Changes between Version 21 and Version 23 of doc/TorBrowser/Sandbox/Linux

Timestamp:

(multiple changes)

Author:

(multiple changes)

Comment:

(multiple changes)

doc/TorBrowser/Sandbox/Linux

@@ -104 +104 @@
 === How do I get sound to work? ===
 
-Assuming your system is running PulseAudio (`pulseaudio --check -v`),
-enable it via the sandbox config.  PulseAudio is required due to the
-sandbox container not having direct access to hardware.
-
-For what it's worth, Firefox also requires PulseAudio in recent versions.
-https://bugzilla.mozilla.org/show_bug.cgi?id=1247056
+'''WARNING: This is likely unsafe against sophisticated adversaries.'''
+
+As it stands right now, if PulseAudio is enabled in the sandbox, Firefox
+will get direct access to the host system's socket.  There are likely
+non-trivial ways to use this to read files from the host filesystem.
+
+(Thanks to "Jann Horn of Google Project Zero" for pointing out that this
+is a possibility.)
+
+If you don't care about this possibility, assuming your system is
+running PulseAudio (`pulseaudio --check -v`), enable it via the sandbox
+config.  PulseAudio is required due to the sandbox container not having
+direct access to hardware, and there being basically nothing better
+despite the potential escape vectors.
+
+For what it's worth, un-sandboxed Tor Browser also requires PulseAudio as
+of version 7.0, due to it being made a requirement for Firefox (See:
+https://bugzilla.mozilla.org/show_bug.cgi?id=1247056)
 
 === The Circuit Display is missing! ===
@@ -144 +156 @@
 one contained in the bundle directory.
 
-=== How do I protect myself from X exploits? ===
-
-Good question.  "Sit there and pray that Wayland will fix everything" or
-"Use a nested X11 implementation like Xephyr or Xpra" seem to be the
-popular options.  An advanced configuration option for setting the
-`DISPLAY` that Firefox will use is provided for convenience.
+=== Wait, Firefox uses X11, isn't security basically hopeless? ===
+
+Yes.  The current implementation of the sandbox does little to nothing
+to defend against Firefox doing evil things to or via the X socket.
+
+If you want to attempt to mitigate this, the best options are:
+
+ * Run 0.0.8-dev or newer, where "something, but not likely enough" is
+   done to defend against some of the easier evil.
+ * Use a nested X11 implementation like Xephyr or Xpra.
+ * Sit there and pray that Wayland will fix everything.
+
+The ideal solution at current time is probably to probably do all three.
+
+An advanced configuration option for setting the `DISPLAY` that Firefox
+will use is provided to enable easier nested X11 usage.
+
+(Thanks to "Jann Horn of Google Project Zero" for pointing out that
+the documentation doesn't make it obvious that such things are beyond
+the threat model.)
 
 === How do I make this use a system tor instance? ===