Opened 3 years ago

Closed 5 months ago

#20746 closed defect (wontfix)

TBB - What are /tmp/0123.mlf files (where 0123 is PID of Firefox)

Reported by: ronvandaal_ Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-disk-leak
Cc: Actual Points:
Parent ID: #23073 Points:
Reviewer: Sponsor:

Description

Using tor-browser-linux64-6.0.6_en-US.tar.xz

This is a general question, but related to the other ticket #200100

In /tmp/ I found some files (*.MLF) , filename is the PID of Firefox.

(for example, the process "0123 ./firefox --class Tor Browser -profile TorBrowser/Data/Browser/profile.default" relates to /tmp/1234.mlf)

What are MLF files? Never seen them before. They appeared after a TBB's browser crashed and couldn't restart due to a faulty Browser/libxul.so.

Anyway. They seem memory dumps. But why?

(2268780 bytes) First bytes header (if any) starting with 010100790a2a21

Example of readable contents:

$ strings 0189.mlf
/home/ronv/tor-browser/Browser/libnspr4.so
/home/ronv/tor-browser/Browser/libplc4.so
/home/ronv/tor-browser/Browser/libplds4.so
/home/ronv/tor-browser/Browser/libnssutil3.so
/home/ronv/tor-browser/Browser/libnss3.so
/home/ronv/tor-browser/Browser/libsmime3.so
/home/ronv/tor-browser/Browser/libssl3.so
/home/ronv/tor-browser/Browser/libmozsqlite3.so
/home/ronv/tor-browser/Browser/liblgpllibs.so
/home/ronv/tor-browser/Browser/libxul.so
/home/ronv/tor-browser/Browser/browser/components/libbrowsercomps.so
/home/ronv/tor-browser/Browser/libsoftokn3.so
/home/ronv/tor-browser/Browser/libfreebl3.so
/home/ronv/tor-browser/Browser/libnssckbi.so

Ideas? Anyone?

Child Tickets

Change History (6)

comment:1 Changed 3 years ago by arma

Looks important at least from the "don't leave stuff on disk" forensics angle?

comment:2 Changed 3 years ago by gk

Keywords: tbb-disk-leak added

comment:3 Changed 12 months ago by qbi

I encounter similar behaviour since (at least) the first 8.5-alpha version of Tor Browser. Sometimes those files are created. When TBB is closed the remain in /tmp/

On my system they are either 9308406 or 9477406 bytes large. strings on one of the files show the following SO files:

tor-browser_de/Browser/libnspr4.so
tor-browser_de/Browser/libplds4.so
tor-browser_de/Browser/libplc4.so
tor-browser_de/Browser/libmozsandbox.so
tor-browser_de/Browser/liblgpllibs.so
tor-browser_de/Browser/libnssutil3.so
tor-browser_de/Browser/libnss3.so
tor-browser_de/Browser/libsmime3.so
tor-browser_de/Browser/libmozsqlite3.so
tor-browser_de/Browser/libssl3.so
tor-browser_de/Browser/libmozgtk.so
tor-browser_de/Browser/libxul.so

comment:4 Changed 10 months ago by arma

Yes, I see these files too. I am running Tor Browser 8.5a6. What is causing them?

comment:5 Changed 10 months ago by gk

Parent ID: #23073

Those files are Selfrando's memory layout files. See: https://lists.torproject.org/pipermail/tbb-dev/2017-May/000537.html ff. for further information.

comment:6 Changed 5 months ago by gk

Resolution: wontfix
Status: newclosed

We removed selfrando support in bug 30377, thus this is a WONTFIX.

Note: See TracTickets for help on using tickets.