passing through", + number); ret = handle_passthrough(number, args); break; }

1 0

[tor-browser-build/master] Bug 23631: Use rootless containers
by gk＠torproject.org 25 Feb '21

25 Feb '21

commit 90c077db1d398041c75e6e4ebc56fb80570eb027 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jun 16 20:03:56 2020 +0200 Bug 23631: Use rootless containers --- README | 20 +- README.HACKING | 23 ++ projects/common/runc-config.json | 267 --------------------- projects/container-image/config | 4 +- projects/debootstrap-image/config | 80 ------ .../{debootstrap-image => mmdebstrap-image}/build | 0 projects/mmdebstrap-image/config | 59 +++++ .../mmdebstrap-image/mmdebstrap-no-user-ns.patch | 30 +++ projects/mmdebstrap/build | 8 + projects/mmdebstrap/config | 5 + rbm | 2 +- rbm.conf | 92 +++---- 12 files changed, 172 insertions(+), 418 deletions(-) diff --git a/README b/README index e37f20d..8ebccf6 100644 --- a/README +++ b/README @@ -4,12 +4,10 @@ Tor Browser Build Installing build dependencies ----------------------------- -To build Tor Browser, you need a Linux distribution that has support -for runc (such as Debian Buster, Ubuntu 16.04, Fedora 30, etc ...). - -Your user account should have sudo access, which is required to be able -to extract container file systems, start containers and copy files to and -from containers. +To build Tor Browser, you need a recent Linux distribution with support +for user_namespaces(7) (such as Debian Buster, Ubuntu 16.04, Fedora 30, +etc ...). You will need to install the uidmap package, providing the +newuidmap and newgidmap commands. The sources of most components are downloaded using git, which needs to be installed. @@ -40,12 +38,20 @@ If you are running Debian or Ubuntu, you can install them with: libio-captureoutput-perl libjson-perl libpath-tiny-perl \ libstring-shellquote-perl libsort-versions-perl \ libdigest-sha-perl libdata-uuid-perl libdata-dump-perl \ - libfile-copy-recursive-perl libfile-slurp-perl git runc + libfile-copy-recursive-perl libfile-slurp-perl git \ + uidmap The build system is based on rbm, which is included as a git submodule in the rbm/ directory. You can fetch the rbm git submodule by running 'make submodule-update'. +The build uses user_namespaces(7), which are disabled by default on Debian. +To enable them you can use the following command as root: + + # sysctl -w kernel.unprivileged_userns_clone=1 + +You can enable them permanently by adding the setting to /etc/sysctl.d/ + Starting a build ---------------- diff --git a/README.HACKING b/README.HACKING index 0d3eeb8..506502d 100644 --- a/README.HACKING +++ b/README.HACKING @@ -305,6 +305,29 @@ The path to the container should be printed on the screen in case you want to backup its rootfs to be able to look at it later. +Manually removing old containers +-------------------------------- + +When a build finishes or when you exit a debugging shell, the old +container should automatically be removed. In some cases however, for +example your computer is rebooted in the middle of a build, some old +container directories may be left in the tmp directory. Some of the +files in the container directories are owned by subordinate user ids +(see the subuid man page), which will prevent you from removing them +with your normal user id. To remove them you can open a container +shell (a new User namespace) using the following command: + + $ ./rbm/container run -- /bin/bash + +From this shell you should be able to remove the old containers +directories in the tmp directory. + +It is also possible to pass the rm command directly without opening a +shell: + + $ ./rbm/container run -- rm -Rf ./tmp/rbm-* + + Testing an rbm patch -------------------- diff --git a/projects/common/runc-config.json b/projects/common/runc-config.json deleted file mode 100644 index b078b97..0000000 --- a/projects/common/runc-config.json +++ /dev/null @@ -1,267 +0,0 @@ -{ - "ociVersion": "1.0.0[% IF !c("var_p/runc_spec100") %]-rc1[% END %]", - "platform": { - "os": "linux", - "arch": "amd64" - }, - "process": { - "terminal": [% IF c("interactive") %]true[% ELSE %]false[% END %], - "user": { - "uid": 0, - "gid": 0 - }, - "args": [ - "/rbm/run" - ], - "env": [ - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", - "TERM=xterm" - ], - "cwd": "/", -[% IF c("var_p/runc_spec100") -%] - "capabilities": { - "bounding": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE", - "CAP_SETGID", - "CAP_SETUID", - "CAP_MKNOD", - "CAP_SYS_CHROOT", -[% IF c("var/container/CAP_SYS_ADMIN") -%] - "CAP_SYS_ADMIN", -[% END -%] - "CAP_FSETID", - "CAP_FOWNER", - "CAP_DAC_OVERRIDE", - "CAP_CHOWN" - ], - "effective": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE", - "CAP_SETGID", - "CAP_SETUID", - "CAP_MKNOD", - "CAP_SYS_CHROOT", -[% IF c("var/container/CAP_SYS_ADMIN") -%] - "CAP_SYS_ADMIN", -[% END -%] - "CAP_FSETID", - "CAP_FOWNER", - "CAP_DAC_OVERRIDE", - "CAP_CHOWN" - ], - "inheritable": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE", - "CAP_SETGID", - "CAP_SETUID", - "CAP_MKNOD", - "CAP_SYS_CHROOT", -[% IF c("var/container/CAP_SYS_ADMIN") -%] - "CAP_SYS_ADMIN", -[% END -%] - "CAP_FSETID", - "CAP_FOWNER", - "CAP_DAC_OVERRIDE", - "CAP_CHOWN" - ], - "permitted": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE", - "CAP_SETGID", - "CAP_SETUID", - "CAP_MKNOD", - "CAP_SYS_CHROOT", -[% IF c("var/container/CAP_SYS_ADMIN") -%] - "CAP_SYS_ADMIN", -[% END -%] - "CAP_FSETID", - "CAP_FOWNER", - "CAP_DAC_OVERRIDE", - "CAP_CHOWN" - ], - "ambient": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE", - "CAP_SETGID", - "CAP_SETUID", - "CAP_MKNOD", - "CAP_SYS_CHROOT", -[% IF c("var/container/CAP_SYS_ADMIN") -%] - "CAP_SYS_ADMIN", -[% END -%] - "CAP_FSETID", - "CAP_FOWNER", - "CAP_DAC_OVERRIDE", - "CAP_CHOWN" - ] - }, -[% ELSE -%] - "capabilities": [ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE", - "CAP_SETGID", - "CAP_SETUID", - "CAP_MKNOD", - "CAP_SYS_CHROOT", -[% IF c("var/container/CAP_SYS_ADMIN") -%] - "CAP_SYS_ADMIN", -[% END -%] - "CAP_FSETID", - "CAP_FOWNER", - "CAP_DAC_OVERRIDE", - "CAP_CHOWN" - ], -[% END -%] - "noNewPrivileges": true - }, - "root": { - "path": "rootfs", - "readonly": false - }, - "hostname": "runc", - "mounts": [ - { - "destination": "/proc", - "type": "proc", - "source": "proc" - }, - { - "type": "bind", - "source": "/etc/resolv.conf", - "destination": "/etc/resolv.conf", - "options": [ - "rbind", - "ro" - ] - }, - { - "destination": "/dev", - "type": "tmpfs", - "source": "tmpfs", - "options": [ - "nosuid", - "strictatime", - "mode=755", - "size=65536k" - ] - }, - { - "destination": "/dev/pts", - "type": "devpts", - "source": "devpts", - "options": [ - "nosuid", - "noexec", - "newinstance", - "ptmxmode=0666", - "mode=0620", - "gid=5" - ] - }, - { - "destination": "/dev/shm", - "type": "tmpfs", - "source": "shm", - "options": [ - "nosuid", - "noexec", - "nodev", - "mode=1777", - "size=65536k" - ] - }, - { - "destination": "/dev/mqueue", - "type": "mqueue", - "source": "mqueue", - "options": [ - "nosuid", - "noexec", - "nodev" - ] - }, - { - "destination": "/sys", - "type": "sysfs", - "source": "sysfs", - "options": [ - "nosuid", - "noexec", - "nodev", - "ro" - ] - }, - { - "destination": "/sys/fs/cgroup", - "type": "cgroup", - "source": "cgroup", - "options": [ - "nosuid", - "noexec", - "nodev", - "relatime", - "ro" - ] - } - ], - "hooks": {}, - "linux": { - "resources": { - "devices": [ - { - "allow": false, - "access": "rwm" - } - ] - }, - "namespaces": [ - { - "type": "pid" - }, - { - "type": "ipc" - }, - { - "type": "uts" - }, -[% IF c("var/container/disable_network/" _ c("exec_name")) -%] - { - "type": "network", - "path": "/var/run/netns/rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %]" - }, -[% END -%] - { - "type": "mount" - } - ], - "maskedPaths": [ - "/proc/kcore", - "/proc/latency_stats", - "/proc/timer_stats", -[% IF c("var_p/runc_spec100") -%] - "/proc/timer_list", - "/sys/firmware", -[% END -%] - "/proc/sched_debug" - ], - "readonlyPaths": [ - "/proc/asound", - "/proc/bus", - "/proc/fs", - "/proc/irq", - "/proc/sys", - "/proc/sysrq-trigger" - ] - }, - "solaris": { - "cappedCPU": {}, - "cappedMemory": {} - } -} diff --git a/projects/container-image/config b/projects/container-image/config index 7520b8e..e0b8b13 100644 --- a/projects/container-image/config +++ b/projects/container-image/config @@ -70,9 +70,9 @@ remote_get: | SET dst = shell_quote(c('get_dst', { error_if_undef => 1 })); -%] mkdir -p "[% dst %]" - sudo tar -C "[% c("var/container/dir") %]/rootfs" -czf "[% dst %]/[% c("filename") %]" . + [% c("rbmdir") %]/container archive '[% c("var/container/dir") %]' "[% dst %]/[% c("filename") %]" input_files: - - project: debootstrap-image + - project: mmdebstrap-image target: - '[% c("var/container/suite") %]-[% c("var/container/arch") %]' diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config deleted file mode 100644 index 5098e29..0000000 --- a/projects/debootstrap-image/config +++ /dev/null @@ -1,80 +0,0 @@ -# vim: filetype=yaml sw=2 -filename: 'container-image_[% c("var/container/suite") %]-[% c("var/container/arch") %]-[% c("version") %].tar.gz' -version: 3 -pkg_type: build - -var: - ubuntu_version: 20.04.1 - - container: - use_container: 1 - # We need CAP_SYS_ADMIN for debootstrap to work - CAP_SYS_ADMIN: 1 - -pre: | - #!/bin/sh - set -e - export DEBIAN_FRONTEND=noninteractive - apt-get update -y -q - apt-get install -y -q debian-archive-keyring ubuntu-keyring debootstrap - debootstrap --arch=[% c("var/container/arch") %] [% c("var/container/debootstrap_opt") %] [% c("var/container/suite") %] base-image [% c("var/container/debootstrap_mirror") %] - [% IF c("var/apt_package_filename") || c("var/apt_utils_package_filename") || c("var/libapt_inst_package_filename") || c("var/libapt_pkg_package_filename") -%] - mkdir ./base-image/apt-update - mv [% c("var/apt_package_filename") %] [% c("var/apt_utils_package_filename") %] \ - [% c("var/libapt_inst_package_filename") %] [% c("var/libapt_pkg_package_filename") %] \ - ./base-image/apt-update - mount proc ./base-image/proc -t proc - mount sysfs ./base-image/sys -t sysfs - chroot ./base-image dpkg -i -R /apt-update - umount ./base-image/proc - umount ./base-image/sys - [% END -%] - [% IF c("var/minimal_apt_version") -%] - apt_version=$(dpkg --admindir=$(pwd)/base-image/var/lib/dpkg -s apt | grep '^Version: ' | cut -d ' ' -f 2) - echo "apt version: $apt_version" - dpkg --compare-versions "$apt_version" ge '[% c("var/minimal_apt_version") %]' - [% END -%] - tar -C ./base-image -czf [% dest_dir %]/[% c("filename") %] . - -targets: - jessie-amd64: - var: - minimal_apt_version: 1.0.9.8.7 - # CVE-2020-27350 - apt_packages_baseurl: https://deb.freexian.com/extended-lts/pool/main/a/apt - apt_package_filename: apt_1.0.9.8.7_amd64.deb - apt_package_sha256sum: 02d5c6240e3410234e91facd4279c1acdce1523b583e05fac7ad64bdc75db7c7 - apt_utils_package_filename: apt-utils_1.0.9.8.7_amd64.deb - apt_utils_package_sha256sum: aa6f0cc7cf2e7cc6e5c56782019cd651d26b01d280aef4d25288587e198ff2d3 - libapt_inst_package_filename: libapt-inst1.5_1.0.9.8.7_amd64.deb - libapt_inst_package_sha256sum: a85c99a64f3d6cdde5bf0849649c2d5f21c7513987854628659ea014bc3eb214 - libapt_pkg_package_filename: libapt-pkg4.12_1.0.9.8.7_amd64.deb - libapt_pkg_package_sha256sum: 0db2410376516f3420594647afc72dc99b48a44877eae4e8c79444a8244e988f - - container: - suite: jessie - arch: amd64 - - buster-amd64: - var: - minimal_apt_version: 1.8.2 - container: - suite: buster - arch: amd64 - -input_files: - - URL: 'https://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' - filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' - sha256sum: 97f6cbcf41f39272c84e32b6f926ed5d6906c6e463a557025181f4aa191ad667 - - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/apt_package_filename") %]' - sha256sum: '[% c("var/apt_package_sha256sum") %]' - enable: '[% c("var/apt_package_filename") %]' - - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/apt_utils_package_filename") %]' - sha256sum: '[% c("var/apt_utils_package_sha256sum") %]' - enable: '[% c("var/apt_utils_package_filename") %]' - - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/libapt_inst_package_filename") %]' - sha256sum: '[% c("var/libapt_inst_package_sha256sum") %]' - enable: '[% c("var/libapt_inst_package_filename") %]' - - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/libapt_pkg_package_filename") %]' - sha256sum: '[% c("var/libapt_pkg_package_sha256sum") %]' - enable: '[% c("var/libapt_pkg_package_filename") %]' diff --git a/projects/debootstrap-image/build b/projects/mmdebstrap-image/build similarity index 100% rename from projects/debootstrap-image/build rename to projects/mmdebstrap-image/build diff --git a/projects/mmdebstrap-image/config b/projects/mmdebstrap-image/config new file mode 100644 index 0000000..102053d --- /dev/null +++ b/projects/mmdebstrap-image/config @@ -0,0 +1,59 @@ +# vim: filetype=yaml sw=2 +filename: 'container-image_[% c("var/container/suite") %]-[% c("var/container/arch") %]-[% c("version") %].tar.gz' +version: 1 +pkg_type: build + +var: + ubuntu_version: 20.04.1 + + container: + use_container: 1 + +pre: | + #!/bin/sh + set -e + rootdir=$(pwd) + export DEBIAN_FRONTEND=noninteractive + apt-get update -y -q + apt-get install -y -q debian-archive-keyring ubuntu-keyring mmdebstrap gnupg patch + + export SOURCE_DATE_EPOCH='[% c("timestamp") %]' + tar -xf [% c('input_files_by_name/mmdebstrap') %] + # As a user namespace inside an other user namespace doesn't seem to work, + # we patch mmdebstrap to avoid creating a new user namespace + patch -d mmdebstrap -p1 < mmdebstrap-no-user-ns.patch + ./mmdebstrap/mmdebstrap --mode=unshare [% c("var/container/mmdebstrap_opt") %] [% c("var/container/suite") %] output.tar.gz [% c("var/container/debian_mirror") %] + + [% IF c("var/minimal_apt_version") -%] + mkdir base-image + tar -C base-image -xf output.tar.gz ./var/lib/dpkg + apt_version=$(dpkg --admindir=$rootdir/base-image/var/lib/dpkg -s apt | grep '^Version: ' | cut -d ' ' -f 2) + echo "apt version: $apt_version" + dpkg --compare-versions "$apt_version" ge '[% c("var/minimal_apt_version") %]' + [% END -%] + + mv output.tar.gz [% dest_dir %]/[% c("filename") %] + +targets: + jessie-amd64: + var: + minimal_apt_version: 1.0.9.8.6 + + container: + suite: jessie + arch: amd64 + + buster-amd64: + var: + minimal_apt_version: 1.8.2 + container: + suite: buster + arch: amd64 + +input_files: + - project: mmdebstrap + name: mmdebstrap + - URL: 'https://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' + filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' + sha256sum: 97f6cbcf41f39272c84e32b6f926ed5d6906c6e463a557025181f4aa191ad667 + - filename: mmdebstrap-no-user-ns.patch diff --git a/projects/mmdebstrap-image/mmdebstrap-no-user-ns.patch b/projects/mmdebstrap-image/mmdebstrap-no-user-ns.patch new file mode 100644 index 0000000..15c547e --- /dev/null +++ b/projects/mmdebstrap-image/mmdebstrap-no-user-ns.patch @@ -0,0 +1,30 @@ +diff --git a/mmdebstrap b/mmdebstrap +index 9b7d892..5d85a74 100755 +--- a/mmdebstrap ++++ b/mmdebstrap +@@ -204,6 +204,7 @@ sub get_tar_compressor { + } + + sub test_unshare { ++ return 1; + my $verbose = shift; + if ($EFFECTIVE_USER_ID == 0) { + my $msg = "cannot use unshare mode when executing as root"; +@@ -382,7 +383,7 @@ sub get_unshare_cmd { + my $idmap = shift; + + my $unshare_flags +- = $CLONE_NEWUSER | $CLONE_NEWNS | $CLONE_NEWPID | $CLONE_NEWUTS ++ = $CLONE_NEWNS | $CLONE_NEWPID | $CLONE_NEWUTS + | $CLONE_NEWIPC; + + if (0) { +@@ -457,6 +458,8 @@ sub get_unshare_cmd { + $gidmapcmd .= " $hostid $nsid $range"; + } + } ++ $uidmapcmd = ""; ++ $gidmapcmd = ""; + my $idmapcmd = ''; + if ($uidmapcmd ne "") { + 0 == system "newuidmap $ppid $uidmapcmd" diff --git a/projects/mmdebstrap/build b/projects/mmdebstrap/build new file mode 100644 index 0000000..ac0f21b --- /dev/null +++ b/projects/mmdebstrap/build @@ -0,0 +1,8 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +tar xf [% project %]-[% c("version") %].tar.gz +mv [% project %]-[% c("version") %] [% project %] +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/mmdebstrap/config b/projects/mmdebstrap/config new file mode 100644 index 0000000..8fbfc97 --- /dev/null +++ b/projects/mmdebstrap/config @@ -0,0 +1,5 @@ +# vim: filetype=yaml sw=2 +version: 655857e5259436755f34b908d07a6ebd4c8b0303 +git_url: http://gitlab.mister-muffin.de/josch/mmdebstrap.git +git_hash: '[% c("version") %]' +filename: '[% project %]-src-[% c("version") %]-[% c("var/build_id") %].tar.gz' diff --git a/rbm b/rbm index 15c8476..cfb4018 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 15c84760ebe3f2677d1212aa00ef6f7485446a69 +Subproject commit cfb4018d34400e43837e77754519b3c2761b7ae6 diff --git a/rbm.conf b/rbm.conf index 14a55a6..ba13cc0 100644 --- a/rbm.conf +++ b/rbm.conf @@ -495,13 +495,13 @@ gpg_wrapper: | exec [% c('gpg_bin') %] [% c('gpg_args') %] --with-fingerprint [% gpg_kr %] "$@" fi -remote_start: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_start") %][% END %]' -remote_exec: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_exec") %][% END %]' -remote_put: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_put") %][% END %]' -remote_get: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_get") %][% END %]' -remote_finish: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_finish") %][% END %]' +remote_start: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("container/remote_start") %][% END %]' +remote_exec: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("container/remote_exec") %][% END %]' +remote_put: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("container/remote_put") %][% END %]' +remote_get: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("container/remote_get") %][% END %]' +remote_finish: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("container/remote_finish") %][% END %]' -runc: +container: remote_start: | #!/bin/sh set -e @@ -511,11 +511,9 @@ runc: ls -l '[% c("remote_srcdir") %]' >&2 exit 1 fi - mkdir -p '[% c("var/container/dir") %]'/rootfs/rbm - sudo tar -C '[% c("var/container/dir") %]'/rootfs -xf $(ls -1 '[% c("remote_srcdir", { error_if_undef => 1 }) %]/container-image_'*) - [% SET user = c("var/container/user") -%] - [% c("remote_exec", { exec_as_root => 1, exec_cmd => 'id ' _ user - _ ' >/dev/null 2>&1 || adduser -m ' _ user _ ' || useradd -m ' _ user }) %] + [% c("rbmdir") %]/container extract '[% c("var/container/dir") %]' '[% c("remote_srcdir", { error_if_undef => 1 }) %]/container-image_'* + test -d '[% c("var/container/dir") %]'/home/rbm || \ + [% c("rbmdir") %]/container run --chroot='[% c("var/container/dir") %]' -- /usr/sbin/useradd -m [% c("var/container/user") %] remote_exec: | #!/bin/sh @@ -523,26 +521,27 @@ runc: [% IF c("interactive") -%] echo Container directory: [% shell_quote(c("var/container/dir")) %] [% END -%] - mkdir -p '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs/rbm - echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rootfs/rbm/cmd - echo [% shell_quote(c('exec_cmd')) %] >> '[% c("var/container/dir") %]'/rootfs/rbm/cmd - echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rootfs/rbm/run - [% IF c('exec_as_root'); SET user = 'root'; ELSE; SET user = c("var/container/user", { error_if_undef => 1 }); END; %] - echo 'su - [% user %] -c /rbm/cmd' >> '[% c("var/container/dir") %]'/rootfs/rbm/run - chmod +x '[% c("var/container/dir") %]'/rootfs/rbm/cmd - chmod +x '[% c("var/container/dir") %]'/rootfs/rbm/run - cat > '[% c("var/container/dir") %]'/config.json << EOF - [% INCLUDE 'runc-config.json' %] - EOF - [% IF c("var/container/disable_network/" _ c("exec_name")) -%] - sudo ip netns add 'rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %]' - # make sure the lo interface is up (see bug 31293) - sudo ip netns exec 'rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %]' ip link set lo up - [% END -%] - sudo runc [% IF c("var_p/runc100") %]run[% ELSE %]start[% END %] -b '[% c("var/container/dir") %]' rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %] [% IF c("runc_hide_stderr") %]2>/dev/null[% END %] + mkdir -p '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rbm + echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rbm/cmd + echo [% shell_quote(c('exec_cmd')) %] >> '[% c("var/container/dir") %]'/rbm/cmd + echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rbm/run [% IF c("var/container/disable_network/" _ c("exec_name")) -%] - sudo ip netns delete 'rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %]' + # Some programs such as gradle need the lo interface to be up. + # See for example tor-browser#31293 + echo 'ip link set lo up' >> '[% c("var/container/dir") %]'/rbm/run [% END -%] + [% IF c('exec_as_root'); SET user = 'root'; ELSE; SET user = c("var/container/user", { error_if_undef => 1 }); END; %] + echo 'su - [% user %] -c /rbm/cmd' >> '[% c("var/container/dir") %]'/rbm/run + chmod +x '[% c("var/container/dir") %]'/rbm/cmd + chmod +x '[% c("var/container/dir") %]'/rbm/run + [% + IF c("var/container/disable_network/" _ c("exec_name")); + SET disable_network = '--disable-network'; + ELSE; + SET disable_network = ''; + END; + -%] + [% c("rbmdir") %]/container run [% disable_network %] --chroot='[% c("var/container/dir") %]' -- /rbm/run remote_put: | #!/bin/sh @@ -551,12 +550,7 @@ runc: SET src = shell_quote(c('put_src', { error_if_undef => 1 })); SET dst = shell_quote(c('put_dst', { error_if_undef => 1 })); -%] - sudo mkdir -p '[% c("var/container/dir") %]'/rootfs/[% dst %] - sudo cp -aP [% src %] '[% c("var/container/dir") %]'/rootfs/[% dst %] - # On Ubuntu, the /root/.profile file contains a `mesg n` line which is - # producing some `stdin: is not a tty` messages. To hide them, we hide - # stderr from this part by setting runc_hide_stderr. - [% c("remote_exec", { exec_as_root => 1, exec_cmd => 'chown -R ' _ c("var/container/user") _ ' ' _ dst, runc_hide_stderr => 1 }) %] + [% c("rbmdir") %]/container put '[% c("var/container/dir") %]' [% src %] [% dst %] [% c("var/container/user") %] remote_get: | #!/bin/sh @@ -565,24 +559,12 @@ runc: SET src = shell_quote(c('get_src', { error_if_undef => 1 })); SET dst = shell_quote(c('get_dst', { error_if_undef => 1 })); -%] - mkdir -p [% dst %] - srcdir='[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs/[% src %] - sudo chown -R $(whoami) "$srcdir" - if [ $(ls -1 "$srcdir"/* 2> /dev/null | wc -l) -gt 0 ] - then - for file in "$srcdir"/* - do - bname="$(basename "$file")" - test -e [% dst %]/"$bname" && rm -Rf [% dst %]/"$bname" - mv -f "$file" [% dst %]/ - done - fi + [% c("rbmdir") %]/container get '[% c("var/container/dir") %]' [% src %] [% dst %] remote_finish: | #!/bin/sh set -e - sudo rm -Rf '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs '[% c("var/container/dir", { error_if_undef => 1 }) %]'/config.json - rmdir '[% c("var/container/dir") %]' + [% c("rbmdir") %]/container remove '[% c("var/container/dir") %]' ENV: TZ: UTC @@ -592,18 +574,6 @@ ENV: use IO::CaptureOutput qw(capture_exec); ( var_p => { - # runc100 is true if we are using runc >= 1.0.0 - # we assume that any version that is not 0.1.1 is >= 1.0.0 - runc100 => sub { - my ($out) = capture_exec('sudo', 'runc', '--version'); - return !($out =~ m/^runc version 0.1.1/); - }, - # runc_spec100 is true if runc spec is at least 1.0.0 - # We will need to update this when there is a new spec version available - runc_spec100 => sub { - my ($out) = capture_exec('sudo', 'runc', '--version'); - return $out =~ m/^.*spec: 1\.[0-9]+\.[0-9]+(?:-dev)?$/m; - }, nightly_torbrowser_version => sub { state $version = ''; return $version if $version;

1 0