[Pkg-privacy-commits] [torbrowser-launcher] 01/02: Add patches to make torbrowser-launcher work with AppArmor enabled on Linux 4.14.

[Intrigeri]

This is an automated email from the git hooks/post-receive script.

intrigeri pushed a commit to branch debian/sid
in repository torbrowser-launcher.

commit a9ddd00736431e7764a7fd6e99fe427ebf8c76c6
Author: intrigeri <intrigeri at boum.org>
Date:   Thu Oct 26 11:37:44 2017 +0000

    Add patches to make torbrowser-launcher work with AppArmor enabled on Linux 4.14.
---
 ...d-rules-needed-with-new-mediation-support.patch | 51 ++++++++++++++++++++++
 ...ant-access-to-mostly-innocuous-stuff-Fire.patch | 23 ++++++++++
 debian/patches/series                              |  2 +
 3 files changed, 76 insertions(+)

diff --git a/debian/patches/0004-AppArmor-add-rules-needed-with-new-mediation-support.patch b/debian/patches/0004-AppArmor-add-rules-needed-with-new-mediation-support.patch
new file mode 100644
index 0000000..df7d9e0
--- /dev/null
+++ b/debian/patches/0004-AppArmor-add-rules-needed-with-new-mediation-support.patch
@@ -0,0 +1,51 @@
+From: intrigeri <intrigeri at boum.org>
+Date: Thu, 26 Oct 2017 11:12:05 +0000
+Subject: AppArmor: add rules needed with new mediation support added in Linux 4.14.
+Forwarded: https://github.com/micahflee/torbrowser-launcher/pull/294
+
+---
+ apparmor/torbrowser.Browser.firefox | 3 +++
+ apparmor/torbrowser.Tor.tor         | 7 +++++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
+index b1883c6..39ac6a2 100644
+--- a/apparmor/torbrowser.Browser.firefox
++++ b/apparmor/torbrowser.Browser.firefox
+@@ -15,8 +15,11 @@
+   # @{HOME}/ r,
+ 
+   #dbus,
++  network netlink raw,
+   network tcp,
+ 
++  ptrace (trace) peer=@{profile_name},
++
+   deny /etc/host.conf r,
+   deny /etc/hosts r,
+   deny /etc/nsswitch.conf r,
+diff --git a/apparmor/torbrowser.Tor.tor b/apparmor/torbrowser.Tor.tor
+index 2410637..0ccd737 100644
+--- a/apparmor/torbrowser.Tor.tor
++++ b/apparmor/torbrowser.Tor.tor
+@@ -3,6 +3,7 @@
+ /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Tor/tor {
+   #include <abstractions/base>
+ 
++  network netlink raw,
+   network tcp,
+   network udp,
+ 
+@@ -17,6 +18,12 @@
+   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/Tor,Lib}/*.so mr,
+   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/Tor,Lib}/*.so.* mr,
+ 
++  # Silence file_inherit logs
++  deny @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/{browser/,}omni.ja r,
++  deny @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Browser/profile.default/.parentlock rw,
++  deny @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Browser/profile.default/extensions/*.xpi r,
++  deny @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Browser/profile.default/startupCache/* r,
++
+   @{PROC}/sys/kernel/random/uuid r,
+   /sys/devices/system/cpu/ r,
+ 
diff --git a/debian/patches/0005-AppArmor-grant-access-to-mostly-innocuous-stuff-Fire.patch b/debian/patches/0005-AppArmor-grant-access-to-mostly-innocuous-stuff-Fire.patch
new file mode 100644
index 0000000..3a1abf4
--- /dev/null
+++ b/debian/patches/0005-AppArmor-grant-access-to-mostly-innocuous-stuff-Fire.patch
@@ -0,0 +1,23 @@
+From: intrigeri <intrigeri at boum.org>
+Date: Thu, 26 Oct 2017 11:12:52 +0000
+Subject: AppArmor: grant access to mostly innocuous stuff Firefox tries to read.
+Forwarded: https://github.com/micahflee/torbrowser-launcher/pull/294
+---
+ apparmor/torbrowser.Browser.firefox | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
+index 39ac6a2..6a2c148 100644
+--- a/apparmor/torbrowser.Browser.firefox
++++ b/apparmor/torbrowser.Browser.firefox
+@@ -31,6 +31,10 @@
+   deny /etc/machine-id r,
+   deny /var/lib/dbus/machine-id r,
+ 
++  /dev/ r,
++  /dev/shm/ r,
++
++  owner @{PROC}/@{pid}/fd/ r,
+   owner @{PROC}/@{pid}/mountinfo r,
+   owner @{PROC}/@{pid}/stat r,
+   owner @{PROC}/@{pid}/status r,
diff --git a/debian/patches/series b/debian/patches/series
index ba90726..d26ae6d 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,5 @@
 0001-AppArmor-support-sysvinit-systems.patch
 0002-Update-mirror-list.patch
 0003-AppArmor-allow-the-tor-process-to-modify-its-data-di.patch
+0004-AppArmor-add-rules-needed-with-new-mediation-support.patch
+0005-AppArmor-grant-access-to-mostly-innocuous-stuff-Fire.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-privacy/packages/torbrowser-launcher.git