Opened 3 years ago

Closed 3 years ago

#22650 closed enhancement (fixed)

Make it clear that Pulse Audio is potentially dangerous to enable.

Reported by: yawning Owned by: yawning
Priority: Medium Milestone:
Component: Archived/Tor Browser Sandbox Version:
Severity: Normal Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description (last modified by yawning)

Per "Jann Horn of Google Project Zero", PulseAudio is a potential vector for sandbox escapes. While this is not part of the threat model in current releases, it should be documented as such in the UI.

The documentation has been updated to note this possibility:
https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Sandbox/Linux?action=diff&version=22

Child Tickets

Change History (3)

comment:1 Changed 3 years ago by yawning

Description: modified (diff)

comment:2 Changed 3 years ago by yawning

Unlike X11, I am opting for just a UI change, because I have better things to do with my life than figuring out the PulseAudio wire protocol.

Note: See TracTickets for help on using tickets.