intrigeri · intrigeri · intrigeri · intrigeri · intrigeri · intrigeri
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
 # Tor Browser Launcher Changelog

+## 0.3.0
+
+* Switched from python2 to python3
+* Switched from gtk2 to Qt5
+* Switched from twisted to requests/socks
+* Use QThreads for async
+* Removed modem sound
+* Only refresh gpg keyring on verification error, instead of every time
+* Updated AppArmor profiles
+* Updated available languages, and fixed locale detection bug
+* Fixed false signature verification error related to twisted
+
 ## 0.2.9

 * Fixed crash issue related to Tor Browser 7.5 changing how the currently installed version number is stored

--- a/apparmor/local/torbrowser.Browser.firefox
+++ b/apparmor/local/torbrowser.Browser.firefox
-# Site-specific additions and overrides for torbrowser.Browser.firefox.
-# For more details, please see /etc/apparmor.d/local/README. 
--- a/apparmor/local/torbrowser.Browser.plugin-container
+++ b/apparmor/local/torbrowser.Browser.plugin-container
-# Site-specific additions and overrides for torbrowser.Browser.plugin-container.
-# For more details, please see /etc/apparmor.d/local/README.
--- a/apparmor/local/torbrowser.Tor.tor
+++ b/apparmor/local/torbrowser.Tor.tor
-# Site-specific additions and overrides for torbrowser.Tor.tor.
-# For more details, please see /etc/apparmor.d/local/README.
--- a/apparmor/torbrowser.Browser.firefox
+++ b/apparmor/torbrowser.Browser.firefox
 #include <tunables/global>
 #include <tunables/torbrowser>

-/home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox {
+@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real
+
+profile torbrowser_firefox @{torbrowser_firefox_executable} {
  #include <abstractions/gnome>

  # Uncomment the following lines if you want to give the Tor Browser read-write
@@ -13,7 +15,8 @@
  network netlink raw,
  network tcp,

-  ptrace (trace) peer=@{profile_name},
+  ptrace (trace) peer=torbrowser_plugin_container,
+  signal (send) set=("term") peer=torbrowser_plugin_container,

  deny /etc/host.conf r,
  deny /etc/hosts r,
@@ -46,10 +49,11 @@
  owner @{torbrowser_home_dir}.bak/ rwk,
  owner @{torbrowser_home_dir}.bak/** rwk,
  owner @{torbrowser_home_dir}/*.so mr,
+  owner @{torbrowser_home_dir}/.cache/fontconfig/ rwk,
+  owner @{torbrowser_home_dir}/.cache/fontconfig/** rwkl,
  owner @{torbrowser_home_dir}/components/*.so mr,
  owner @{torbrowser_home_dir}/browser/components/*.so mr,
  owner @{torbrowser_home_dir}/firefox rix,
-  owner @{torbrowser_home_dir}/plugin-container px -> torbrowser_plugin_container,
  owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/updater ix,
  owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/0/MozUpdater/bgupdate/updater ix,
  owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profiles.ini r,
@@ -59,10 +63,14 @@
  owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so mr,
  owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr,

+  # Web Content processes
+  owner @{torbrowser_firefox_executable} px -> torbrowser_plugin_container,
+
  /etc/mailcap r,
  /etc/mime.types r,

  /usr/share/ r,
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
  /usr/share/mime/ r,
  /usr/share/themes/ r,
  /usr/share/applications/** rk,
@@ -103,6 +111,10 @@
  deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
  deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,

+  # Silence denial logs about PulseAudio
+  deny /etc/pulse/client.conf r,
+  deny /usr/bin/pulseaudio x,
+
  # KDE 4
  owner @{HOME}/.kde/share/config/* r,


--- a/apparmor/torbrowser.Browser.plugin-container
+++ b/apparmor/torbrowser.Browser.plugin-container
 #include <tunables/global>
 #include <tunables/torbrowser>

+@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real
+
 profile torbrowser_plugin_container {
  #include <abstractions/gnome>

-  # Uncomment the following lines if you don'want the Tor Browser
+  # Uncomment the following lines if you want Tor Browser
  # to have direct access to your sound hardware. You will also
-  # need to remove the "deny" word in the machine-id lines further
-  # bellow.
+  # need to remove, further bellow:
+  #  - the "deny" word in the machine-id lines
+  #  - the rules that deny reading /etc/pulse/client.conf
+  #    and executing /usr/bin/pulseaudio
  # #include <abstractions/audio>
  # /etc/asound.conf r,
-  # owner @{PROC}/@{pid}/fd/ r,
  # owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/tmp/mozilla-temp-* rw,

+  signal (receive) set=("term") peer=torbrowser_firefox,
+
  deny /etc/host.conf r,
  deny /etc/hosts r,
  deny /etc/nsswitch.conf r,
@@ -24,6 +29,13 @@ profile torbrowser_plugin_container {
  deny /etc/machine-id r,
  deny /var/lib/dbus/machine-id r,

+  /etc/mime.types r,
+  /usr/share/applications/gnome-mimeapps.list r,
+
+  /dev/shm/ r,
+
+  owner @{PROC}/@{pid}/environ r,
+  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mountinfo r,
  owner @{PROC}/@{pid}/stat r,
  owner @{PROC}/@{pid}/status r,
@@ -40,11 +52,12 @@ profile torbrowser_plugin_container {
  owner @{torbrowser_home_dir}/browser/components/*.so mr,
  owner @{torbrowser_home_dir}/defaults/pref/     r,
  owner @{torbrowser_home_dir}/defaults/pref/*.js r,
+  owner @{torbrowser_home_dir}/dependentlibs.list r,
  owner @{torbrowser_home_dir}/fonts/   r,
  owner @{torbrowser_home_dir}/fonts/** r,
  owner @{torbrowser_home_dir}/omni.ja r,
-  owner @{torbrowser_home_dir}/plugin-container ixmr,
  owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/extensions/*.xpi r,
+  owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/startupCache/* r,
  owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/tmp/* rw,
  owner @{torbrowser_home_dir}/TorBrowser/Data/fontconfig/fonts.conf r,
  owner @{torbrowser_home_dir}/TorBrowser/Tor/ r,
@@ -53,6 +66,8 @@ profile torbrowser_plugin_container {
  owner @{torbrowser_home_dir}/Downloads/ rwk,
  owner @{torbrowser_home_dir}/Downloads/** rwk,

+  owner @{torbrowser_firefox_executable} ixmr -> torbrowser_plugin_container,
+
  /sys/devices/system/cpu/ r,
  /sys/devices/system/cpu/present r,
  /sys/devices/system/node/ r,
@@ -78,5 +93,9 @@ profile torbrowser_plugin_container {
  deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
  deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,

+  # Silence denial logs about PulseAudio
+  deny /etc/pulse/client.conf r,
+  deny /usr/bin/pulseaudio x,
+
  #include <local/torbrowser.Browser.plugin-container>
 }
--- a/apparmor/torbrowser.Tor.tor
+++ b/apparmor/torbrowser.Tor.tor
 #include <tunables/global>
+#include <tunables/torbrowser>

-/home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Tor/tor {
+@{torbrowser_tor_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/tor
+
+profile torbrowser_tor @{torbrowser_tor_executable} {
  #include <abstractions/base>

  network netlink raw,
@@ -11,18 +14,23 @@
  /etc/nsswitch.conf r,
  /etc/passwd r,
  /etc/resolv.conf r,
-  owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Tor/tor mr,
-  owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Tor/ rw,
-  owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Tor/* rw,
-  owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Tor/lock rwk,
-  owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/Tor,Lib}/*.so mr,
-  owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/Tor,Lib}/*.so.* mr,
+  owner @{torbrowser_home_dir}/TorBrowser/Tor/tor mr,
+  owner @{torbrowser_home_dir}/TorBrowser/Data/Tor/ rw,
+  owner @{torbrowser_home_dir}/TorBrowser/Data/Tor/** rw,
+  owner @{torbrowser_home_dir}/TorBrowser/Data/Tor/lock rwk,
+  owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so mr,
+  owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr,
+
+  # Support some of the included pluggable transports
+  owner @{torbrowser_home_dir}/TorBrowser/Tor/PluggableTransports/** rix,
+  @{PROC}/sys/net/core/somaxconn r,

  # Silence file_inherit logs
-  deny @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/{browser/,}omni.ja r,
-  deny @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Browser/profile.default/.parentlock rw,
-  deny @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Browser/profile.default/extensions/*.xpi r,
-  deny @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/{Browser/TorBrowser/,}Data/Browser/profile.default/startupCache/* r,
+  deny @{torbrowser_home_dir}/{browser/,}omni.ja r,
+  deny @{torbrowser_home_dir}/{browser/,}features/*.xpi r,
+  deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/.parentlock rw,
+  deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/extensions/*.xpi r,
+  deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/startupCache/* r,

  @{PROC}/sys/kernel/random/uuid r,
  /sys/devices/system/cpu/ r,

--- a/debian/changelog
+++ b/debian/changelog
+torbrowser-launcher (0.3.0-1~exp1) experimental; urgency=medium
+
+  * New upstream release 0.3.0
+    - Switched from python2 to python3
+    - Switched from gtk2 to Qt5
+    - Switched from twisted to requests/socks
+    - Use QThreads for async
+    - Removed modem sound
+    - Only refresh gpg keyring on verification error, instead of every time
+    - Updated AppArmor profiles
+    - Updated available languages, and fixed locale detection bug
+    - Fixed false signature verification error related to twisted
+  * debian/patches:
+    - Refresh patches.
+    - Remove upstreamed patches.
+  * debian/control:
+    - Remove XS-Python-Version and XB-Python-Version, since lintian says
+      it's not necessary.
+
+ -- Roger Shimizu <rosh@debian.org>  Wed, 19 Sep 2018 23:06:56 +0900
+
 torbrowser-launcher (0.3.0~dev-1~exp4) experimental; urgency=medium

  * debian/patches:
@@ -21,15 +42,6 @@ torbrowser-launcher (0.3.0~dev-1~exp3) experimental; urgency=medium

 -- Roger Shimizu <rosh@debian.org>  Mon, 25 Jun 2018 02:21:12 +0900

-torbrowser-launcher (0.2.9-3) unstable; urgency=medium
-
-  * Team upload.
-  * NEWS.Debian: recommend rebooting the system after upgrading to 0.2.9-2
-    (Closes: #894333)
-  * Update Vcs-* control fields wrt. the move to Salsa.
-
- -- intrigeri <intrigeri@debian.org>  Fri, 25 May 2018 09:12:30 +0000
-
 torbrowser-launcher (0.3.0~dev-1~exp2) experimental; urgency=medium

  * debian/rules:
@@ -65,6 +77,44 @@ torbrowser-launcher (0.3.0~dev-1~exp1) experimental; urgency=medium

 -- Roger Shimizu <rosh@debian.org>  Wed, 28 Mar 2018 20:15:00 +0900

+torbrowser-launcher (0.2.9-5) unstable; urgency=high
+
+  * debian/source/lintian-overrides:
+    - Rename from debian/source.lintian-overrides
+  * debian/control:
+    - Rename tag X-Python-Version to XS-Python-Version.
+    - Add XB-Python-Version tag for binary package.
+  * debian/patches:
+    - Cherry-pick three upstream commits to fix appamor profile for
+      Web Content process (Closes: #908463).
+  * debian/torbrowser-launcher.maintscript:
+    - rm_conffile appamor profile /etc/apparmor.d/local/*, which was
+      removed since 0.2.9-2. Thanks to gregor herrmann for the fix.
+
+ -- Roger Shimizu <rosh@debian.org>  Tue, 18 Sep 2018 01:17:18 +0900
+
+torbrowser-launcher (0.2.9-4) unstable; urgency=medium
+
+  [ Ulrike Uhlig ]
+  * debian/control:
+    - Remove myself from uploaders.
+
+  [ Roger Shimizu ]
+  * debian/patches:
+    - Cherry-pick two upstream commits to fix appamor profile for
+      Tor Browser 8.0a9 (Closes: #908068).
+
+ -- Roger Shimizu <rosh@debian.org>  Sun, 09 Sep 2018 16:43:19 +0900
+
+torbrowser-launcher (0.2.9-3) unstable; urgency=medium
+
+  * Team upload.
+  * NEWS.Debian: recommend rebooting the system after upgrading to 0.2.9-2
+    (Closes: #894333)
+  * Update Vcs-* control fields wrt. the move to Salsa.
+
+ -- intrigeri <intrigeri@debian.org>  Fri, 25 May 2018 09:12:30 +0000
+
 torbrowser-launcher (0.2.9-2) unstable; urgency=medium

  * debian/patches:

--- a/debian/control
+++ b/debian/control
@@ -10,7 +10,6 @@ Build-Depends:
 help2man,
 lsb-release,
 python3-all
-XS-Python-Version: >= 3.0
 Standards-Version: 3.9.8
 Homepage: https://micahflee.com/torbrowser-launcher/
 Vcs-Git: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher.git
@@ -27,7 +26,6 @@ Depends:
 python3-gpg,
 python3-requests,
 python3-socks
-XB-Python-Version: ${python:Versions}
 Recommends: tor
 Suggests: apparmor, python-pygame
 Description: helps download and run the Tor Browser Bundle

--- a/debian/patches/0001-Drop-spurious-trailing-whitespace.patch
+++ b/debian/patches/0001-Drop-spurious-trailing-whitespace.patch
-From: intrigeri <intrigeri@boum.org>
-Date: Sun, 28 Jan 2018 18:51:40 +0000
-Subject: Drop spurious trailing whitespace.
-
---
- apparmor/local/torbrowser.Browser.firefox | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/apparmor/local/torbrowser.Browser.firefox b/apparmor/local/torbrowser.Browser.firefox
-index 2bbf71e..da8acb0 100644
--- a/apparmor/local/torbrowser.Browser.firefox
-+++ b/apparmor/local/torbrowser.Browser.firefox
-@@ -1,2 +1,2 @@
- # Site-specific additions and overrides for torbrowser.Browser.firefox.
-# For more details, please see /etc/apparmor.d/local/README. 
-+# For more details, please see /etc/apparmor.d/local/README.
--- a/debian/patches/0015-Remove-apparmor-local-path-from-setup.py.patch
+++ b/debian/patches/0015-Remove-apparmor-local-path-from-setup.py.patch
--- a/debian/patches/0002-AppArmor-allow-plugin-container-to-read-file-app-ass.patch
+++ b/debian/patches/0002-AppArmor-allow-plugin-container-to-read-file-app-ass.patch
-From: intrigeri <intrigeri@boum.org>
-Date: Mon, 29 Jan 2018 06:34:14 +0000
-Subject: AppArmor: allow plugin-container to read file/app association
- information.
-
-We already allow the main browser profile to do that but with e10s
-plugin-container now needs it as well.
---
- apparmor/torbrowser.Browser.plugin-container | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/apparmor/torbrowser.Browser.plugin-container b/apparmor/torbrowser.Browser.plugin-container
-index ee30fd4..eb28cc0 100644
--- a/apparmor/torbrowser.Browser.plugin-container
-+++ b/apparmor/torbrowser.Browser.plugin-container
-@@ -24,6 +24,9 @@ profile torbrowser_plugin_container {
-   deny /etc/machine-id r,
-   deny /var/lib/dbus/machine-id r,
- 
-+  /etc/mime.types r,
-+  /usr/share/applications/gnome-mimeapps.list r,
-+
-   owner @{PROC}/@{pid}/mountinfo r,
-   owner @{PROC}/@{pid}/stat r,
-   owner @{PROC}/@{pid}/status r,
--- a/debian/patches/0016-show-gui-only-if-tbb-not-installed.patch
+++ b/debian/patches/0016-show-gui-only-if-tbb-not-installed.patch
 From: troubadoour <trobador@riseup.net>
 Date: Tue, 27 Mar 2018 18:19:26 -0400
 Subject: show gui only if tbb not installed
-Origin: https://github.com/troubadoour/torbrowser-launcher/commit/1402015487db5559847492ca294ac6c895245dca

 ---
 torbrowser_launcher/__init__.py | 29 ++++++++++++++++-------------

--- a/debian/patches/0003-AppArmor-allow-Firefox-to-ptrace-plugin-container-an.patch
+++ b/debian/patches/0003-AppArmor-allow-Firefox-to-ptrace-plugin-container-an.patch
-From: intrigeri <intrigeri@boum.org>
-Date: Mon, 29 Jan 2018 06:36:55 +0000
-Subject: AppArmor: allow Firefox to ptrace plugin-container and to send it
- term signals.
-
-With e10s Firefox does not need to ptrace itself anymore but instead it needs
-to ptrace and kill its child plugin-container processes.
---
- apparmor/torbrowser.Browser.firefox | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
-index 05f4d16..2069d6f 100644
--- a/apparmor/torbrowser.Browser.firefox
-+++ b/apparmor/torbrowser.Browser.firefox
-@@ -13,7 +13,8 @@
-   network netlink raw,
-   network tcp,
- 
-  ptrace (trace) peer=@{profile_name},
-+  ptrace (trace) peer=torbrowser_plugin_container,
-+  signal (send) set=("term") peer=torbrowser_plugin_container,
- 
-   deny /etc/host.conf r,
-   deny /etc/hosts r,
--- a/debian/patches/0017-remove-double-common-assignment.patch
+++ b/debian/patches/0017-remove-double-common-assignment.patch
 From: troubadoour <trobador@riseup.net>
 Date: Wed, 28 Mar 2018 03:52:42 -0400
 Subject: remove double 'common' assignment
-Origin: https://github.com/troubadoour/torbrowser-launcher/commit/63646cb69521d40bf25484831d58bcf691f71cca

 ---
 torbrowser_launcher/__init__.py | 3 +--

--- a/debian/patches/0004-AppArmor-allow-plugin-container-to-receive-term-sign.patch
+++ b/debian/patches/0004-AppArmor-allow-plugin-container-to-receive-term-sign.patch
-From: intrigeri <intrigeri@boum.org>
-Date: Mon, 29 Jan 2018 06:43:43 +0000
-Subject: AppArmor: allow plugin-container to receive term signals from the
- parent Firefox process.
-MIME-Version: 1.0
-Content-Type: text/plain; charset="utf-8"
-Content-Transfer-Encoding: 8bit
-
-We already allow Firefox to send term signals to plugin-container;
-this is the receiving counterpart.
-
-This requires giving the Firefox profile a proper name (torbrowser_firefox)
-because this:
-
-  signal (receive) set=("term") peer=/home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox
-
-… does not work.
-
-Note to package maintainers
-===========================
-
-(This should probably be copied to the release notes.)
-
-Due to the profile renaming, upgrading the
-/etc/apparmor.d/torbrowser.Browser.firefox file requires special care. The best
-option is probably to strongly recommend users to reboot their system after
-this upgrade.
-
-Other options I can think of have unacceptable consequences:
-
- - if we unload the old profile from the kernel, we will leave any already
-   running Tor Browser's Firefox executable unconfined, which is an unacceptable
-   violation of the user's security expectations;
-
- - if we don't unload the old profile from the kernel, surprising behaviour will
-   happen such as:
-
-    - any already running Tor Browser's Firefox executable will be left confined
-      under the old profile which won't play well with new rules that have
-      peer=torbrowser_firefox;
-    - unpredictable behavior when a new Tor Browser is started, because two
-      profiles matching the Tor Browser's Firefox executable are loaded.
---
- apparmor/torbrowser.Browser.firefox          | 4 +++-
- apparmor/torbrowser.Browser.plugin-container | 2 ++
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
-index 2069d6f..5f7f1a7 100644
--- a/apparmor/torbrowser.Browser.firefox
-+++ b/apparmor/torbrowser.Browser.firefox
-@@ -1,7 +1,9 @@
- #include <tunables/global>
- #include <tunables/torbrowser>
- 
-/home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox {
-+@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox
-+
-+profile torbrowser_firefox @{torbrowser_firefox_executable} {
-   #include <abstractions/gnome>
- 
-   # Uncomment the following lines if you want to give the Tor Browser read-write
-diff --git a/apparmor/torbrowser.Browser.plugin-container b/apparmor/torbrowser.Browser.plugin-container
-index eb28cc0..f5554db 100644
--- a/apparmor/torbrowser.Browser.plugin-container
-+++ b/apparmor/torbrowser.Browser.plugin-container
-@@ -13,6 +13,8 @@ profile torbrowser_plugin_container {
-   # owner @{PROC}/@{pid}/fd/ r,
-   # owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/tmp/mozilla-temp-* rw,
- 
-+  signal (receive) set=("term") peer=torbrowser_firefox,
-+
-   deny /etc/host.conf r,
-   deny /etc/hosts r,
-   deny /etc/nsswitch.conf r,
--- a/debian/patches/0005-Fix-comment.patch
+++ b/debian/patches/0005-Fix-comment.patch
-From: intrigeri <intrigeri@boum.org>
-Date: Mon, 29 Jan 2018 07:24:29 +0000
-Subject: Fix comment.
-
---
- apparmor/torbrowser.Browser.plugin-container | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/apparmor/torbrowser.Browser.plugin-container b/apparmor/torbrowser.Browser.plugin-container
-index f5554db..5fd3efa 100644
--- a/apparmor/torbrowser.Browser.plugin-container
-+++ b/apparmor/torbrowser.Browser.plugin-container
-@@ -4,7 +4,7 @@
- profile torbrowser_plugin_container {
-   #include <abstractions/gnome>
- 
-  # Uncomment the following lines if you don'want the Tor Browser
-+  # Uncomment the following lines if you want Tor Browser
-   # to have direct access to your sound hardware. You will also
-   # need to remove the "deny" word in the machine-id lines further
-   # bellow.
--- a/debian/patches/0006-AppArmor-allow-Firefox-to-fully-manage-its-fontconfi.patch
+++ b/debian/patches/0006-AppArmor-allow-Firefox-to-fully-manage-its-fontconfi.patch
-From: intrigeri <intrigeri@boum.org>
-Date: Mon, 29 Jan 2018 07:38:41 +0000
-Subject: AppArmor: allow Firefox to fully manage its fontconfig cache.
-
-So far we allowed it to do everything in there except a link operation, so let's
-be consistent.
---
- apparmor/torbrowser.Browser.firefox | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
-index 5f7f1a7..e6a455b 100644
--- a/apparmor/torbrowser.Browser.firefox
-+++ b/apparmor/torbrowser.Browser.firefox
-@@ -49,6 +49,8 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
-   owner @{torbrowser_home_dir}.bak/ rwk,
-   owner @{torbrowser_home_dir}.bak/** rwk,
-   owner @{torbrowser_home_dir}/*.so mr,
-+  owner @{torbrowser_home_dir}/.cache/fontconfig/ rwk,
-+  owner @{torbrowser_home_dir}/.cache/fontconfig/** rwkl,
-   owner @{torbrowser_home_dir}/components/*.so mr,
-   owner @{torbrowser_home_dir}/browser/components/*.so mr,
-   owner @{torbrowser_home_dir}/firefox rix,
--- a/debian/patches/0007-AppArmor-grant-access-to-mostly-innocuous-stuff-plug.patch
+++ b/debian/patches/0007-AppArmor-grant-access-to-mostly-innocuous-stuff-plug.patch
-From: intrigeri <intrigeri@boum.org>
-Date: Mon, 29 Jan 2018 07:40:37 +0000
-Subject: AppArmor: grant access to mostly innocuous stuff plugin-container
- tries to read.
-
-Same rationale as commit 68f502c3fbb754742cd23967cf30038ff6ce799a.
---
- apparmor/torbrowser.Browser.plugin-container | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/apparmor/torbrowser.Browser.plugin-container b/apparmor/torbrowser.Browser.plugin-container
-index 5fd3efa..4ee65ec 100644
--- a/apparmor/torbrowser.Browser.plugin-container
-+++ b/apparmor/torbrowser.Browser.plugin-container
-@@ -10,7 +10,6 @@ profile torbrowser_plugin_container {
-   # bellow.
-   # #include <abstractions/audio>
-   # /etc/asound.conf r,
-  # owner @{PROC}/@{pid}/fd/ r,
-   # owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/tmp/mozilla-temp-* rw,
- 
-   signal (receive) set=("term") peer=torbrowser_firefox,
-@@ -29,6 +28,9 @@ profile torbrowser_plugin_container {
-   /etc/mime.types r,
-   /usr/share/applications/gnome-mimeapps.list r,
- 
-+  /dev/shm/ r,
-+
-+  owner @{PROC}/@{pid}/fd/ r,
-   owner @{PROC}/@{pid}/mountinfo r,
-   owner @{PROC}/@{pid}/stat r,
-   owner @{PROC}/@{pid}/status r,
--- a/debian/patches/0008-AppArmor-silence-denial-logs-about-PulseAudio.patch
+++ b/debian/patches/0008-AppArmor-silence-denial-logs-about-PulseAudio.patch
-From: intrigeri <intrigeri@boum.org>
-Date: Mon, 29 Jan 2018 07:42:09 +0000
-Subject: AppArmor: silence denial logs about PulseAudio.
-
-We don't currently allow access to the audio subsystem; let's not let AppArmor
-spam the logs about it.
---
- apparmor/torbrowser.Browser.firefox          |  4 ++++
- apparmor/torbrowser.Browser.plugin-container | 10 ++++++++--
- 2 files changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
-index e6a455b..d0aded9 100644
--- a/apparmor/torbrowser.Browser.firefox
-+++ b/apparmor/torbrowser.Browser.firefox
-@@ -108,6 +108,10 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
-   deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
-   deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
- 
-+  # Silence denial logs about PulseAudio
-+  deny /etc/pulse/client.conf r,
-+  deny /usr/bin/pulseaudio x,
-+
-   # KDE 4
-   owner @{HOME}/.kde/share/config/* r,
- 
-diff --git a/apparmor/torbrowser.Browser.plugin-container b/apparmor/torbrowser.Browser.plugin-container
-index 4ee65ec..fe95fdb 100644
--- a/apparmor/torbrowser.Browser.plugin-container
-+++ b/apparmor/torbrowser.Browser.plugin-container
-@@ -6,8 +6,10 @@ profile torbrowser_plugin_container {
- 
-   # Uncomment the following lines if you want Tor Browser
-   # to have direct access to your sound hardware. You will also
-  # need to remove the "deny" word in the machine-id lines further
-  # bellow.
-+  # need to remove, further bellow:
-+  #  - the "deny" word in the machine-id lines
-+  #  - the rules that deny reading /etc/pulse/client.conf
-+  #    and executing /usr/bin/pulseaudio
-   # #include <abstractions/audio>
-   # /etc/asound.conf r,
-   # owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/tmp/mozilla-temp-* rw,
-@@ -85,5 +87,9 @@ profile torbrowser_plugin_container {
-   deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
-   deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
- 
-+  # Silence denial logs about PulseAudio
-+  deny /etc/pulse/client.conf r,
-+  deny /usr/bin/pulseaudio x,
-+
-   #include <local/torbrowser.Browser.plugin-container>
- }