Commit 8b56e3f6 authored by bertagaz's avatar bertagaz
Browse files

Merge branch 'master' into stable

parents 52eaf89d 0e901e24
--- a/etc/apparmor.d/usr.bin.thunderbird.orig 2018-01-09 20:30:54.000000000 +0000
+++ b/etc/apparmor.d/usr.bin.thunderbird 2018-02-23 14:48:02.180000000 +0000
@@ -16,7 +16,6 @@
# TODO: finetune this for required accesses
#include <abstractions/dbus>
#include <abstractions/dbus-accessibility>
- #include <abstractions/dbus-session>
#include <abstractions/gnome>
#include <abstractions/ibus>
#include <abstractions/nameservice>
@@ -24,29 +23,19 @@
#include <abstractions/p11-kit>
#include <abstractions/private-files>
#include <abstractions/ssl_certs>
- #include <abstractions/ubuntu-browsers>
#include <abstractions/ubuntu-browsers.d/java>
#include <abstractions/ubuntu-helpers>
# Allow opening attachments
# TODO: create and use abstractions for opening various file formats
- /{usr/local/,usr/,}bin/* Cx -> sanitized_helper,
+ /{usr/local/,usr/,}bin/{[^g],g[^p],gp[^g]}* Cx -> sanitized_helper,
/usr/lib/libreoffice/program/soffice Cxr -> sanitized_helper,
- # For Xubuntu to launch the browser
- /usr/bin/exo-open ixr,
- /usr/lib/@{multiarch}/xfce4/exo-1/exo-helper-1 ixr,
- /etc/xdg/xdg-xubuntu/xfce4/helpers.rc r,
- /etc/xdg/xfce4/helpers.rc r,
-
# for crash reports?
ptrace (read,trace) peer=@{profile_name},
@{thunderbird_executable} ixr,
- # Pulseaudio
- /usr/bin/pulseaudio Pixr,
-
owner @{HOME}/.{cache,config}/dconf/user rw,
owner /run/user/[0-9]*/dconf/user rw,
owner @{HOME}/.config/gtk-3.0/bookmarks r,
@@ -107,6 +96,8 @@
/etc/gre.d/* r,
# noisy
+ deny /etc/dconf/profile/user r,
+ deny /etc/machine-id r,
deny @{MOZ_LIBDIR}/** w,
deny /usr/lib/thunderbird-addons/** w,
deny /usr/lib/xulrunner-addons/** w,
@@ -138,7 +129,6 @@
/etc/lsb-release r,
/etc/ssl/openssl.cnf r,
/usr/lib/thunderbird/crashreporter ix,
- /usr/bin/expr ix,
/sys/devices/system/cpu/ r,
/sys/devices/system/cpu/** r,
@@ -190,15 +180,6 @@
deny /usr/share/mozilla/extensions/**/ w,
deny /usr/share/mozilla/ w,
- # Miscellaneous (to be abstracted)
- # Ideally these would use a child profile. They are all ELF executables
- # so running with 'Ux', while not ideal, is ok because we will at least
- # benefit from glibc's secure execute.
- /usr/bin/mkfifo Uxr, # investigate
- /{usr/,}bin/ps Uxr,
- /{usr/,}bin/uname Uxr,
- /usr/bin/locale Uxr,
-
/usr/bin/gpg Cx -> gpg,
/usr/bin/gpg2 Cx -> gpg,
/usr/bin/gpgconf Cx -> gpg,
@@ -224,7 +205,9 @@
deny owner @{HOME}/.cache/thunderbird/**/_CACHE_* w,
# noise from inherited files
+ deny @{HOME}/.thunderbird/*.default/ImapMail/*/INBOX w,
deny /usr/{lib,share}/thunderbird/omni.ja r,
+ deny /usr/share/thunderbird/extensions/** r,
# For smartcards?
/dev/bus/usb/ r,
@@ -255,6 +255,7 @@
owner @{HOME}/.gnupg/.#*[0-9]x rwl,
owner @{HOME}/.gnupg/.#lk0x[0-9a-f]* rwl,
owner @{HOME}/.gnupg/.gpg-v[0-9]*-migrated rw,
+ owner @{HOME}/.gnupg/openpgp-revocs.d/{,[A-F0-9]*.rev} rw,
owner @{HOME}/** r,
owner @{PROC}/@{pids}/mountinfo r,
@@ -272,13 +255,16 @@
/usr/bin/dirmngr ix,
owner @{PROC}/@{pids}/task/@{tid}/comm rw,
+ # for revocation certificate generation
+ owner @{HOME}/.{icedove,thunderbird}/*.default/0x[A-F0-9]*_rev.asc rw,
+
# for signature generation
- owner /tmp/nsemail.eml w,
- owner /tmp/nsemail-[0-9]*.eml w,
+ owner @{HOME}/.{icedove,thunderbird}/*.default/tmp/nsemail.eml w,
+ owner @{HOME}/.{icedove,thunderbird}/*.default/tmp/nsemail-[0-9]*.eml w,
# for signature verifications
- owner /tmp/data.sig r,
- owner /tmp/data-[0-9]*.sig r,
+ owner @{HOME}/.{icedove,thunderbird}/*.default/tmp/data.sig r,
+ owner @{HOME}/.{icedove,thunderbird}/*.default/tmp/data-[0-9]*.sig r,
owner /tmp/gpg-[a-zA-Z0-9]*/S.gpg-agent rw,
--- a/etc/apparmor.d/system_tor 2016-06-01 21:34:23.000000000 +0000
+++ b/etc/apparmor.d/system_tor 2016-06-10 11:09:09.249017739 +0000
@@ -4,6 +4,15 @@
@@ -4,6 +4,18 @@
profile system_tor flags=(attach_disconnected) {
#include <abstractions/tor>
......@@ -12,6 +12,9 @@
+ # at least when using bridges as torrc is owned by debian-tor:debian-tor
+ # with permissions 0600 once it's been saved by Tor Launcher.
+ capability dac_read_search,
+
+ # Used by Tor to do clearnet DNS lookups while in bridge mode (#8775).
+ /etc/resolv-over-clearnet.conf r,
+
owner /var/lib/tor/** rwk,
owner /var/lib/tor/ r,
......
stretch-backports.chroot
\ No newline at end of file
deb http://ftp.us.debian.org/debian/ stretch-backports main contrib non-free
tails (3.5.1) UNRELEASED; urgency=medium
tails (3.6) unstable; urgency=medium
* Dummy entry for potential emergency release.
* Major changes
- Upgrade Tor Browser to 7.5.1.
- Upgrade Tor to 0.3.2.10. (Closes: #15158)
- Add ability to lock the screen. (Closes: #5684)
- Add initial support for Meek bridges. (Closes: #8243)
- Upgrade to Thunderbird 52.6.0. (Closes: #15298)
- Enable Thunderbird AppArmor profile. (Closes: 11973)
- Upgrade Linux to 4.15.0-1. (Closes: #15309).
- Upgrade systemd to 237.
- Upgrade Electrum to 3.0.6. (Closes: #15022)
- Upgrade the base system to the Debian Stretch 9.4 point-release
(Closes: #15341)
- Port a few shell scripts to Python thanks to GoodCrypto. (Closes: #11198)
* Security fixes
- Upgrade Intel processor microcode firmware. (Closes: #15173).
- Upgrade poppler to 0.48.0-2+deb9u1. (CVE-2017-14929, CVE-2017-1000456)
- Upgrade tiff to 4.0.8-2+deb9u2 (CVE-2017-9935, CVE-2017-11335,
CVE-2017-12944, CVE-2017-13726, CVE-2017-13727, CVE-2017-18013)
- Upgrade ffmpeg to 7:3.2.10-1~deb9u1. (CVE-2017-17081)
- Upgrade libtasn1-6 to 4.10-1.1+deb9u1. (CVE-2017-10790, CVE-2018-6003)
- Upgrade Libre Office to 1:5.2.7-1+deb9u2. (CVE-2018-6871)
- Upgrade libvorbis to 1.3.5-4+deb9u1. (CVE-2017-14632, CVE-2017-14633)
- Upgrade gcc to 6.3.0-18+deb9u1.
- Upgrade util-linux to 2.29.2-1+deb9u1. (CVE-2018-7738)
- Upgrade isc-dhcp to 4.3.5-3+deb9u1 (CVE-2017-3144, CVE-2018-5732,
CVE-2018-5733)
-- Tails developers <tails@boum.org> Tue, 23 Jan 2018 01:33:25 +0100
* Minor improvements
- Avoid noisy warning at boot time by creating tails-upgrade-frontend's
trusted GnuPG homedir with stricter permissions, then making it looser.
(Closes: #7037)
- Drop (broken) Thunderbird dedicated SocksPort. (Closes: #12460)
- Drop customized update-ca-certificates.service. (Closes: #14756)
- Update AppArmor cupsd profile. (Closes: #15029)
- Improve UX when GDM does not start. (Closes: #14521)
- Install packages needed to support Video Acceleration API.
(Closes: #14580)
- Upgrade aufs-dkms for Linux 4.15. (Closes: #15132).
- Ship pdf-redact-tools, thanks to dachary <loic@dachary.org>.
(Closes: #15052)
- Additional Software Packages: convert to python3 and PEP-8.
(Closes: #15198)
- Additional Software Packages: do not check for updates every time the
network gets reconnected. (Closes: #9819)
- Revert to xorg-xserver from Stretch. (Closes: #15232)
- Open Tails documentation in Tor Browser when online. (Closes: #15332)
- Disable Enigmail's Memory Hole feature. (Closes: #15201)
- Persistence Setup: stop depending on Synaptic. (Closes: #15263)
* Bugfixes
- Additional Software Packages: fix the "incomplete online upgrade
process" bug in offline mode (Closes: #14570)
- Additional Software Packages: do not block Desktop opening.
(Closes: #9059)
- Install OpenPGP Applet 1.1. (Closes: #6398).
- Repair rng-tools using a real start-stop-daemon program.
(Closes: #15344)
- Tails installer: fix bug with unicode status messages. (Closes: #15254)
* Build system
- Abort if tails-custom-apt-sources failed.
- Abort the ISO build when DKMS modules are not built. (Closes: #14789).
- Improve how we track dependencies in build hooks. (Closes: #14818)
- Fix (potential) rare race condition during build.
- Ensure the SquashFS has /etc/hostname properly configured.
(Closes: #15322)
- Bump builder VM's RAM. (Closes: #15310)
* Test suite
- Log the list of systemd jobs when systemctl is-system-running fails.
(Closes: #14772).
- Allow more time for 'systemctl is-system-running' to succeed.
- Only support SikuliX, not Sikuli.
- Disable SPICE clipboard sharing.
- Don't flood the debug logger with the journal contents.
- Rescue exception.
- Enter a name into the Thunderbird account configuration.
(Closes: #11256)
- Fix the "I do not see ..." step's case. (Closes: #14929)
- Mark scenarios that use the "The Report an Error launcher will…" step
as fragile (Closes: #15321)
- Test that Tor Browser opens docs when online. (Closes: #15332)
- Adapt test after warning moved to after Unsafe Browser verification
dialog. (Closes: #8775)
- Dogtailify electrum.feature.
- Add additional software packages feature. (Closes: #14572)
- Disable test that is broken due to a Tor Browser bug. (Closes: #15336)
-- Tails developers <tails@boum.org> Mon, 12 Mar 2018 21:28:29 +0100
tails (3.5) unstable; urgency=medium
......
@product
Feature: Additional software packages
As a Tails user
I may want to install softwares not shipped in Tails
And have them installed automatically when I enable persistence in the Greeter
Scenario: Additional software packages are installed even without network
Given I have started Tails without network from a USB drive with a persistent partition enabled and logged in with an administration password
And the network is plugged
And Tor is ready
And all notifications have disappeared
And available upgrades have been checked
# This is required to use APT in the test suite as explained in
# commit e2510fae79870ff724d190677ff3b228b2bf7eac
And I configure APT to use non-onion sources
When I update APT using apt
And I configure additional software packages to install "sslh"
And I install "sslh" using apt
# We have to save the non-onion APT sources in persistence, so
# that on next boot the additional software packages service has
# the right APT indexes to install the package we want.
And I make my current APT sources persistent
And I shutdown Tails and wait for the computer to power off
And I start Tails from USB drive "__internal" with network unplugged and I login with persistence enabled
Then the additional software package installation service is run
And the package "sslh" is installed
@product @doc
Feature: Tails documentation
Scenario: The Tails documentation launcher on the desktop works
Scenario: The Tails documentation launcher on the desktop works when offline
Given I have started Tails from DVD without network and logged in
When I double-click on the Tails documentation launcher on the desktop
Then the documentation viewer opens the "Getting started" page
Scenario: The Tails documentation launcher on the desktop works when online
Given I have started Tails from DVD and logged in and the network is connected
When I double-click on the Tails documentation launcher on the desktop
Then the Tor Browser starts
And the Tor Browser opens the Getting started page
#15321
@fragile
Scenario: The Report an Error launcher will open the support documentation
......
......@@ -8,7 +8,7 @@ Feature: Electrum Bitcoin client
Given I have started Tails from DVD without network and logged in
When I start Electrum through the GNOME menu
But persistence for "electrum" is not enabled
Then I see a warning that Electrum is not persistent
And I see a warning that Electrum is not persistent
#11697
@fragile
......@@ -21,14 +21,18 @@ Feature: Electrum Bitcoin client
Then persistence for "electrum" is enabled
When I start Electrum through the GNOME menu
But a bitcoin wallet is not present
Then I am prompted to configure Electrum
When I create a new bitcoin wallet
Then Electrum starts
And I am prompted to configure Electrum
When I follow the Electrum wizard to create a new bitcoin wallet
Then a bitcoin wallet is present
And I see the main Electrum client window
And Electrum successfully connects to the network
And I shutdown Tails and wait for the computer to power off
Then I shutdown Tails and wait for the computer to power off
Given I start Tails from USB drive "__internal" and I login with persistence enabled
When I start Electrum through the GNOME menu
And a bitcoin wallet is present
And I see the main Electrum client window
Then Electrum successfully connects to the network
But a bitcoin wallet is present
Then Electrum starts
And I am prompted to enter my Electrum wallet password
When I enter my Electrum wallet password
Then I see the main Electrum client window
And Electrum successfully connects to the network
When /^I configure additional software packages to install "(.+?)"$/ do |package|
$vm.file_overwrite(
'/live/persistence/TailsData_unlocked/live-additional-software.conf',
package + "\n"
)
end
Then /^the additional software package installation service is run$/ do
try_for(300) do
$vm.file_exist?('/run/live-additional-software/installed')
end
end
......@@ -38,6 +38,18 @@ EOF
)
end
When /^I make my current APT sources persistent$/ do
$vm.execute("install -d -m 755 /live/persistence/TailsData_unlocked/apt-sources.list.d")
$vm.file_append(
'/live/persistence/TailsData_unlocked/persistence.conf',
"/etc/apt/sources.list.d source=apt-sources.list.d,link\n"
)
$vm.file_overwrite(
'/live/persistence/TailsData_unlocked/apt-sources.list.d/persistent.list',
$vm.file_content($vm.file_glob('/etc/apt/{,*/}*.list'))
)
end
When /^I update APT using apt$/ do
recovery_proc = Proc.new do
step 'I kill the process "apt"'
......@@ -59,7 +71,7 @@ Then /^I install "(.+)" using apt$/ do |package_name|
retry_tor(recovery_proc) do
Timeout::timeout(2*60) do
$vm.execute_successfully("echo #{@sudo_password} | " +
"sudo -S apt install #{package_name}",
"sudo -S DEBIAN_PRIORITY=critical apt -y install #{package_name}",
:user => LIVE_USER)
end
end
......
# coding: utf-8
When /^I start the Unsafe Browser(?: through the GNOME menu)?$/ do
step "I start \"Unsafe Browser\" via GNOME Activities Overview"
end
......@@ -213,3 +214,16 @@ Then /^the Tor Browser shows the "([^"]+)" error$/ do |error|
found = headers.any? { |heading| heading.text == error }
raise "Could not find the '#{error}' error in the Tor Browser" unless found
end
# This step shouldn't be needed (the '"$title}" has loaded in the Tor
# Browser' step should be enough), but since we run Dogtail with
# python2 (#12185) we have terrible unicode support; for instance
# `.child('Tails - Getting started…')` will fail since Dogtail expects
# ascii and cannot decode "…".
Then /^the Tor Browser opens the Getting started page$/ do
try_for(60) do
@torbrowser
.children(roleName: "document frame")
.any? { |f| f.name == 'Tails - Getting started…' }
end
end
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment