Ubuntu
torbrowser-launcher package

[SRU] Apparmor profile prevents Tor Browser from loading libstdc++.so.6 since Tor Browser 10.0 was released

Bug #1897302 reported by AsciiWolf
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
torbrowser-launcher (Ubuntu)
Fix Released
Undecided
Unassigned
Focal
Fix Released
Undecided
Thomas Ward

Bug Description

[Impact]
The AppArmor profile for Tor Browser prevents access to libstdc libraries. This prevents Tor Browser from starting.

[Test Case]
(1) Install torbrowser-launcher.
(2) Let it download/update.
(3) Program will fail to start when launched with error in attempting to mem-map libstdc libraries.

[Regression Potential]
The regression potential for the fix for this is near-zero. It simply alters the apparmor profile to permit mem-mapping of libstdc.

[racb] We are changing the apparmor profile. There may be some unusual user configuration where the old name works but the new name doesn't, or where changing the conffile causes a breakage because the user has customisations and accepts the replacement conffile.

[Original Bug Description]

The AppArmor profile torbrowser.Browser.firefox prevents Tor Browser from loading libstdc++.so.6 on Ubuntu 20.04. This results in Tor Browser failing to start since 10.0 release with the following error being printed on stdout:

./firefox.real: error while loading shared libraries: libstdc++.so.6: failed to map segment from shared object

And the following message in the audit logs:

AVC apparmor="DENIED" operation="file_mmap" profile="torbrowser_firefox" name="/home/<user>/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Tor/libstdc++/libstdc++.so.6" pid=3883 comm="firefox.real" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000

This patch from Debian fixes the issue: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/87859bce5779f89b37c4e4be334f7e1670b0a9f3

It is already fixed in Groovy.

See original description
AsciiWolf (asciiwolf)
description: updated
AsciiWolf (asciiwolf)
description: updated
Thomas Ward (teward)
Changed in torbrowser-launcher (Ubuntu):
status: New → Fix Released
Changed in torbrowser-launcher (Ubuntu Focal):
status: New → In Progress
assignee: nobody → Thomas Ward (teward)
Thomas Ward (teward)
summary: - Apparmor profile prevents Tor Browser from loading libstdc++.so.6 since
- Tor Browser 10.0 was released
+ [SRU] Apparmor profile prevents Tor Browser from loading libstdc++.so.6
+ since Tor Browser 10.0 was released
description: updated
Robie Basak (racb)
description: updated
Revision history for this message
Robie Basak (racb) wrote : Please test proposed package

Hello AsciiWolf, or anyone else affected,

Accepted torbrowser-launcher into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/torbrowser-launcher/0.3.2-9ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in torbrowser-launcher (Ubuntu Focal):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-focal
Revision history for this message
AsciiWolf (asciiwolf) wrote :

I have tested the provided torbrowser-launcher 0.3.2-9ubuntu1 build from focal-proposed on fully-updated Ubuntu 20.04 system. I am no longer able to reproduce the issue and torbrowser-launcher now works properly.

tags: added: verification-done-focal
removed: verification-needed-focal
Thomas Ward (teward)
tags: removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package torbrowser-launcher - 0.3.2-9ubuntu1

---------------
torbrowser-launcher (0.3.2-9ubuntu1) focal; urgency=medium

  * This is a bug-fix only upload to address several significant bugs
    found in the Tor Browser launcher package.
  * Patches backported from Debian Unstable release and Debian Salsa git
    repository for the package into the Focal package to fix issues.
    The following patches were added in d/patches and added to the quilt
    series file in the stated order:
    - 0023-Update-Tor-Browser-Developers-public-key-481.patch: Fixes issue
      with signature verification of tor browser tarball, due to changed
      upstream developers key. (LP: #1856895)
    - 0030-Use-gpg-instead-of-gpg2.patch: Use /usr/bin/gpg instead of the
      /usr/bin/gpg2 symlink due to gnupg2 transitional package not being
      part of default installations. (LP: #1897306)
    - 0031-Use-better-version-string-comparison.patch: Properly handle the
      version string comparison between Tor Browser versions, so that the
      launcher supports version 10+ and can properly validate.
      (LP: #1896752)
    - 0032-apparmor-allow-Browser-to-memory-map-libstdc.patch: Allow
      apparmor profile to access and memory map libstdc, due to AppArmor
      default DENY on access causing issues. (LP: #1897302)

 -- Thomas Ward <email address hidden> Sun, 27 Sep 2020 14:34:53 -0400

Changed in torbrowser-launcher (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Update Released

The verification of the Stable Release Update for torbrowser-launcher has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.