Unverified Commit 767dd879 authored by Georg Koppen's avatar Georg Koppen
Browse files

Bug 26438: Remove seatbelt profiles for macOS 

Starting with content sandboxing being enabled our seatbelt profiles
have been broken (see: #22000). We should remove them for now to avoid
a broken experience in the alphas.
parent 951b1a7e

projects/tor-browser/Bundle-Data/mac-sandbox/.DS_Store

deleted100644 → 0
−6 KiB

File deleted.

View file

projects/tor-browser/Bundle-Data/mac-sandbox/README.txt

deleted100644 → 0
+0 −29
Original line number Diff line number Diff line 
Experimental Sandboxed Tor Browser for OS X



Requirements:

  Mac OS 10.9 or newer.

  A willingness to run shell commands from Terminal.



Follow these steps to use the sandbox profiles:



1. Copy this folder ("Sandboxed Tor Browser") to a local drive, but do not

   put it in /Applications.

2. Copy the TorBrowser app into your "Sandboxed Tor Browser" folder.

3. Open Terminal.

4. Run start-tor-with-sandbox and wait for Tor bootstrapping to finish.

5. Run start-browser-with-sandbox.



Known Issues:



You will need to manually kill start-tor-with-sandbox or the tor.real

process after you exit the browser.



The browser has full access to the Tor control port. Ideally, access

would be limited to the things that are necessary for New Identity and

for the circuit display features.



Printing does not work.



The built-in updater will not work.



Files can only be downloaded or saved to ~/Downloads.

projects/tor-browser/Bundle-Data/mac-sandbox/start-browser-with-sandbox

deleted100755 → 0
+0 −24
Original line number Diff line number Diff line 
#!/bin/bash



# TODO: assumes not in /Applications

# TODO: assumes app is in TorBrowser.app



BASEDIR="`dirname \"$0\"`"

BASEDIR="`(cd \"$BASEDIR\" && pwd)`"

TORBROWSER_APP_DIR="$BASEDIR/TorBrowser.app"

TORBROWSER_DATA_DIR="$BASEDIR/TorBrowser-Data"

TOR_DATA_DIR="$TORBROWSER_DATA_DIR/Tor"

SOCKETDIR="/tmp/Tor"



export TOR_SKIP_LAUNCH=1

export TOR_CONTROL_IPC_PATH="$SOCKETDIR/control.socket"

export TOR_SOCKS_IPC_PATH="$SOCKETDIR/socks.socket"

export TOR_CONTROL_COOKIE_AUTH_FILE="$TOR_DATA_DIR/control_auth_cookie"

SB_PROFILE="`pwd`/tb.sb"

cd "$TORBROWSER_APP_DIR"

sandbox-exec -f "$SB_PROFILE"							\

	-D "HOME_DIR=$HOME"									\

	-D "CURRENT_DIR=$BASEDIR"							\

	-D "TORBROWSER_APP_DIR=$TORBROWSER_APP_DIR"			\

	-D "TORBROWSER_DATA_DIR=$TORBROWSER_DATA_DIR"		\

	"./Contents/MacOS/firefox"

projects/tor-browser/Bundle-Data/mac-sandbox/start-tor-with-sandbox

deleted100755 → 0
+0 −42
Original line number Diff line number Diff line 
#!/bin/bash



# TODO: assumes not in /Applications

# TODO: assumes /tmp/Tor is not used by anyone else.

# TODO: assumes app is in TorBrowser.app



set -e



BASEDIR="`dirname \"$0\"`"

BASEDIR="`(cd \"$BASEDIR\" && pwd)`"

TOR_DATA_DIR="$BASEDIR/TorBrowser-Data/Tor"

TOR_STATIC_DATA_DIR="$BASEDIR/TorBrowser.app/Contents/Resources/TorBrowser/Tor"

TOR_BIN_DIR="$BASEDIR/TorBrowser.app/Contents/MacOS/Tor"

TORRC="$TOR_DATA_DIR/torrc"

SOCKETDIR="/tmp/Tor"



# Compiled Python modules require a compatible Python, which means 32-bit 2.6.

export VERSIONER_PYTHON_VERSION=2.6

export DYLD_LIBRARY_PATH=.:$DYLD_LIBRARY_PATH



mkdir -p "$TOR_DATA_DIR"

if [ ! -e "$TORRC" ]; then

	touch "$TORRC"

fi



if [ ! -e "$SOCKETDIR" ]; then

	mkdir -p "$SOCKETDIR"

	chmod 700 "$SOCKETDIR"

fi



TOR="$TOR_BIN_DIR/tor.real"

sandbox-exec -f tor.sb -D "TOR_DATA_DIR=$TOR_DATA_DIR" \

	-D "TOR_STATIC_DATA_DIR=$TOR_STATIC_DATA_DIR" \

	-D "TOR_BIN_DIR=$TOR_BIN_DIR" "$TOR" \

	--defaults-torrc "$TOR_STATIC_DATA_DIR/torrc-defaults" \

	-f "$TORRC" \

	CookieAuthentication 1 \

	DataDirectory "$TOR_DATA_DIR" \

	GeoIPFile "$TOR_STATIC_DATA_DIR/geoip" \

	GeoIPv6File "$TOR_STATIC_DATA_DIR/geoip6" \

	ControlPort "unix:$SOCKETDIR/control.socket" \

	SocksPort "unix:$SOCKETDIR/socks.socket"

projects/tor-browser/Bundle-Data/mac-sandbox/tb.sb

deleted100644 → 0
+0 −122
Original line number Diff line number Diff line 
(version 1)



;; Parameters:

;;   HOME_DIR             the user's home directory

;;   CURRENT_DIR          the current working directory

;;   TORBROWSER_APP_DIR   the TorBrowser.app directory

;;   TORBROWSER_DATA_DIR  the TorBrowser-Data directory



;; TODO: can see all dirs but can download/save only in Downloads (no error reported though!)

;; TODO: printing does not work (Save to PDF does).



(deny default)



(define (home-path aSubPath)

    (path (string-append (param "HOME_DIR") aSubPath)))



(define (home-subpath aSubPath)

    (subpath (string-append (param "HOME_DIR") aSubPath)))



(define (torbrowser-data-dir-path aSubPath)

    (path (string-append (param "TORBROWSER_DATA_DIR") aSubPath)))



(define (torbrowser-data-dir-subpath aSubPath)

    (subpath (string-append (param "TORBROWSER_DATA_DIR") aSubPath)))



(define (torbrowser-app-dir-path aSubPath)

    (subpath (string-append (param "TORBROWSER_APP_DIR") aSubPath)))



(allow file-read*

       (path "/Library/Preferences/com.apple.HIToolbox.plist")

       (path "/Library/Preferences/com.apple.ViewBridge.plist")

       (path "/Library/Preferences/.GlobalPreferences.plist")

       (path "/dev/random")

       (path "/dev/urandom")

       (path "/dev/dtracehelper")

       (path "/private/etc/localtime")

       (path "/private/etc/passwd")

       (path "/private/tmp")

       (path "/private/var/tmp")

       (path (param "HOME_DIR"))

       (subpath "/Library/Audio")

       (subpath "/Library/Fonts")

       (subpath "/System")

       (subpath "/private/var/folders")

       (subpath "/usr/lib")

       (subpath "/usr/share")

       (home-subpath "/Downloads")

       (home-subpath "/Library/Input Methods")

       (home-subpath "/Library/Keyboard Layouts")

       (home-subpath "/Library/Preferences")

       (torbrowser-app-dir-path "")

       (torbrowser-data-dir-path "")

       (torbrowser-data-dir-subpath "/Browser")

       (torbrowser-data-dir-path "/Tor/control_auth_cookie")

)



(allow file-read-metadata

       (home-path "/Desktop")

       (home-path "/Library")

       (home-path "/Library/Saved Application State")

       (path (param "CURRENT_DIR"))

       (path "/")

       (path "/Applications")

       (path "/Users")

       (path "/etc")

       (path "/home")

       (path "/net")

       (path "/private/var/db/.AppleSetupDone")

       (path "/tmp")

       (path "/var")

       (torbrowser-data-dir-path "/Tor/control.socket")

       (torbrowser-data-dir-path "/Tor/socks.socket")

       (path-regex "/private/tmp/Tor[-0-9]*/control.socket")

       (path-regex "/private/tmp/Tor[-0-9]*/socks.socket")

)



(allow file-write-data file-ioctl

       (path "/dev/dtracehelper")

)



(allow file-write*

       (home-subpath "/Downloads")

       (home-path "/Library/Preferences/.GlobalPreferences.plist")

       (torbrowser-data-dir-subpath "/Browser")

       (subpath "/private/var/folders")

       (path-regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/org.mozilla.tor"))

       (path "/Library/Preferences/.GlobalPreferences.plist")

)



(allow iokit-open)



(allow ipc-posix-shm

       (ipc-posix-name "apple.shm.notification_center")

       (ipc-posix-name-regex "^/tmp/com.apple.csseed")

       (ipc-posix-name-regex "^CFPBS:")

       (ipc-posix-name-regex "^apple\.cfprefs\.")

       (ipc-posix-name-regex "^apple\.shm\.cfprefs\.")

       (ipc-posix-name-regex "^AudioIO")

)



(allow mach-lookup)



(allow mach-register

       (local-name "com.apple.CFPasteboardClient")

       (local-name "com.apple.axserver")

       (local-name "com.apple.coredrag")

       (local-name "com.apple.tsm.portname")

)



(allow network-outbound

       (path "/private/var/run/cupsd")

       (torbrowser-data-dir-path "/Tor/control.socket")

       (torbrowser-data-dir-path "/Tor/socks.socket")

       (path-regex "/private/tmp/Tor[-0-9]*/control.socket")

       (path-regex "/private/tmp/Tor[-0-9]*/socks.socket")

)



(allow process-exec*

       (torbrowser-app-dir-path "/Contents/MacOS/firefox")

)



(allow sysctl-read)