Merge pull request #478 from diabonas/reproducible-mo-file

Make torbrowser-launcher.mo ordering reproducible

diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
index 57c03594bb7b19eff1855ba9fd156c645be1f661..6882f9d9ae186c129e4faa55529953c5ba81137b 100644 (file)
--- a/apparmor/torbrowser.Browser.firefox
+++ b/apparmor/torbrowser.Browser.firefox
@@ -6,6 +6,8 @@
 profile torbrowser_firefox @{torbrowser_firefox_executable} {
   #include <abstractions/audio>
   #include <abstractions/gnome>
+  #include <abstractions/ibus>
+  #include if exists <abstractions/vulkan>
 
   # Uncomment the following lines if you want to give the Tor Browser read-write
   # access to most of your personal files.
@@ -36,6 +38,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   /dev/ r,
   /dev/shm/ r,
 
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/environ r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,
@@ -99,6 +102,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   /sys/devices/system/cpu/present r,
   /sys/devices/system/node/ r,
   /sys/devices/system/node/node[0-9]*/meminfo r,
+  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_quota_us r,
   deny /sys/devices/virtual/block/*/uevent r,
 
   # Should use abstractions/gstreamer instead once merged upstream
@@ -126,7 +130,6 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
   deny /run/user/[0-9]*/dconf/user rw,
   deny /usr/bin/lsb_release x,
-  deny capability sys_admin,
 
   # Silence denial logs about PulseAudio
   deny /etc/pulse/client.conf r,
@@ -148,5 +151,11 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   # Yubikey NEO also needs this:
   /sys/devices/**/hidraw/hidraw*/uevent r,
 
+  # Needed for Firefox sandboxing via unprivileged user namespaces
+  capability sys_admin,
+  capability sys_chroot,
+  owner @{PROC}/@{pid}/{gid,uid}_map w,
+  owner @{PROC}/@{pid}/setgroups w,
+
   #include <local/torbrowser.Browser.firefox>
 }

diff --git a/setup.py b/setup.py
index 0a743f7ec26d3007e0eb59b86fa1904b7075892d..67e126e20a8b3c9e66b700d02f66f396dfffaeec 100644 (file)
--- a/setup.py
+++ b/setup.py
@@ -28,14 +28,14 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 import os
 import sys
-import platform
+import distro
 import subprocess
 from distutils.core import setup
 
 SHARE = "share"
 
 # detect linux distribution
-distro = platform.dist()[0]
+distro = distro.linux_distribution()[0]
 
 
 def file_list(path):

diff --git a/torbrowser_launcher/common.py b/torbrowser_launcher/common.py
index 1a05fb48d80baabaafacb0dd786da2ea00e893d7..55f11ee3eb20680962efbdf60fa0c5b9228da4ca 100644 (file)
--- a/torbrowser_launcher/common.py
+++ b/torbrowser_launcher/common.py
@@ -76,25 +76,36 @@ class Common(object):
         available_languages = [
             "ar",
             "ca",
+            "cs",
             "da",
             "de",
+            "el",
             "en-US",
+            "es-AR",
             "es-ES",
             "fa",
             "fr",
             "ga-IE",
             "he",
+            "hu",
             "id",
             "is",
             "it",
             "ja",
+            "ka",
             "ko",
+            "lt",
+            "mk",
+            "ms",
+            "my",
             "nb-NO",
             "nl",
             "pl",
             "pt-BR",
+            "ro",
             "ru",
             "sv-SE",
+            "th",
             "tr",
             "vi",
             "zh-CN",
@@ -135,8 +146,6 @@ class Common(object):
                     self.set_gui(
                         "error", _("Error creating {0}").format(homedir), [], False
                     )
-        if not os.access(homedir, os.W_OK):
-            self.set_gui("error", _("{0} is not writable").format(homedir), [], False)
 
         tbb_config = '{0}/torbrowser'.format(self.get_env('XDG_CONFIG_HOME', '{0}/.config'.format(homedir)))
         tbb_cache = '{0}/torbrowser'.format(self.get_env('XDG_CACHE_HOME', '{0}/.cache'.format(homedir)))