[Pkg-privacy-commits] [Git][pkg-privacy-team/torbrowser-launcher][debian/sid] Fix apparmor restrictions for glycin/bwrap; 0.3.9-2

[Thomas Ward (@teward)]

Thomas Ward pushed to branch debian/sid at Privacy Maintainers / torbrowser-launcher


Commits:
de1024cb by Thomas Ward at 2026-08-19T23:56:36-04:00
Fix apparmor restrictions for glycin/bwrap; 0.3.9-2

- - - - -


3 changed files:

- debian/changelog
- + debian/patches/06-AppArmor-glycin-abstractions.patch
- debian/patches/series


Changes:

=====================================
debian/changelog
=====================================
@@ -1,9 +1,15 @@
-torbrowser-launcher (0.3.9-2) UNRELEASED; urgency=medium
+torbrowser-launcher (0.3.9-2) unstable; urgency=medium
 
   * d/control: Update homepage URL to torproject gitlab.
     (Requested via email to maintainers by upstream teams)
   * d/upstream/metadata: Update metadata URLs to reflect new 
     upstream repository home page data.
+  * d/patches/06-AppArmor-glycin-abstractions.patch: Modify the
+    torbrowser.Browser.firefox AppArmor rules to include the glycin
+    abstractions from AppArmor core. Necessary because of sandboxed 
+    image loading and the use of glycin:bwrap. Fixes saving/downloading 
+    of images and files.
+    (Fixes: #1130690, #1138831)
 
  -- Thomas Ward <teward at ubuntu.com>  Thu, 22 Jan 2026 12:20:25 -0500
 


=====================================
debian/patches/06-AppArmor-glycin-abstractions.patch
=====================================
@@ -0,0 +1,27 @@
+Description: <short description, required>
+ Due to TorBrowser/Firefox using glycin under the hood, and glycin having 
+ its own need for user namespaces and glycin:bwrap controls, the AppArmor 
+ core package has abstractions/glycin as an includeable abstractions set 
+ for any apps that require the use of glycin. In testing, this solves all 
+ issues observed by bugs #1130690 and #1138831.
+Author: Thomas Ward <teward at ubuntu.com>
+Bug-Debian: https://bugs.debian.org/1130690
+Bug-Debian: https://bugs.debian.org/1138831
+Last-Update: 2026-08-19
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/apparmor/torbrowser.Browser.firefox
++++ b/apparmor/torbrowser.Browser.firefox
+@@ -195,5 +195,12 @@
+   /etc/glvnd/egl_vendor.d/{*,.json} r,
+   /usr/share/glvnd/egl_vendor.d/{,*.json} r,
+ 
++  ### Debian Bugs #1120690, #1138831
++  # Because of the use of glycin, we need to use the glycin abstractions.
++  # This will solve the problems of saving/downloading because Firefox
++  # is using glycin/bwrap, and the abstractions/glycin profile
++  # has abstractions to permit Glycin loaders and glycin:bwrap.
++  #include if exists <abstractions/glycin>
++
+   #include <local/torbrowser.Browser.firefox>
+ }


=====================================
debian/patches/series
=====================================
@@ -3,3 +3,4 @@ po/03-Add-Chinese-Traditional-translation.patch
 01-Remove-use-of-deprecated-platform.dist-fixes-446.patch
 02-Update-apparmor-profile.patch
 05-Add-IBus-socket-access.patch
+06-AppArmor-glycin-abstractions.patch



View it on GitLab: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/de1024cbe646c69d0346d0c7b0eacc1f781b79e4

-- 
View it on GitLab: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/de1024cbe646c69d0346d0c7b0eacc1f781b79e4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-privacy-commits/attachments/20260820/69290a47/attachment-0001.htm>