Audio in TBB when process in enforced

GNUser · 2015-07-10 15:34:33 UTC

After a long time away from GNU/Linux security, I have decided to check apparmor profiles again.
A few days ago I think I saw in whonix git a profile for tor browser that in the last lines said something like “it’s not enough to add abstractions/audio to get sound” and it had a special permission given to pulse in the next line. I can’t find it anymore and since one of my problems when I tried these profiles was exactly not getting sound in my TBB, I would like to know if this profile is still available?

GNUser · 2015-07-10 22:31:30 UTC

I think i found what I was looking for.
But now I have a problem. I am using the profile as shown below (which is simpler I think than the one you have here), but it gives a warning

“Warning from torprofile (torprofile line 79): profile /home/*/tor-browser_en-US/Browser/firefox network rules not enforced”

And when I click start-tor-browser, it won’t give me anything (neither the launcher or the browser, nothing).

Any ideas?
My profile:

#include <tunables/global>

/home/*/tor-browser_en-US/Browser/firefox {
#include <abstractions/gnome>
#include <abstractions/base>
#include <abstractions/fonts>
#include <abstractions/user-tmp>
#include <abstractions/X>

Uncomment the following line if you don’t want the Tor Browser

to have direct access to your sound hardware. Note that this is not

enough to have working sound support in Tor Browser.

#include <abstractions/audio>

capability sys_ptrace,

#dbus,
network tcp,

deny /etc/host.conf r,
deny /etc/hosts r,
deny /etc/nsswitch.conf r,
deny /etc/resolv.conf r,
deny /etc/passwd r,
deny /etc/group r,
deny /etc/mailcap r,

deny /etc/machine-id r,
deny /var/lib/dbus/machine-id r,

@{PROC}/[0-9]/mountinfo r,
@{PROC}/[0-9]/stat r,
@{PROC}/[0-9]/task//stat r,
@{PROC}/sys/kernel/random/uuid r,

owner @{HOME}//tor-browser_en-US/ r,
owner @{HOME}//tor-browser_en-US/* r,
owner @{HOME}//tor-browser_en-US/.** rwk,
owner @{HOME}//tor-browser_en-US/Browser/.** rwk,
owner @{HOME}//tor-browser_en-US/Browser/ r,
owner @{HOME}//tor-browser_en-US/Browser/** r,
owner @{HOME}//tor-browser_en-US/Browser/.so mr,
owner @{HOME}//tor-browser_en-US/Browser/components/.so mr,
owner @{HOME}//tor-browser_en-US/Browser/browser/components/.so mr,
owner @{HOME}//tor-browser_en-US/Browser/firefox rix,
owner @{HOME}//tor-browser_en-US/Browser/TorBrowser/Data/Browser/profiles.ini r,
owner @{HOME}//tor-browser_en-US/Browser/TorBrowser/Data/Browser/profile.default/ r,
owner @{HOME}//tor-browser_en-US/Browser/TorBrowser/Data/Browser/profile.default/** rwk,
owner @{HOME}//tor-browser_en-US/Browser/TorBrowser/Tor/tor Px,
owner @{HOME}//tor-browser_en-US/Browser/TorBrowser/Tor/libstdc++.so.6 m,
owner @{HOME}//tor-browser_en-US/Browser/Desktop/ rw,
owner @{HOME}//tor-browser_en-US/Browser/Desktop/** rwk,
owner @{HOME}//tor-browser_en-US/Browser/Downloads/ rw,
owner @{HOME}//tor-browser_en-US/Browser/Downloads/** rwk,

/etc/mailcap r,
/etc/mime.types r,

/usr/share/ r,
/usr/share/mime/ r,
/usr/share/themes/ r,
/usr/share/applications/** rk,
/usr/share/gnome/applications/ r,
/usr/share/gnome/applications/kde4/ r,
/usr/share/poppler/cMap/ r,

/sys/devices/system/cpu/ r,
/sys/devices/system/cpu/present r,
deny /sys/devices/virtual/block/*/uevent r,

Should use abstractions/gstreamer instead once merged upstream

/etc/udev/udev.conf r,
/run/udev/data/+pci:* r,
/sys/devices/pci[0-9]/**/uevent r,
owner /{dev,run}/shm/shmfd- rw,

}

troubadour · 2015-07-11 15:57:11 UTC

Split this topic as it might be of interest to some users, and does not get buried in the profiles development discussion.

The profile you found seems to be a merge of a profile developed for torbrowser-launcher and the one developed in Whonix (there has been a try at some stage). Not surprisingly, it does not work any longer.

Regarding the audio, there is a strange issue: it works when Tor Browser is not enforced, and does not otherwise, but without AppArmor denied message. Furthermore, after starting an audio link, the firefox process does not exit, preventing Tor Browser to restart.

The workaround is to install pulseaudio.

I cannot explain it. Could you double check by leaving the original Whonix profile untouched and installing pulseaudio?

Note: the above is valid for Debian jessie based Whonix (from Whonix 11). There are some issues in Debian wheezy that we don’t want to deal with.

GNUser · 2015-07-15 11:34:21 UTC

Thank you for your kind reply.
Well, right now I am using Debian 7 Whezzy, so I don’t know how much good it will do to test it now. However, I will be replacing it with Debian 8 Jessie in about a month or so, and will continue testing then.

I have also been thinking, which should be considered more “dangerous” and more in a need of app armor profile. The Tor Browser or the Tor service itself. Because the way I see the Tor Browser can only be attacked by the websites who don’t know who I am, but the Tor service being attacked means I could be individually targeted by someone who had control over the Dir Authorities.

Am I right on this, or missing something?

EDIT: Btw, I do have pulseaudio installed. Though like I said, I am running Whezzy.

troubadour · 2015-07-16 19:30:58 UTC

The Tor browser is confined by AppArmor in Whonix Wokstation, and the tor service is also confined in Whonix Gateway (system_tor profile)

CooloutAC · 2015-09-12 00:26:36 UTC

I have the same issue, no audio in the torbrowser, and no apparmor alert message.

CooloutAC · 2015-09-13 03:54:05 UTC

I already had pulseaudio installed. Should I try to use the above profile?

troubadour · 2015-09-16 20:47:10 UTC

No, it will not work.

CooloutAC · 2015-09-18 16:23:35 UTC

ya, i don’t use audio much in tor browser but it would be nice to have. any i deas why it doesn’t work in mine? I get these two messages in syslog:

audit: type=1400 audit(1442593130.998:940): apparmor=“DENIED” operation=“open” profile="/home//tor-browser_/Browser/firefox" name="/etc/machine-id" pid=8546 comm=4D6564696120417564696F requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0

audit: type=1400 audit(1442592063.679:938): apparmor=“DENIED” operation=“open” profile="/home//tor-browser_/Browser/firefox" name="/rw/usrlocal/share/applications/" pid=8241 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0

I don’t believe they have anything to do with audio? not sure why it doesn’t work?

CooloutAC · 2015-09-18 16:28:13 UTC

I get these two messages when i first open up the browser:

audit: type=1400 audit(1442593306.257:941): apparmor=“DENIED” operation=“open” profile="/home//tor-browser_/Browser/firefox" name="/rw/usrlocal/share/fonts/" pid=8617 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0

audit: type=1400 audit(1442593307.666:942): apparmor=“DENIED” operation=“open” profile="/home//tor-browser_/Browser/firefox" name="/rw/usrlocal/share/applications/" pid=8617 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0

But I don’t think they would have to do with audio either?

troubadour · 2015-09-22 16:25:17 UTC

The AppArmor messages should not have anything to do with audio.

On my side, for the time being, audio is not working at all in VirtualBox, period, and I have no time to investigate.

Regarding the messages, the location for “/usr/local” under “/rw” is non standard. AppArmor will report denied messages as long as this is not corrected . “/usr/local” should be in the root directory.

Patrick · 2015-09-22 16:37:38 UTC

Similar / duplicate:
Whonix AppArmor Profiles Development Discussion

It’s Qubes specific. More on usr local:
Whonix AppArmor Profiles Development Discussion

exacto · 2016-03-12 17:35:48 UTC

The links above are broken.

Did anyone find a fix to missing audio when TBB apparmor profile enforced? I don’t want to install pulseaudio.

The little I can assume is firefox tries to find gstreamer and fails, and then falls back to pulse.

Patrick · 2016-03-12 23:52:41 UTC

Links fixed.

exacto · 2016-03-14 04:22:57 UTC

Thanks…

I found a fix!

The following lines in /etc/apparmor.d/home.*.tor-browser_*.Browser.firefox:

    deny /etc/passwd r,
    deny /etc/group r,

have to be inverted to allow read:

    /etc/passwd r,
    /etc/group r,

so:

    sudo -s
    sed -ri 's#^(\s*)deny\s\s*(/etc/passwd r,)#\1\2#' '/etc/apparmor.d/home.*.tor-browser_*.Browser.firefox'
    sed -ri 's#^(\s*)deny\s\s*(/etc/group r,)#\1\2#' '/etc/apparmor.d/home.*.tor-browser_*.Browser.firefox'
    systemctl reload apparmor

After doing this, I get audio in TBB.

Granting passwd and group access is not great but better than disabling the whole profile.