Unverified Commit 767dd879 authored by Georg Koppen's avatar Georg Koppen
Browse files

Bug 26438: Remove seatbelt profiles for macOS

Starting with content sandboxing being enabled our seatbelt profiles
have been broken (see: #22000). We should remove them for now to avoid
a broken experience in the alphas.
parent 951b1a7e
Experimental Sandboxed Tor Browser for OS X
Requirements:
Mac OS 10.9 or newer.
A willingness to run shell commands from Terminal.
Follow these steps to use the sandbox profiles:
1. Copy this folder ("Sandboxed Tor Browser") to a local drive, but do not
put it in /Applications.
2. Copy the TorBrowser app into your "Sandboxed Tor Browser" folder.
3. Open Terminal.
4. Run start-tor-with-sandbox and wait for Tor bootstrapping to finish.
5. Run start-browser-with-sandbox.
Known Issues:
You will need to manually kill start-tor-with-sandbox or the tor.real
process after you exit the browser.
The browser has full access to the Tor control port. Ideally, access
would be limited to the things that are necessary for New Identity and
for the circuit display features.
Printing does not work.
The built-in updater will not work.
Files can only be downloaded or saved to ~/Downloads.
#!/bin/bash
# TODO: assumes not in /Applications
# TODO: assumes app is in TorBrowser.app
BASEDIR="`dirname \"$0\"`"
BASEDIR="`(cd \"$BASEDIR\" && pwd)`"
TORBROWSER_APP_DIR="$BASEDIR/TorBrowser.app"
TORBROWSER_DATA_DIR="$BASEDIR/TorBrowser-Data"
TOR_DATA_DIR="$TORBROWSER_DATA_DIR/Tor"
SOCKETDIR="/tmp/Tor"
export TOR_SKIP_LAUNCH=1
export TOR_CONTROL_IPC_PATH="$SOCKETDIR/control.socket"
export TOR_SOCKS_IPC_PATH="$SOCKETDIR/socks.socket"
export TOR_CONTROL_COOKIE_AUTH_FILE="$TOR_DATA_DIR/control_auth_cookie"
SB_PROFILE="`pwd`/tb.sb"
cd "$TORBROWSER_APP_DIR"
sandbox-exec -f "$SB_PROFILE" \
-D "HOME_DIR=$HOME" \
-D "CURRENT_DIR=$BASEDIR" \
-D "TORBROWSER_APP_DIR=$TORBROWSER_APP_DIR" \
-D "TORBROWSER_DATA_DIR=$TORBROWSER_DATA_DIR" \
"./Contents/MacOS/firefox"
#!/bin/bash
# TODO: assumes not in /Applications
# TODO: assumes /tmp/Tor is not used by anyone else.
# TODO: assumes app is in TorBrowser.app
set -e
BASEDIR="`dirname \"$0\"`"
BASEDIR="`(cd \"$BASEDIR\" && pwd)`"
TOR_DATA_DIR="$BASEDIR/TorBrowser-Data/Tor"
TOR_STATIC_DATA_DIR="$BASEDIR/TorBrowser.app/Contents/Resources/TorBrowser/Tor"
TOR_BIN_DIR="$BASEDIR/TorBrowser.app/Contents/MacOS/Tor"
TORRC="$TOR_DATA_DIR/torrc"
SOCKETDIR="/tmp/Tor"
# Compiled Python modules require a compatible Python, which means 32-bit 2.6.
export VERSIONER_PYTHON_VERSION=2.6
export DYLD_LIBRARY_PATH=.:$DYLD_LIBRARY_PATH
mkdir -p "$TOR_DATA_DIR"
if [ ! -e "$TORRC" ]; then
touch "$TORRC"
fi
if [ ! -e "$SOCKETDIR" ]; then
mkdir -p "$SOCKETDIR"
chmod 700 "$SOCKETDIR"
fi
TOR="$TOR_BIN_DIR/tor.real"
sandbox-exec -f tor.sb -D "TOR_DATA_DIR=$TOR_DATA_DIR" \
-D "TOR_STATIC_DATA_DIR=$TOR_STATIC_DATA_DIR" \
-D "TOR_BIN_DIR=$TOR_BIN_DIR" "$TOR" \
--defaults-torrc "$TOR_STATIC_DATA_DIR/torrc-defaults" \
-f "$TORRC" \
CookieAuthentication 1 \
DataDirectory "$TOR_DATA_DIR" \
GeoIPFile "$TOR_STATIC_DATA_DIR/geoip" \
GeoIPv6File "$TOR_STATIC_DATA_DIR/geoip6" \
ControlPort "unix:$SOCKETDIR/control.socket" \
SocksPort "unix:$SOCKETDIR/socks.socket"
(version 1)
;; Parameters:
;; HOME_DIR the user's home directory
;; CURRENT_DIR the current working directory
;; TORBROWSER_APP_DIR the TorBrowser.app directory
;; TORBROWSER_DATA_DIR the TorBrowser-Data directory
;; TODO: can see all dirs but can download/save only in Downloads (no error reported though!)
;; TODO: printing does not work (Save to PDF does).
(deny default)
(define (home-path aSubPath)
(path (string-append (param "HOME_DIR") aSubPath)))
(define (home-subpath aSubPath)
(subpath (string-append (param "HOME_DIR") aSubPath)))
(define (torbrowser-data-dir-path aSubPath)
(path (string-append (param "TORBROWSER_DATA_DIR") aSubPath)))
(define (torbrowser-data-dir-subpath aSubPath)
(subpath (string-append (param "TORBROWSER_DATA_DIR") aSubPath)))
(define (torbrowser-app-dir-path aSubPath)
(subpath (string-append (param "TORBROWSER_APP_DIR") aSubPath)))
(allow file-read*
(path "/Library/Preferences/com.apple.HIToolbox.plist")
(path "/Library/Preferences/com.apple.ViewBridge.plist")
(path "/Library/Preferences/.GlobalPreferences.plist")
(path "/dev/random")
(path "/dev/urandom")
(path "/dev/dtracehelper")
(path "/private/etc/localtime")
(path "/private/etc/passwd")
(path "/private/tmp")
(path "/private/var/tmp")
(path (param "HOME_DIR"))
(subpath "/Library/Audio")
(subpath "/Library/Fonts")
(subpath "/System")
(subpath "/private/var/folders")
(subpath "/usr/lib")
(subpath "/usr/share")
(home-subpath "/Downloads")
(home-subpath "/Library/Input Methods")
(home-subpath "/Library/Keyboard Layouts")
(home-subpath "/Library/Preferences")
(torbrowser-app-dir-path "")
(torbrowser-data-dir-path "")
(torbrowser-data-dir-subpath "/Browser")
(torbrowser-data-dir-path "/Tor/control_auth_cookie")
)
(allow file-read-metadata
(home-path "/Desktop")
(home-path "/Library")
(home-path "/Library/Saved Application State")
(path (param "CURRENT_DIR"))
(path "/")
(path "/Applications")
(path "/Users")
(path "/etc")
(path "/home")
(path "/net")
(path "/private/var/db/.AppleSetupDone")
(path "/tmp")
(path "/var")
(torbrowser-data-dir-path "/Tor/control.socket")
(torbrowser-data-dir-path "/Tor/socks.socket")
(path-regex "/private/tmp/Tor[-0-9]*/control.socket")
(path-regex "/private/tmp/Tor[-0-9]*/socks.socket")
)
(allow file-write-data file-ioctl
(path "/dev/dtracehelper")
)
(allow file-write*
(home-subpath "/Downloads")
(home-path "/Library/Preferences/.GlobalPreferences.plist")
(torbrowser-data-dir-subpath "/Browser")
(subpath "/private/var/folders")
(path-regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/org.mozilla.tor"))
(path "/Library/Preferences/.GlobalPreferences.plist")
)
(allow iokit-open)
(allow ipc-posix-shm
(ipc-posix-name "apple.shm.notification_center")
(ipc-posix-name-regex "^/tmp/com.apple.csseed")
(ipc-posix-name-regex "^CFPBS:")
(ipc-posix-name-regex "^apple\.cfprefs\.")
(ipc-posix-name-regex "^apple\.shm\.cfprefs\.")
(ipc-posix-name-regex "^AudioIO")
)
(allow mach-lookup)
(allow mach-register
(local-name "com.apple.CFPasteboardClient")
(local-name "com.apple.axserver")
(local-name "com.apple.coredrag")
(local-name "com.apple.tsm.portname")
)
(allow network-outbound
(path "/private/var/run/cupsd")
(torbrowser-data-dir-path "/Tor/control.socket")
(torbrowser-data-dir-path "/Tor/socks.socket")
(path-regex "/private/tmp/Tor[-0-9]*/control.socket")
(path-regex "/private/tmp/Tor[-0-9]*/socks.socket")
)
(allow process-exec*
(torbrowser-app-dir-path "/Contents/MacOS/firefox")
)
(allow sysctl-read)
(version 1)
;; Parameters:
;; TOR_DATA_DIR directory that contains writeable config, e.g, torrc
;; TOR_STATIC_DATA_DIR directory for read-only config, e.g., torrc-defaults
;; TOR_BIN_DIR directory that contains tor binaries, e.g., tor.real
(deny default)
(allow file-read* file-write-data file-ioctl
(path "/dev/dtracehelper")
)
(allow file-read*
(subpath (param "TOR_BIN_DIR"))
(subpath "/usr/local")
(subpath (param "TOR_DATA_DIR"))
(subpath (param "TOR_STATIC_DATA_DIR"))
(subpath (param "TOR_BIN_DIR"))
(path-regex "/private/tmp/Tor[-0-9]*")
)
(allow file-read-data
(path "/dev/random")
(path "/dev/srandom")
(path "/dev/urandom")
(subpath "/usr/share")
)
(allow file-read-metadata
(path "/etc")
(path "/private/etc/localtime")
(path "/tmp")
(subpath "/usr/lib")
)
(allow file-write*
(subpath (param "TOR_DATA_DIR"))
)
(allow ipc-posix-shm-read-data
(ipc-posix-name "apple.shm.notification_center")
)
(allow mach-lookup
(global-name "com.apple.system.notification_center")
)
(allow network-inbound file-write*
(path (string-append (param "TOR_DATA_DIR") "/control.socket"))
(path (string-append (param "TOR_DATA_DIR") "/socks.socket"))
(path-regex "/private/tmp/Tor[-0-9]*/control.socket")
(path-regex "/private/tmp/Tor[-0-9]*/socks.socket")
)
(allow network-outbound
(remote tcp "*:*")
)
(allow process-exec
(path (string-append (param "TOR_BIN_DIR") "/tor.real"))
)
(allow sysctl-read)
......@@ -105,11 +105,6 @@ tar -C "$TBDIR[% IF ! c("var/osx") %]/TorBrowser[% END %]" -xf [% c('input_files
mv "$TBDIR/$TORBINPATH/tor" "$TBDIR/$TORBINPATH/tor.real"
cp Bundle-Data/mac-tor.sh "$TBDIR/$TORCONFIGPATH/tor"
[% IF ! c("var/release") -%]
SANDBOX_FOLDER="$TB_STAGE_DIR/Sandboxed Tor Browser"
mv Bundle-Data/mac-sandbox "$SANDBOX_FOLDER"
[% END -%]
tar -C Bundle-Data/mac-applications.dmg -c . | tar -C $TB_STAGE_DIR -x
[% END %]
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment