apparmor + firejail behavior torbrowser

Support
#1

I was running tor browser with the command firejail --seccomp torbrowser. It worked fine, then all of the suddn noscript stopped working and said it had to be restarted. I restarted tor browser the same way (firejail --seccomp) and got a red screen, saying something went wrong.

I then opened up torbrowser without firejail and it worked perfectly.

Does firejail --seccomp torbrowser disable noscript in some way?

As for apparmor, when I run sudo aa-status, it shows 3 processes in enforce mode for tor-browser, but I am only running 1. They each have their own id also.

Can anyone help me investigate this to see what is going on and how to correct it?

Tor Browser Hardening (hardened malloc, firejail, apparmor) vs Web Fingerprint
#2

Documentation updated just now. See Tor Browser Essentials instead.

Not deliberate. It probably happens due to firejail restricting access to that file or something else.

#3

The default seccomp filter for firejail likely blocks a syscall the Tor Browser needs. Use the proper profile instead by running

firejail --profile=/etc/firejail/start-tor-browser.profile torbrowser
#4

Insufficient. Details:

We don’t confine the wrapper /usr/bin/torbrowser. As per above ticket. We confine actual Tor Browser only.

Use as per wiki instructions.

1 Like
#5

Yes but the only way to confine the Tor Browser only while still using the torbrowser script is to set a variable in a file in /etc/torbrowser.d which is permanent unless you remove it which is not good for a one-time test.

#6

No, can also use.

torbrowser --hardening

That is temporary until next browser start.
(Adds hardening to actual Tor Browser only. Not to the wrapper. Same.)

(Environment variable would also work.)

2 Likes
#7

Ah, I haven’t tried that yet so I forgot it was possible.