Commit 09fa0352 authored by anonym's avatar anonym
Browse files

Merge branch 'master' into stable

parents cb6663dc e7de1abf
This diff is collapsed.
#!/bin/sh
set -e
set -u
EXT="/usr/lib/icedove/extensions"
[ -d "$EXT" ] || exit 1
echo "Enabling Torbirdy and Enigmail in Icedove"
ln -s /usr/share/xul-ext/torbirdy "$EXT"/castironthunderbirdclub@torproject.org
ln -s /usr/lib/xul-ext/enigmail "$EXT"/\{847b3a00-7ab1-11d4-8f02-006008948af5\}
echo "Enabling the amnesia branding extension in Icedove"
ln -s /usr/local/share/tor-browser-extensions/branding@amnesia.boum.org "$EXT"
......@@ -33,7 +33,7 @@ install_torbrowser_AppArmor_profile() {
tmpdir="$(mktemp -d)"
(
cd "$tmpdir"
apt-get source torbrowser-launcher/sid
apt-get source torbrowser-launcher/testing
install -m 0644 \
torbrowser-launcher-*/apparmor/torbrowser.Browser.firefox \
"$PROFILE"
......
#!/bin/sh
set -e
# We don't want the real binary to be in $PATH:
# Also note that wget uses the executable name in some help/error messages,
# so wget-real/etc. should be avoided.
mkdir -p /usr/lib/wget
dpkg-divert --add --rename --divert /usr/lib/wget/wget /usr/bin/wget
# We don't want users or other applications using wget directly:
cat > /usr/bin/wget << 'EOF'
#!/bin/sh
unset http_proxy
unset HTTP_PROXY
unset https_proxy
unset HTTPS_PROXY
exec torsocks /usr/lib/wget/wget --passive-ftp "$@"
EOF
chmod 755 /usr/bin/wget
......@@ -5,12 +5,12 @@
# Run only when the interface is not "lo":
if [ $1 = "lo" ]; then
exit 0
exit 0
fi
# Run whenever an interface gets "up", not otherwise:
if [ $2 != "up" ]; then
exit 0
exit 0
fi
# Import tor_control_setconf(), TOR_LOG
......@@ -35,26 +35,41 @@ rm -f "${TOR_LOG}"
# a HTTP proxy or allowed firewall ports won't get the sandboxing, but
# much better than nothing.
if [ "$(tails_netconf)" = "direct" ]; then
tor_set_in_torrc Sandbox 1
tor_set_in_torrc Sandbox 1
fi
# A SIGHUP should be enough but there's a bug in Tor. Details:
# We would like Tor to be started during init time, even before the
# network is up, and then send it a SIGHUP here to make it start
# bootstrapping swiftly, but it doesn't work because of a bug in
# Tor. Details:
# * https://trac.torproject.org/projects/tor/ticket/1247
# * https://tails.boum.org/bugs/tor_vs_networkmanager/
restart-tor
# To work around this we restart Tor, in various ways, no matter the
# case below.
if [ "$(tails_netconf)" = "obstacle" ]; then
# When using a bridge Tor reports TLS cert lifetime errors
# (e.g. when the system clock is way off) with severity "info", but
# when no bridge is used the severity is "warn". tordate/20-time.sh
# depends on grepping these error messages, so we temporarily
# increase Tor's logging severity.
tor_control_setconf "Log=\"info file ${TOR_LOG}\""
# Enable the transports we support. We cannot do this in general,
# when bridge mode is not enabled, since we then use seccomp
# sandboxing.
tor_control_setconf 'ClientTransportPlugin="obfs2,obfs3,obfs4 exec /usr/bin/obfs4proxy managed"'
/usr/local/sbin/tails-tor-launcher &
# We do not use restart-tor since it validates that bootstraping
# succeeds. That cannot happen until Tor Launcher has started
# (below) and the user is done configuring it.
service tor restart
# When using a bridge Tor reports TLS cert lifetime errors
# (e.g. when the system clock is way off) with severity "info", but
# when no bridge is used the severity is "warn". tordate/20-time.sh
# depends on grepping these error messages, so we temporarily
# increase Tor's logging severity.
tor_control_setconf "Log=\"info file ${TOR_LOG}\""
# Enable the transports we support. We cannot do this in general,
# when bridge mode is not enabled, since we then use seccomp
# sandboxing.
tor_control_setconf 'ClientTransportPlugin="obfs2,obfs3,obfs4 exec /usr/bin/obfs4proxy managed"'
/usr/local/sbin/tails-tor-launcher &
# Wait until the user has done the Tor Launcher configuration.
until [ "$(tor_control_getconf DisableNetwork)" = 0 ]; do
sleep 1
done
else
( restart-tor ) &
fi
......@@ -70,7 +70,7 @@ has_only_unverified_consensus() {
wait_for_tor_consensus_helper() {
tries=0
while ! has_consensus && [ $tries -lt 5 ]; do
while ! has_consensus && [ $tries -lt 10 ]; do
inotifywait -q -t 30 -e close_write -e moved_to ${TOR_DIR} || log "timeout"
tries=$(expr $tries + 1)
done
......@@ -81,10 +81,6 @@ wait_for_tor_consensus_helper() {
wait_for_tor_consensus() {
log "Waiting for a Tor consensus file to contain a valid time interval"
if ! has_consensus && ! wait_for_tor_consensus_helper; then
log "Unsuccessfully waited for Tor consensus, restarting Tor and retrying."
restart-tor
fi
if ! has_consensus && ! wait_for_tor_consensus_helper; then
log "Unsuccessfully retried waiting for Tor consensus, aborting."
fi
......@@ -175,7 +171,7 @@ maybe_set_time_from_tor_consensus() {
date -us "${vmid}" 1>/dev/null
# Tor is unreliable with picking a circuit after time change
restart-tor
service tor restart
}
tor_cert_valid_after() {
......@@ -219,15 +215,6 @@ start_notification_helper() {
### Main
# When the network is obstacled (e.g. we need a bridge) we wait until
# Tor Launcher has unset DisableNetwork, since Tor's bootstrapping
# won't start until then.
if [ "$(tails_netconf)" = "obstacle" ]; then
until [ "$(tor_control_getconf DisableNetwork)" = 0 ]; do
sleep 1
done
fi
start_notification_helper
# Delegate time setting to other daemons if Tor connections work
......
// This is the Debian specific preferences file for Mozilla Firefox
// You can make any change in here, it is the purpose of this file.
// You can, with this file and all files present in the
// /etc/thunderbird/pref directory, override any preference that is
// present in /usr/lib/thunderbird/defaults/pref directory.
// While your changes will be kept on upgrade if you modify files in
// /etc/thunderbird/pref, please note that they won't be kept if you
// do them in /usr/lib/thunderbird/defaults/pref.
pref("extensions.update.enabled", false);
// Use LANG environment variable to choose locale
pref("intl.locale.matchOS", true);
// Disable default mail checking (gnome).
pref("mail.shell.checkDefaultMail", false);
// if you are not using gnome
pref("network.protocol-handler.app.http", "x-www-browser");
pref("network.protocol-handler.app.https", "x-www-browser");
// Tell TorBirdy we're running Tails so that it adapts its behaviour.
//pref("vendor.name", "Tails");
// Disable mail indexing
pref("mailnews.database.global.indexer.enabled", false);
// Disable chat
pref("mail.chat.enabled", false);
// Disable system addons
pref("extensions.autoDisableScopes", 3);
pref("extensions.enabledScopes", 4);
// Only show the tab bar if there's more than one tab to display
pref("mail.tabs.autoHide", true);
// Try to disable "Would you like to help Icedove Mail/News by automatically reporting memory usage, performance, and responsiveness to Mozilla"
pref("toolkit.telemetry.prompted", 2);
pref("toolkit.telemetry.rejected", true);
pref("toolkit.telemetry.enabled", false);
/* Required, do not remove */
@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
#torbirdy-jondo-selection,
#torbirdy-whonix-selection,
#torbirdy-tor-selection,
#torbirdy-tor-selection + menuseparator,
#torbirdy-anon-settings,
#torbirdy-anonservice,
/* Hide "Chat account" on Icedove's start-up page */
#CreateAccountChat
{ display: none; }
user_pref("extensions.enigmail.configuredVersion", "1.7.2");
......@@ -20,7 +20,7 @@ SocksPort 127.0.0.1:9061 IsolateDestAddr
## SocksPort for Tails-specific applications
SocksPort 127.0.0.1:9062 IsolateDestAddr IsolateDestPort
## SocksPort for the default web browser
SocksPort 127.0.0.1:9150
SocksPort 127.0.0.1:9150 IsolateSOCKSAuth KeepAliveIsolateSOCKSAuth
## Entry policies to allow/deny SOCKS requests based on IP address.
## First entry that matches wins. If no SocksPolicy is set, we accept
......
#!/bin/sh
set -e
set -u
PROFILE="${HOME}/.icedove/profile.default"
start_icedove() {
# Give Icedove its own temp directory, similar rationale to a1fd1f0f & #9558.
TMPDIR="${PROFILE}/tmp"
mkdir --mode=0700 -p "$TMPDIR"
export TMPDIR
if [ -z "$XAUTHORITY" ]; then
XAUTHORITY=~/.Xauthority
export XAUTHORITY
fi
unset SESSION_MANAGER
/usr/bin/icedove --class "Icedove" -profile "${PROFILE}" "${@}"
}
start_icedove "${@}"
#!/bin/sh
unset http_proxy
unset HTTP_PROXY
unset https_proxy
unset HTTPS_PROXY
exec torsocks /usr/bin/wget "$@"
#!/bin/sh
# Get monotonic time in seconds. See clock_gettime(2) for details.
# Note: we limit ourselves to seconds simply because floating point
# arithmetic is a PITA in the shell.
clock_gettime_monotonic() {
perl -w -MTime::HiRes=clock_gettime,CLOCK_MONOTONIC \
-E 'say clock_gettime(CLOCK_MONOTONIC)' | \
sed 's/\..*$//'
}
# Run `check_expr` until `timeout` seconds has passed, and sleep
# `delay` (optional, defaults to 1) seconds in between the calls.
# Note that execution isn't aborted exactly after `timeout`
......@@ -11,9 +20,9 @@ wait_until() {
timeout="${1}"
check_expr="${2}"
delay="${3:-1}"
timeout_at=$(expr $(date +%s) + ${timeout})
timeout_at=$(expr $(clock_gettime_monotonic) + ${timeout})
until eval "${check_expr}"; do
if [ "$(date +%s)" -ge "${timeout_at}" ]; then
if [ "$(clock_gettime_monotonic)" -ge "${timeout_at}" ]; then
return 1
fi
sleep ${delay}
......
......@@ -21,6 +21,14 @@ nic_is_up() {
# The following "nic"-related functions require that the argument is a
# NIC that exists
nic_ipv4_addr() {
ip addr show "${1}" | sed -n 's,^\s*inet \([0-9\.]\+\)/.*$,\1,p'
}
nic_ipv6_addr() {
ip addr show "${1}" | sed -n 's,^\s*inet6 \([0-9a-fA-F:]\+\)/.*$,\1,p'
}
# Will just output nothing on failure
get_current_mac_of_nic() {
local mac
......
......@@ -9,6 +9,7 @@
I2P_DEFAULT_CONFIG="/usr/share/i2p"
I2P_CONFIG="/var/lib/i2p/i2p-config"
I2P_TUNNEL_CONFIG="${I2P_CONFIG}/i2ptunnel.config"
I2P_WRAPPER_LOG="/var/log/i2p/wrapper.log"
i2p_is_enabled() {
grep -qw "i2p" /proc/cmdline
......@@ -27,7 +28,29 @@ i2p_eep_proxy_address() {
echo ${listen_host}:${listen_port}
}
i2p_has_bootstrapped() {
i2p_reseed_started() {
grep -q 'Reseed start$' "${I2P_WRAPPER_LOG}"
}
i2p_reseed_failed() {
grep -q 'Reseed failed, check network connection$' "${I2P_WRAPPER_LOG}"
}
i2p_reseed_completed() {
grep -q "Reseed complete" "${I2P_WRAPPER_LOG}"
}
i2p_reseed_status() {
if i2p_reseed_completed; then
echo success
elif i2p_reseed_failed; then
echo failure
elif i2p_reseed_started; then
echo running
fi
}
i2p_built_a_tunnel() {
netstat -nlp | grep -qwF "$(i2p_eep_proxy_address)"
}
......
......@@ -64,6 +64,37 @@ Options affecting the 'activate' action:
"
}
escape_dots() {
printf "%s\n" $1 | sed 's/\./\\./g'
}
migrate_persistence_preset()
{
local OLD_PRESET="${1}"
local OLD_PRESET_SOURCE="${2}"
local NEW_PRESET="${3}"
local NEW_PRESET_SOURCE="${4}"
local CONFIG="${5}"
if grep -E -qs --line-regex \
-e "$(escape_dots ${OLD_PRESET})\s+source=${OLD_PRESET_SOURCE}" \
"$CONFIG" \
&& ! grep -E -qs --line-regex \
-e "$(escape_dots ${NEW_PRESET})\s+source=${NEW_PRESET_SOURCE}" \
"$CONFIG"
then
warning "Need to make $NEW_PRESET persistent"
if [ "$PERSISTENCE_READONLY" = true ]
then
warning "Persistence configuration needs to be migrated, but read only was selected; please retry in read-write mode"
else
echo "$NEW_PRESET source=$NEW_PRESET_SOURCE" \
>> "$CONFIG" \
|| error "Failed to make $NEW_PRESET: $?"
warning "Successfully made $NEW_PRESET persistent"
fi
fi
}
warning ()
{
echo "warning: ${@}" >&2
......@@ -323,31 +354,19 @@ activate_volumes ()
fi
done
# Migrate Squeeze-era NetworkManager persistence setting to Wheezy.
for conf in $(ls /live/persistence/*_unlocked/persistence.conf || true)
do
if grep -E -qs --line-regex \
-e '/home/amnesia/\.gconf/system/networking/connections\s+source=nm-connections' \
"$conf" \
&& ! grep -E -qs --line-regex \
-e '/etc/NetworkManager/system-connections\s+source=nm-system-connections' \
# Migrate Squeeze-era NetworkManager persistence setting to Wheezy.
migrate_persistence_preset '/home/amnesia/.gconf/system/networking/connections' 'nm-connections' \
'/etc/NetworkManager/system-connections' 'nm-system-connections' "$conf"
# disable pre-Wheezy NM persistence setting
sed -r -i \
-e 's,^(/home/amnesia/\.gconf/system/networking/connections\s+source=nm-connections)$,#\1,' \
"$conf"
then
warning "Needs to make /etc/NetworkManager/system-connections persistent"
if [ "$PERSISTENCE_READONLY" = true ]
then
# XXX: don't really error-out, do we?
error "Persistence configuration needs to be migrated, but read only was selected; please retry in read-write mode"
fi
echo '/etc/NetworkManager/system-connections source=nm-system-connections' \
>> "$conf" \
|| error "Failed to make /etc/NetworkManager/system-connections persistent: $?"
warning "Successfully made /etc/NetworkManager/system-connections persistent"
# disable pre-Wheezy NM persistence setting
sed -r -i \
-e 's,^(/home/amnesia/\.gconf/system/networking/connections\s+source=nm-connections)$,#\1,' \
"$conf"
fi
# Migrate Claws-mail persistence setting to Icedove
migrate_persistence_preset '/home/amnesia/.claws-mail' 'claws-mail' \
'/home/amnesia/.icedove' 'icedove' "$conf"
done
# Fix permissions on persistent directories that were created
......
......@@ -2,13 +2,58 @@
set -e
# Import try_for() and clock_gettime_monotonic()
. /usr/local/lib/tails-shell-library/common.sh
# Import tor_bootstrap_progress()
. /usr/local/lib/tails-shell-library/tor.sh
# Import log()
. /usr/local/lib/tails-shell-library/log.sh
_LOG_TAG="$(basename $0)"
# The Tor log is removed to ensure `tor_bootstrap_progress`'s output will be
# accurate.
clear_tor_log() {
rm -f /var/log/tor/log
}
clear_tor_log
service tor restart
# The main point of this script is to make sure that if vidalia is
# running, and Tor is restarted, then we also restart Vidalia. This is
# because Vidalia doesn't re-connect to Tor automatically, so the user
# has to restart it to be able to control Tor again. Also, any options
# set by Vidalia will be lost since they weren't written to torrc.
# There are two main points to this script:
# * restarting Tor if bootstrapping stalls for more than 20 seconds
# * making sure that if vidalia is running it is restarted if Tor is restarted.
# This is needed because Vidalia doesn't re-connect to Tor automatically,
# so the user has to restart it to be able to control Tor again. Also, any
# options set by Vidalia will be lost since they weren't written to torrc.
bootstrap_progress=0
last_bootstrap_change=$(clock_gettime_monotonic)
maybe_restart_tor() {
local new_bootstrap_progress=$(tor_bootstrap_progress)
if [ $new_bootstrap_progress -eq 100 ]; then
log "Tor has successfully bootstrapped."
return 0
elif [ $new_bootstrap_progress -gt $bootstrap_progress ]; then
bootstrap_progress=$new_bootstrap_progress
last_bootstrap_change=$(clock_gettime_monotonic)
return 1
elif [ $(expr $(clock_gettime_monotonic) - $last_bootstrap_change) -ge 20 ]; then
log "Tor seems to have stalled while bootstrapping. Restarting Tor."
clear_tor_log
service tor restart
bootstrap_progress=0
last_bootstrap_change=$(clock_gettime_monotonic)
return 1
else
return 1
fi
}
try_for 270 maybe_restart_tor
if pgrep "\<vidalia\>" >/dev/null; then
killall -SIGKILL vidalia
# Since Tor just restarted we wait for a while until the
......
......@@ -7,9 +7,13 @@ debug_command() {
}
debug_file() {
local user="${1}"
shift
file="${1}"
[ ! -e "${file}" ] && return
echo
echo "===== content of $1 ====="
cat "$1"
sudo -u "${user}" -- cat "${file}"
}
debug_command /usr/sbin/dmidecode -s system-manufacturer
......@@ -21,19 +25,39 @@ debug_command "/bin/mount"
debug_command "/usr/bin/lspci"
debug_command grep spoof-mac: /var/log/messages
debug_file "/etc/X11/xorg.conf"
debug_file "/home/amnesia/.xsession-errors"
debug_file "/proc/asound/cards"
debug_file "/proc/asound/devices"
debug_file "/proc/asound/modules"
debug_file "/var/log/Xorg.0.log"
debug_file "/var/log/gdm3/:0-slave.log"
debug_file "/var/log/gdm3/:0-greeter.log"
debug_file "/var/log/gdm3/tails-greeter.errors"
debug_file "/var/log/live-persist"
debug_file "/var/log/live/boot.log"
debug_file "/var/log/live/config.log"
debug_file "/var/lib/gdm3/tails.persistence"
debug_file "/var/lib/live/config/tails.physical_security"
debug_file "/live/persistence/TailsData_unlocked/persistence.conf"
debug_file "/live/persistence/TailsData_unlocked/live-additional-software.conf"
# Great attention must be given to the ownership situation of these
# files and their parent directories in order to avoid a symlink-based
# attack that could read the contents of any file and make it
# accessible to the user running this script (typicall the live
# user). Therefore, when adding a new file, give as the first argument
# 'root' only if the complete path to it (including the file itself)
# is owned by root and already exists before the system is connected to
# the network (that is, before GDM's PostLogin script is run).
# If not, the following rules must be followed strictly:
#
# * only one non-root user is involved in the ownership situation (the
# file, its dir and the parent dirs). From now on let's assume it is
# the case and call it $USER.
#
# * if any non-root group has write access, it must not have any
# members.
#
# If any of these rules does not apply, the file cannot be added here
# safely and something is probably quite wrong and should be
# investigated carefully.
debug_file root "/etc/X11/xorg.conf"
debug_file amnesia "/home/amnesia/.xsession-errors"
debug_file root "/proc/asound/cards"
debug_file root "/proc/asound/devices"
debug_file root "/proc/asound/modules"
debug_file root "/var/log/Xorg.0.log"
debug_file Debian-gdm "/var/log/gdm3/:0-slave.log"
debug_file Debian-gdm "/var/log/gdm3/:0-greeter.log"
debug_file Debian-gdm "/var/log/gdm3/tails-greeter.errors"
debug_file root "/var/log/live-persist"
debug_file root "/var/log/live/boot.log"
debug_file root "/var/log/live/config.log"
debug_file root "/var/lib/gdm3/tails.persistence"
debug_file root "/var/lib/live/config/tails.physical_security"
debug_file root "/live/persistence/TailsData_unlocked/persistence.conf"
debug_file root "/live/persistence/TailsData_unlocked/live-additional-software.conf"
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment