[Pkg-privacy-maintainers] Bug#1152629: torbrowser-launcher: apparmor 5.0 breaks portals and --allow-remote usage

[Hefee]

Package: torbrowser-launcher
Version: 0.3.9-2
Severity: normal
Tags: patch upstream
X-Debbugs-Cc: hefee at debian.org

Hey,

with apparmor 5.0 the dbus interface is more stricly handled and that
breaks my --allow-remote usage. I use Tor Browser as default browser and
that's why I want to open urls from the outside.
There for Tor Birwser needs to be started with --allow-remote and that
creates a dbus interface. And also Tor Browser upstream wants to support
this usage:
https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/42595

Additionally I find it useful, if Tor Browser can use portals, as I like
to have a nice integration with my Desktop Environment.

I can fully unterstand that enable the remote is dangerous, so maybe we can ship a
apparmor.d/local/torbrowser.Browser.firefox.allow-remote
that a user can simple include in
apparmor.d/local/torbrowser.Browser.firefox

Regards,

hefee

Patch: the added dbus lines in
/etc/apparmor.d/torbrowser.Browser.firefox

-- System Information:
Debian Release: forky/sid
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (500, 'oldstable'), (100, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 7.2.12+deb14-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=en_US
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages torbrowser-launcher depends on:
ii  ca-certificates             20260816+nmu1
ii  gnupg                       2.4.9-8
ii  libasound2t64 [libasound2]  1.2.16.1-2
ii  libdbus-glib-1-2            0.116-1
ii  libgtk-3-0t64 [libgtk-3-0]  3.24.52-3
ii  python3                     3.14.8-1
ii  python3-gpg                 2.0.0-3+b2
ii  python3-packaging           26.2-3
ii  python3-pyside6.qtcore      6.11.2-2
ii  python3-pyside6.qtgui       6.11.2-2
ii  python3-pyside6.qtwidgets   6.11.2-2
ii  python3-requests            2.34.2-1
ii  python3-socks               1.7.1+dfsg-2

Versions of packages torbrowser-launcher recommends:
ii  tor  0.4.9.15-1

Versions of packages torbrowser-launcher suggests:
ii  apparmor  5.0.2-5

-- Configuration Files:
/etc/apparmor.d/torbrowser.Browser.firefox changed:
@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser/Browser/firefox.real
profile torbrowser_firefox @{torbrowser_firefox_executable} {
[...]
  #dbus,
  network netlink raw,
  network tcp,
  
  dbus send bus=session path=/org/a11y/bus interface=org.freedesktop.DBus.Properties member=GetAll peer=(label=unconfined),
  dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=ReleaseName peer=(label=unconfined),
  dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=RequestName peer=(label=unconfined),
  
  dbus receive bus=session path=/ interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(label=unconfined),
  dbus receive bus=session path=/org interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(label=unconfined),
  
  dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Settings member=ReadAll peer=(label=unconfined),
  dbus receive bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Settings member=SettingChanged peer=(label=unconfined),

  # file picker portl
  dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.DBus.Properties member=GetAll peer=(label=unconfined),
  dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.host.portal.Registry member=Register peer=(label=unconfined),
  dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.FileChooser member=SaveFile peer=(label=unconfined),
  dbus receive bus=session path=/org/freedesktop/portal/desktop/request/* interface=org.freedesktop.portal.Request member=Response peer=(label=unconfined),
 
  # Needed for --allow-remote to be able to open url in tabs/windows https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/42595
  dbus bind bus=session name=org.torproject.firefox.*,
  dbus send bus=session path=/org/mozilla/firefox/Remote interface=org.freedesktop.DBus.Properties member=GetAll peer=(label=torbrowser_firefox),
  dbus receive bus=session path=/org/mozilla/firefox/Remote interface=org.freedesktop.DBus.Properties member=GetAll peer=(label=torbrowser_firefox),
  dbus send bus=session path=/org/mozilla/firefox/Remote interface=org.mozilla.firefox member=OpenURL peer=(label=torbrowser_firefox),
  dbus receive bus=session path=/org/mozilla/firefox/Remote interface=org.mozilla.firefox member=OpenURL peer=(label=torbrowser_firefox),
  
  dbus receive bus=session path=/org/torproject interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(label=unconfined),
  dbus receive bus=session path=/org/torproject/firefox interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(label=unconfined),
  dbus receive bus=session path=/org/torproject/firefox/Remote interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(label=unconfined),
  
  dbus send bus=session path=/org/torproject/firefox/Remote interface=org.freedesktop.DBus.Properties member=GetAll peer=(label=torbrowser_firefox),
  dbus receive bus=session path=/org/torproject/firefox/Remote interface=org.freedesktop.DBus.Properties member=GetAll peer=(label=torbrowser_firefox),
  dbus send bus=session path=/org/torproject/firefox/Remote interface=org.torproject.firefox member=OpenURL peer=(label=torbrowser_firefox),
  dbus receive bus=session path=/org/torproject/firefox/Remote interface=org.torproject.firefox member=OpenURL peer=(label=torbrowser_firefox),
  
  # ibus socket
  owner @{HOME}/.cache/ibus/dbus-* rw,
[...]
}


-- no debconf information