[tor-bugs] #5791 [Tor bundles/installation]: Gather apparmor/selinux/seatbelt profiles for each component of TBB

[Tor Bug Tracker & Wiki]

#5791: Gather apparmor/selinux/seatbelt profiles for each component of TBB
--------------------------------------+-------------------------------------
 Reporter:  arma                      |          Owner:  cypherpunks
     Type:  project                   |         Status:  assigned   
 Priority:  normal                    |      Milestone:             
Component:  Tor bundles/installation  |        Version:             
 Keywords:  SponsorZ                  |         Parent:  #4522      
   Points:                            |   Actualpoints:             
--------------------------------------+-------------------------------------
Description changed by trams:

Old description:

> The file attached contains sandboxes for osx. It does not need to be
> compiled in, but they need to be placed in the correct location for
> things to work. There are no binaries, just seatbelt files and wrapper
> scripts.
>
> To install/try them, do the following steps:
> 1. unzip the TorBrowser-2.2.35-11-osx-x86_64-en-US.zip
> 2. cd TorBrowser_en-US.app
> 3. tar xvf ../path/to/tor-sandbox.tar
>
> happy sandboxing

New description:

 It's increasingly clear that shipping TBB without any "system call
 permissions" wrappers is an arms race that is too easy to lose. Bug 5741
 is the latest of what will continue to be many instances.

 The Tor wiki has a variety of instructions on putting your TBB in a VM, or
 running it wrapped by apparmor, or somebody saying the word SELinux, etc.

 We should gather all these instructions together, and start vetting them
 with the goal of integrating as many as we can into the main build
 processes, and providing the rest as "for experts, you can be even safer
 if".

 We need a volunteer with good security taste to get this started. I could
 easily see this project being a bounty too.

--

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5791#comment:24>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online