Skip to content

Use desktop portals in Tor Browser

Rationale

Using desktop portals in Tor Browser allows users to open files which Tor Browser usually doesn't have access to (#10422) and provides better integration into the desktop via other portal interfaces like the settings interface (see #19328).

We have a working PoC (actually two: one which fakes some things to make the portal service and Tor Browser think it's running in a flatpak and one which actually runs Tor Browser in a flatpak) to run Tor Browser with portals.

Things outside of our control (upstream)

Regressions

Not regressions but unfortunately not fixed by portals (yet)

Things under our control

Regressions

  • Opening a web page via double-click on nautilus fails.
    • Works on 10422-portals-in-tor-browser and 10422-tor-browser-in-flatpak as long as the file is accessible by Tor Browser. When it's not accessible by Tor Browser it's not a regression.
      • Firefox in Flatpak seems to use the document portal to access arbitrary files -> We might be able to get that to work in Tor Browser too
  • Also /usr/local/bin/tails-documentation
    • tails-documentation actually works as expected on 10422-portals-in-tor-browser and 10422-tor-browser-in-flatpak

User-visible improvements

  • They can now open/save file in every place of $HOME (saving might require retrying) (#10422)
  • Settings like the window manager's button layout (minimize maximize buttons) are respected (#19328)
  • Whatever other portals Tor Browser uses (not clear)

FT-visible improvements

  • Less NIH: we will get rid of most our own code to sandbox applications (and still allow them access to the resources which they do need access to)
    • Probably avoid bugs like #18485 (closed), which we suspect is caused by buggy D-Bus proxy handling on our side. Things like that would be taken over by Flatpak.
  • flatpak has a nice debugging interface, much nicer than what we have now
  • In perspective, Flatpak will allow us to restrict AppArmor more → more security, but not now.
  • In perspective, Flatpak is a "requirement" to ship Signal #14567

Archive

Copied from #10422:

Originally created by @sajolida on #10422 (Redmine)

In https://mailman.boum.org/pipermail/tails-ux/2015-September/000645.html we’re been discussing the idea of granting Tor Browser access to files if and only if the user decide to open or otherwise access it.

This would improve on the current control access policy based on a set of folders (/Tor Browser and /Persistent/Tor Browser). This idea is inspired by “Guidelines and Strategies for Secure Interaction Design” by Ka-Ping Yee and also seems to be of interest to GNOME as “Implicit permission grants from interactive operations”:

https://mail.gnome.org/archives/gnome-os-list/2015-March/msg00010.html

We should follow-up on the plans of GNOME regarding this but there’s not much we can do ourselves for the time being.

Existing WIP and discussions:

Blueprints:

Parent Task: #15678

Edited by intrigeri
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information