Commit 640e4b58 authored by anonym's avatar anonym
Browse files

Merge remote-tracking branch 'origin/testing' into bugfix/10333-tails-debugging-info-leak

parents 2c0bed28 133fbcdd
#!/bin/sh
set -e
set -u
EXT="/usr/lib/icedove/extensions"
[ -d "$EXT" ] || exit 1
echo "Enabling Torbirdy and Enigmail in Icedove"
ln -s /usr/share/xul-ext/torbirdy "$EXT"/castironthunderbirdclub@torproject.org
ln -s /usr/lib/xul-ext/enigmail "$EXT"/\{847b3a00-7ab1-11d4-8f02-006008948af5\}
echo "Enabling the amnesia branding extension in Icedove"
ln -s /usr/local/share/tor-browser-extensions/branding@amnesia.boum.org "$EXT"
#!/bin/sh
set -e
# We don't want the real binary to be in $PATH:
# Also note that wget uses the executable name in some help/error messages,
# so wget-real/etc. should be avoided.
mkdir -p /usr/lib/wget
dpkg-divert --add --rename --divert /usr/lib/wget/wget /usr/bin/wget
# We don't want users or other applications using wget directly:
cat > /usr/bin/wget << 'EOF'
#!/bin/sh
unset http_proxy
unset HTTP_PROXY
unset https_proxy
unset HTTPS_PROXY
exec torsocks /usr/lib/wget/wget --passive-ftp "$@"
EOF
chmod 755 /usr/bin/wget
// This is the Debian specific preferences file for Mozilla Firefox
// You can make any change in here, it is the purpose of this file.
// You can, with this file and all files present in the
// /etc/thunderbird/pref directory, override any preference that is
// present in /usr/lib/thunderbird/defaults/pref directory.
// While your changes will be kept on upgrade if you modify files in
// /etc/thunderbird/pref, please note that they won't be kept if you
// do them in /usr/lib/thunderbird/defaults/pref.
pref("extensions.update.enabled", false);
// Use LANG environment variable to choose locale
pref("intl.locale.matchOS", true);
// Disable default mail checking (gnome).
pref("mail.shell.checkDefaultMail", false);
// if you are not using gnome
pref("network.protocol-handler.app.http", "x-www-browser");
pref("network.protocol-handler.app.https", "x-www-browser");
// Tell TorBirdy we're running Tails so that it adapts its behaviour.
//pref("vendor.name", "Tails");
// Disable mail indexing
pref("mailnews.database.global.indexer.enabled", false);
// Disable chat
pref("mail.chat.enabled", false);
// Disable system addons
pref("extensions.autoDisableScopes", 3);
pref("extensions.enabledScopes", 4);
// Only show the tab bar if there's more than one tab to display
pref("mail.tabs.autoHide", true);
// Try to disable "Would you like to help Icedove Mail/News by automatically reporting memory usage, performance, and responsiveness to Mozilla"
pref("toolkit.telemetry.prompted", 2);
pref("toolkit.telemetry.rejected", true);
pref("toolkit.telemetry.enabled", false);
/* Required, do not remove */
@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
#torbirdy-jondo-selection,
#torbirdy-whonix-selection,
#torbirdy-tor-selection,
#torbirdy-tor-selection + menuseparator,
#torbirdy-anon-settings,
#torbirdy-anonservice,
/* Hide "Chat account" on Icedove's start-up page */
#CreateAccountChat
{ display: none; }
user_pref("extensions.enigmail.configuredVersion", "1.7.2");
......@@ -20,7 +20,7 @@ SocksPort 127.0.0.1:9061 IsolateDestAddr
## SocksPort for Tails-specific applications
SocksPort 127.0.0.1:9062 IsolateDestAddr IsolateDestPort
## SocksPort for the default web browser
SocksPort 127.0.0.1:9150
SocksPort 127.0.0.1:9150 IsolateSOCKSAuth KeepAliveIsolateSOCKSAuth
## Entry policies to allow/deny SOCKS requests based on IP address.
## First entry that matches wins. If no SocksPolicy is set, we accept
......
#!/bin/sh
set -e
set -u
PROFILE="${HOME}/.icedove/profile.default"
start_icedove() {
# Give Icedove its own temp directory, similar rationale to a1fd1f0f & #9558.
TMPDIR="${PROFILE}/tmp"
mkdir --mode=0700 -p "$TMPDIR"
export TMPDIR
if [ -z "$XAUTHORITY" ]; then
XAUTHORITY=~/.Xauthority
export XAUTHORITY
fi
unset SESSION_MANAGER
/usr/bin/icedove --class "Icedove" -profile "${PROFILE}" "${@}"
}
start_icedove "${@}"
#!/bin/sh
unset http_proxy
unset HTTP_PROXY
unset https_proxy
unset HTTPS_PROXY
exec torsocks /usr/bin/wget "$@"
#!/bin/sh
# Get monotonic time in seconds. See clock_gettime(2) for details.
# Note: we limit ourselves to seconds simply because floating point
# arithmetic is a PITA in the shell.
clock_gettime_monotonic() {
perl -w -MTime::HiRes=clock_gettime,CLOCK_MONOTONIC \
-E 'say clock_gettime(CLOCK_MONOTONIC)' | \
sed 's/\..*$//'
}
# Run `check_expr` until `timeout` seconds has passed, and sleep
# `delay` (optional, defaults to 1) seconds in between the calls.
# Note that execution isn't aborted exactly after `timeout`
......@@ -11,9 +20,9 @@ wait_until() {
timeout="${1}"
check_expr="${2}"
delay="${3:-1}"
timeout_at=$(expr $(date +%s) + ${timeout})
timeout_at=$(expr $(clock_gettime_monotonic) + ${timeout})
until eval "${check_expr}"; do
if [ "$(date +%s)" -ge "${timeout_at}" ]; then
if [ "$(clock_gettime_monotonic)" -ge "${timeout_at}" ]; then
return 1
fi
sleep ${delay}
......
......@@ -82,7 +82,5 @@ mod_rev_dep() {
# Unloads module $1, and all modules that (transatively) depends on
# $1 (i.e. its reverse dependencies).
unload_module_and_rev_deps() {
for mod in $(mod_rev_dep ${1}); do
/sbin/rmmod ${mod}
done
/sbin/modprobe -r $(mod_rev_dep ${1})
}
......@@ -9,6 +9,7 @@
I2P_DEFAULT_CONFIG="/usr/share/i2p"
I2P_CONFIG="/var/lib/i2p/i2p-config"
I2P_TUNNEL_CONFIG="${I2P_CONFIG}/i2ptunnel.config"
I2P_WRAPPER_LOG="/var/log/i2p/wrapper.log"
i2p_is_enabled() {
grep -qw "i2p" /proc/cmdline
......@@ -27,7 +28,29 @@ i2p_eep_proxy_address() {
echo ${listen_host}:${listen_port}
}
i2p_has_bootstrapped() {
i2p_reseed_started() {
grep -q 'Reseed start$' "${I2P_WRAPPER_LOG}"
}
i2p_reseed_failed() {
grep -q 'Reseed failed, check network connection$' "${I2P_WRAPPER_LOG}"
}
i2p_reseed_completed() {
grep -q "Reseed complete" "${I2P_WRAPPER_LOG}"
}
i2p_reseed_status() {
if i2p_reseed_completed; then
echo success
elif i2p_reseed_failed; then
echo failure
elif i2p_reseed_started; then
echo running
fi
}
i2p_built_a_tunnel() {
netstat -nlp | grep -qwF "$(i2p_eep_proxy_address)"
}
......
......@@ -64,6 +64,37 @@ Options affecting the 'activate' action:
"
}
escape_dots() {
printf "%s\n" $1 | sed 's/\./\\./g'
}
migrate_persistence_preset()
{
local OLD_PRESET="${1}"
local OLD_PRESET_SOURCE="${2}"
local NEW_PRESET="${3}"
local NEW_PRESET_SOURCE="${4}"
local CONFIG="${5}"
if grep -E -qs --line-regex \
-e "$(escape_dots ${OLD_PRESET})\s+source=${OLD_PRESET_SOURCE}" \
"$CONFIG" \
&& ! grep -E -qs --line-regex \
-e "$(escape_dots ${NEW_PRESET})\s+source=${NEW_PRESET_SOURCE}" \
"$CONFIG"
then
warning "Need to make $NEW_PRESET persistent"
if [ "$PERSISTENCE_READONLY" = true ]
then
warning "Persistence configuration needs to be migrated, but read only was selected; please retry in read-write mode"
else
echo "$NEW_PRESET source=$NEW_PRESET_SOURCE" \
>> "$CONFIG" \
|| error "Failed to make $NEW_PRESET: $?"
warning "Successfully made $NEW_PRESET persistent"
fi
fi
}
warning ()
{
echo "warning: ${@}" >&2
......@@ -323,31 +354,19 @@ activate_volumes ()
fi
done
# Migrate Squeeze-era NetworkManager persistence setting to Wheezy.
for conf in $(ls /live/persistence/*_unlocked/persistence.conf || true)
do
if grep -E -qs --line-regex \
-e '/home/amnesia/\.gconf/system/networking/connections\s+source=nm-connections' \
"$conf" \
&& ! grep -E -qs --line-regex \
-e '/etc/NetworkManager/system-connections\s+source=nm-system-connections' \
# Migrate Squeeze-era NetworkManager persistence setting to Wheezy.
migrate_persistence_preset '/home/amnesia/.gconf/system/networking/connections' 'nm-connections' \
'/etc/NetworkManager/system-connections' 'nm-system-connections' "$conf"
# disable pre-Wheezy NM persistence setting
sed -r -i \
-e 's,^(/home/amnesia/\.gconf/system/networking/connections\s+source=nm-connections)$,#\1,' \
"$conf"
then
warning "Needs to make /etc/NetworkManager/system-connections persistent"
if [ "$PERSISTENCE_READONLY" = true ]
then
# XXX: don't really error-out, do we?
error "Persistence configuration needs to be migrated, but read only was selected; please retry in read-write mode"
fi
echo '/etc/NetworkManager/system-connections source=nm-system-connections' \
>> "$conf" \
|| error "Failed to make /etc/NetworkManager/system-connections persistent: $?"
warning "Successfully made /etc/NetworkManager/system-connections persistent"
# disable pre-Wheezy NM persistence setting
sed -r -i \
-e 's,^(/home/amnesia/\.gconf/system/networking/connections\s+source=nm-connections)$,#\1,' \
"$conf"
fi
# Migrate Claws-mail persistence setting to Icedove
migrate_persistence_preset '/home/amnesia/.claws-mail' 'claws-mail' \
'/home/amnesia/.icedove' 'icedove' "$conf"
done
# Fix permissions on persistent directories that were created
......
......@@ -2,7 +2,7 @@
set -e
# Import try_for()
# Import try_for() and clock_gettime_monotonic()
. /usr/local/lib/tails-shell-library/common.sh
# Import tor_bootstrap_progress()
......@@ -29,7 +29,7 @@ service tor restart
# options set by Vidalia will be lost since they weren't written to torrc.
bootstrap_progress=0
last_bootstrap_change=$(date +%s)
last_bootstrap_change=$(clock_gettime_monotonic)
maybe_restart_tor() {
local new_bootstrap_progress=$(tor_bootstrap_progress)
......@@ -38,14 +38,14 @@ maybe_restart_tor() {
return 0
elif [ $new_bootstrap_progress -gt $bootstrap_progress ]; then
bootstrap_progress=$new_bootstrap_progress
last_bootstrap_change=$(date +%s)
last_bootstrap_change=$(clock_gettime_monotonic)
return 1
elif [ $(expr $(date +%s) - $last_bootstrap_change) -ge 20 ]; then
elif [ $(expr $(clock_gettime_monotonic) - $last_bootstrap_change) -ge 20 ]; then
log "Tor seems to have stalled while bootstrapping. Restarting Tor."
clear_tor_log
service tor restart
bootstrap_progress=0
last_bootstrap_change=$(date +%s)
last_bootstrap_change=$(clock_gettime_monotonic)
return 1
else
return 1
......
#!/bin/sh
set -e
set -u
ZSH_VERSION="${ZSH_VERSION:-}"
# Get LANG
. /etc/default/locale
......@@ -11,25 +13,29 @@ export LANG
TEXTDOMAIN="tails"
export TEXTDOMAIN
# Must be set after gettext initialization
set -u
# Import wait_until()
. /usr/local/lib/tails-shell-library/common.sh
# Import i2p_has_bootstrapped(), i2p_router_console_is_ready() and
# set_best_i2p_router_console_lang().
# Import i2p_built_a_tunnel, i2p_reseed_failed, i2p_router_console_is_ready(),
# and set_best_i2p_router_console_lang().
. /usr/local/lib/tails-shell-library/i2p.sh
I2P_STARTUP_TIMEOUT=60
# We'll give up once 6 minutes have passed. Even with ridiculously
# subpar network conditions I've not seen bootstrapping take longer
# than this.
I2P_BOOTSTRAP_TIMEOUT=360
# When there are network problems (either local or remote), it can take up to 3
# minutes for all of the current reseed servers to be tried.
I2P_BOOTSTRAP_TIMEOUT=210
# After the router infos (RIs) are downloaded from the reseed servers
# it can take 3-5 minutes for a tunnel to be built, e.g.
# once we get to this point I2P should be ready to be used.
I2P_TUNNEL_BUILD_TIMEOUT=300
startup_failure() {
/usr/local/sbin/tails-notify-user \
"`gettext \"I2P failed to start\"`" \
"`gettext \"Something went wrong when I2P was starting. Check the logs in /var/log/i2p for more information.\"`"
service i2p dump # generate a thread dump
sleep 5 # Give thread dump ample time to complete
service i2p stop # clean up, just in case
exit 1
}
......@@ -38,6 +44,10 @@ wait_until_i2p_router_console_is_ready() {
wait_until ${I2P_STARTUP_TIMEOUT} i2p_router_console_is_ready
}
wait_until_i2p_has_bootstrapped() {
wait_until ${I2P_BOOTSTRAP_TIMEOUT} '[ "$(i2p_reseed_status)" = success ]'
}
notify_router_console_success() {
/usr/local/sbin/tails-notify-user \
"`gettext \"I2P's router console is ready\"`" \
......@@ -51,8 +61,10 @@ bootstrap_failure() {
exit 1
}
wait_until_i2p_has_bootstrapped() {
wait_until ${I2P_BOOTSTRAP_TIMEOUT} i2p_has_bootstrapped
wait_until_i2p_builds_a_tunnel() {
wait_until ${I2P_TUNNEL_BUILD_TIMEOUT} i2p_built_a_tunnel
# static sleep to work around upstream bug.
sleep 240
}
notify_bootstrap_success() {
......@@ -76,6 +88,7 @@ case "${1}" in
wait_until_i2p_router_console_is_ready || startup_failure
notify_router_console_success
wait_until_i2p_has_bootstrapped || bootstrap_failure
wait_until_i2p_builds_a_tunnel || bootstrap_failure
notify_bootstrap_success
;;
stop)
......
......@@ -18,6 +18,15 @@
</Description>
</em:targetApplication>
<!-- Thunderbird -->
<em:targetApplication>
<Description>
<em:id>{3550f703-e582-4d05-9a08-453d09bdfdc6}</em:id>
<em:minVersion>24.0</em:minVersion>
<em:maxVersion>32.0</em:maxVersion>
</Description>
</em:targetApplication>
</Description>
</RDF>
http://torbrowser-archive.tails.boum.org/5.0.3/
http://torbrowser-archive.tails.boum.org/5.0.4/
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment