boklm pushed to branch main at The Tor Project / Applications / torbrowser-launcher
Commits:
6ec48451 by Fei1Yang at 2023-09-21T08:40:50+00:00
Fix path variables in AppArmor profile
- - - - -
629493a6 by anonym at 2023-09-28T15:06:51+02:00
AppArmor: allow executing glxtest
This "Firefox OpenGL probe utility" was added in Tor Browser 13.
- - - - -
41f20588 by anonym at 2023-09-28T15:07:16+02:00
AppArmor: allow reading/writing to /proc/PID/oom_score_adj
Firefox adjusts the OOM scores of its processes so that if they are
reaped they are killed in a sane order, e.g. the parent process last.
Source: hal/linux/LinuxProcessPriority.cpp
- - - - -
b257da03 by anonym at 2023-09-28T15:08:01+02:00
AppArmor: give read access to proc info about which command the browser's threads use
- - - - -
29e1fe41 by anonym at 2023-09-28T15:08:17+02:00
AppArmor: silence denial of sys_ptrace capability
We already allow ptrace for its relevant subprocesses via ptrace
rules, and I'm unsure if the full capability is really needed. I see
lots of other profiles which have ptrace rules without the capability
so I guess not. And I wonder if allowing the capability allows ptrace
for arbitrary processes, which would be really bad.
So let's assume it's not needed and we'll see what happens.
- - - - -
b80e0078 by anonym at 2023-09-28T15:08:58+02:00
AppArmor: silence denial to read /sys/class/input/
It is unclear to me what this is about.
- - - - -
25ebbe67 by intrigeri at 2023-10-04T11:13:50+02:00
Merge pull request #702 from Fei1Yang/apparmor-path
Fix path variables in AppArmor profile
- - - - -
4652b442 by intrigeri at 2023-10-04T11:25:46+02:00
Merge pull request #709 from anonym/tor-browser-13.0
Adapt AppArmor profile for Tor browser 13.0
- - - - -
3 changed files:
- apparmor/torbrowser.Browser.firefox
- apparmor/torbrowser.Tor.tor
- apparmor/tunables/torbrowser
Changes:
=====================================
apparmor/torbrowser.Browser.firefox
=====================================
@@ -1,7 +1,7 @@
#include <tunables/global>
#include <tunables/torbrowser>
-@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real
+@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser/Browser/firefox.real
profile torbrowser_firefox @{torbrowser_firefox_executable} {
#include <abstractions/audio>
@@ -12,6 +12,8 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
#include <abstractions/opencl>
#include if exists <abstractions/vulkan>
+ deny capability sys_ptrace,
+
# Uncomment the following lines if you want to give the Tor Browser read-write
# access to most of your personal files.
# #include <abstractions/user-download>
@@ -46,10 +48,13 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
owner @{PROC}/@{pid}/environ r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
+ owner @{PROC}/@{pid}/oom_score_adj rw,
owner @{PROC}/@{pid}/smaps r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/statm r,
owner @{PROC}/@{pid}/status r,
+ owner @{PROC}/@{pid}/task/ r,
+ owner @{PROC}/@{pid}/task/*/comm r,
owner @{PROC}/@{pid}/task/*/stat r,
@{PROC}/sys/kernel/random/uuid r,
@@ -70,6 +75,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
owner @{torbrowser_home_dir}/Downloads/ rwk,
owner @{torbrowser_home_dir}/Downloads/** rwk,
owner @{torbrowser_home_dir}/firefox rix,
+ owner @{torbrowser_home_dir}/glxtest ix,
owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/* rw,
owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/{,MozUpdater/bgupdate/}updater ix,
owner @{torbrowser_home_dir}/updater ix,
@@ -111,6 +117,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
/sys/devices/system/node/ r,
/sys/devices/system/node/node[0-9]*/meminfo r,
/sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_quota_us r,
+ deny /sys/class/input/ r,
deny /sys/devices/virtual/block/*/uevent r,
# Should use abstractions/gstreamer instead once merged upstream
=====================================
apparmor/torbrowser.Tor.tor
=====================================
@@ -1,7 +1,7 @@
#include <tunables/global>
#include <tunables/torbrowser>
-@{torbrowser_tor_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/tor
+@{torbrowser_tor_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser/Browser/TorBrowser/Tor/tor
profile torbrowser_tor @{torbrowser_tor_executable} {
#include <abstractions/base>
=====================================
apparmor/tunables/torbrowser
=====================================
@@ -1,2 +1,2 @@
-@{torbrowser_installation_dir}=@{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*
+@{torbrowser_installation_dir}=@{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser
@{torbrowser_home_dir}=@{torbrowser_installation_dir}/Browser
View it on GitLab: https://gitlab.torproject.org/tpo/applications/torbrowser-launcher/-/compar…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/torbrowser-launcher/-/compar…
You're receiving this email because of your account on gitlab.torproject.org.
Pier Angelo Vendrame pushed to branch maint-13.0 at The Tor Project / Applications / tor-browser-build
Commits:
d355fa8c by Pier Angelo Vendrame at 2023-10-03T19:48:02+02:00
Bug 40972: Tweaks to the changelog script for MB and group projects
The changelog script works well also with Mullvad Browser, but there
are a few changes we need to do every time we use it for MB instead of
TBB.
With this commit we automate them.
In addition to that, we group items by project, as it makes reading the
changelog easier.
- - - - -
1 changed file:
- tools/fetch-changelogs.py
Changes:
=====================================
tools/fetch-changelogs.py
=====================================
@@ -2,6 +2,7 @@
from datetime import datetime
import enum
from pathlib import Path
+import re
import sys
import requests
@@ -11,6 +12,16 @@ GITLAB = "https://gitlab.torproject.org"
API_URL = f"{GITLAB}/api/v4"
PROJECT_ID = 473
+is_mb = False
+project_order = {
+ "tor-browser-spec": 0,
+ # Leave 1 free, so we can redefine mullvad-browser when needed.
+ "tor-browser": 2,
+ "tor-browser-build": 3,
+ "mullvad-browser": 4,
+ "rbm": 5,
+}
+
class Platform(enum.IntFlag):
WINDOWS = 8
@@ -27,6 +38,7 @@ class Issue:
self.project, self.number = (
j["references"]["full"].rsplit("/", 2)[-1].split("#")
)
+ self.number = int(self.number)
self.platform = 0
self.num_platforms = 0
if "Desktop" in j["labels"]:
@@ -43,9 +55,14 @@ class Issue:
self.platform |= Platform.LINUX
self.num_platforms += 1
if "Android" in j["labels"]:
- self.platform |= Platform.ANDROID
- self.num_platforms += 1
- if not self.platform:
+ if is_mb and self.num_platforms == 0:
+ raise Exception(
+ f"Android-only issue on Mullvad Browser: {j['references']['full']}!"
+ )
+ elif not is_mb:
+ self.platform |= Platform.ANDROID
+ self.num_platforms += 1
+ if not self.platform or (is_mb and self.platform == Platform.DESKTOP):
self.platform = Platform.ALL_PLATFORMS
self.num_platforms = 4
self.is_build = "Build System" in j["labels"]
@@ -68,7 +85,9 @@ class Issue:
return f"Bug {self.number}: {self.title} [{self.project}]"
def __lt__(self, other):
- return self.number < other.number
+ if self.project == other.project:
+ return self.number < other.number
+ return project_order[self.project] < project_order[other.project]
def sorted_issues(issues):
@@ -125,7 +144,7 @@ elif len(issues) > 1:
sys.exit(4)
else:
iid = version
- version = None
+ version = "CHANGEME!"
if iid[0] == "#":
iid = iid[1:]
try:
@@ -136,6 +155,9 @@ else:
)
if r.ok and r.json():
issue = r.json()[0]
+ version_match = re.search(r"\b[0-9]+\.[.0-9a]+\b", issue["title"])
+ if version_match:
+ version = version_match.group()
except ValueError:
pass
if not issue:
@@ -143,6 +165,9 @@ if not issue:
"Release preparation issue not found. Please make sure it has ~Release Prep."
)
sys.exit(5)
+if "Sponsor 131" in issue["labels"]:
+ is_mb = True
+ project_order["mullvad-browser"] = 1
iid = issue["iid"]
linked = {}
@@ -159,8 +184,9 @@ for i in r.json():
linked = sorted_issues(linked)
linked_build = sorted_issues(linked_build)
+name = "Mullvad" if is_mb else "Tor"
date = datetime.now().strftime("%B %d %Y")
-print(f"Tor Browser {version} - {date}")
+print(f"{name} Browser {version} - {date}")
for issues in linked:
print(f" * {issues[0].get_platforms()}")
for i in issues:
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/d…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/d…
You're receiving this email because of your account on gitlab.torproject.org.
Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build
Commits:
d355fa8c by Pier Angelo Vendrame at 2023-10-03T19:48:02+02:00
Bug 40972: Tweaks to the changelog script for MB and group projects
The changelog script works well also with Mullvad Browser, but there
are a few changes we need to do every time we use it for MB instead of
TBB.
With this commit we automate them.
In addition to that, we group items by project, as it makes reading the
changelog easier.
- - - - -
1 changed file:
- tools/fetch-changelogs.py
Changes:
=====================================
tools/fetch-changelogs.py
=====================================
@@ -2,6 +2,7 @@
from datetime import datetime
import enum
from pathlib import Path
+import re
import sys
import requests
@@ -11,6 +12,16 @@ GITLAB = "https://gitlab.torproject.org"
API_URL = f"{GITLAB}/api/v4"
PROJECT_ID = 473
+is_mb = False
+project_order = {
+ "tor-browser-spec": 0,
+ # Leave 1 free, so we can redefine mullvad-browser when needed.
+ "tor-browser": 2,
+ "tor-browser-build": 3,
+ "mullvad-browser": 4,
+ "rbm": 5,
+}
+
class Platform(enum.IntFlag):
WINDOWS = 8
@@ -27,6 +38,7 @@ class Issue:
self.project, self.number = (
j["references"]["full"].rsplit("/", 2)[-1].split("#")
)
+ self.number = int(self.number)
self.platform = 0
self.num_platforms = 0
if "Desktop" in j["labels"]:
@@ -43,9 +55,14 @@ class Issue:
self.platform |= Platform.LINUX
self.num_platforms += 1
if "Android" in j["labels"]:
- self.platform |= Platform.ANDROID
- self.num_platforms += 1
- if not self.platform:
+ if is_mb and self.num_platforms == 0:
+ raise Exception(
+ f"Android-only issue on Mullvad Browser: {j['references']['full']}!"
+ )
+ elif not is_mb:
+ self.platform |= Platform.ANDROID
+ self.num_platforms += 1
+ if not self.platform or (is_mb and self.platform == Platform.DESKTOP):
self.platform = Platform.ALL_PLATFORMS
self.num_platforms = 4
self.is_build = "Build System" in j["labels"]
@@ -68,7 +85,9 @@ class Issue:
return f"Bug {self.number}: {self.title} [{self.project}]"
def __lt__(self, other):
- return self.number < other.number
+ if self.project == other.project:
+ return self.number < other.number
+ return project_order[self.project] < project_order[other.project]
def sorted_issues(issues):
@@ -125,7 +144,7 @@ elif len(issues) > 1:
sys.exit(4)
else:
iid = version
- version = None
+ version = "CHANGEME!"
if iid[0] == "#":
iid = iid[1:]
try:
@@ -136,6 +155,9 @@ else:
)
if r.ok and r.json():
issue = r.json()[0]
+ version_match = re.search(r"\b[0-9]+\.[.0-9a]+\b", issue["title"])
+ if version_match:
+ version = version_match.group()
except ValueError:
pass
if not issue:
@@ -143,6 +165,9 @@ if not issue:
"Release preparation issue not found. Please make sure it has ~Release Prep."
)
sys.exit(5)
+if "Sponsor 131" in issue["labels"]:
+ is_mb = True
+ project_order["mullvad-browser"] = 1
iid = issue["iid"]
linked = {}
@@ -159,8 +184,9 @@ for i in r.json():
linked = sorted_issues(linked)
linked_build = sorted_issues(linked_build)
+name = "Mullvad" if is_mb else "Tor"
date = datetime.now().strftime("%B %d %Y")
-print(f"Tor Browser {version} - {date}")
+print(f"{name} Browser {version} - {date}")
for issues in linked:
print(f" * {issues[0].get_platforms()}")
for i in issues:
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/d…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/d…
You're receiving this email because of your account on gitlab.torproject.org.
Dan Ballard pushed to branch firefox-android-115.2.1-13.0-1 at The Tor Project / Applications / firefox-android
Commits:
b62cfff5 by clairehurst at 2023-10-02T10:51:52-06:00
fixup! Modify UI/UX
- - - - -
1 changed file:
- fenix/app/src/main/java/org/mozilla/fenix/components/toolbar/BrowserToolbarCFRPresenter.kt
Changes:
=====================================
fenix/app/src/main/java/org/mozilla/fenix/components/toolbar/BrowserToolbarCFRPresenter.kt
=====================================
@@ -70,7 +70,7 @@ class BrowserToolbarCFRPresenter(
*/
@Suppress("MagicNumber")
fun start() {
- if (shouldShowCFR()) {
+ if (false) { //shouldShowCFR()
tcpCfrScope = browserStore.flowScoped { flow ->
flow
.mapNotNull { it.findCustomTabOrSelectedTab(sessionId)?.content?.progress }
View it on GitLab: https://gitlab.torproject.org/tpo/applications/firefox-android/-/commit/b62…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/firefox-android/-/commit/b62…
You're receiving this email because of your account on gitlab.torproject.org.
Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build
Commits:
bbea08af by Pier Angelo Vendrame at 2023-10-03T09:26:45+02:00
Bug 40971: Do not ship Linux i686 debug symbols.
Debug symbols are not actually genereated because we used to have a
linking problem when they were enabled. So, we have been shipping a
tiny package only with generated headers in the last alphas.
Hopefully, this is a temporary change, so I disabled only the final
copy in projects/browser/build, but left the step in
projects/firefox/build enabled.
- - - - -
1 changed file:
- projects/browser/build
Changes:
=====================================
projects/browser/build
=====================================
@@ -414,9 +414,10 @@ SCRIPT_EOF
[% IF c("var/updater_enabled") -%]
cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/
[% END -%]
-[% IF c("var/linux") -%]
+[% IF c("var/linux-x86_64") -%]
+ # TODO: See if we can make symbols also for Linux i686, see tor-browser#42146.
cp $rootdir/[% c('input_files_by_name/firefox') %]/browser-debug-symbols.tar.xz "$OUTDIR/[% c('var/project-name') %]-debug-symbols-[% c('var/mar_osname') %]-[% c('var/torbrowser_version') %].tar.xz"
- [% IF c("var/linux-x86_64") && !c("var/asan") -%]
+ [% IF !c("var/asan") -%]
cp $rootdir/[% c('input_files_by_name/firefox') %]/geckodriver.tar.xz "$OUTDIR/geckodriver-[% c('var/mar_osname') %]-[% c('var/torbrowser_version') %].tar.xz"
[% END -%]
[% ELSIF c("var/windows") -%]
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b…
You're receiving this email because of your account on gitlab.torproject.org.