{"push_id":2462317785,"size":15,"distinct_size":15,"ref":"refs/heads/develop","head":"8a7625634876ec535d57353cf72ee1692ad3d6a6","before":"2f8b8ddafbdf504828ac9107513725e7f86affd8","commits":[{"sha":"064ad1f7a6c29684da68053c4b19a05cea764b2e","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"Drop spurious trailing whitespace.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/064ad1f7a6c29684da68053c4b19a05cea764b2e"},{"sha":"cdb290fed89617fe43093d3108060c4e59f6283e","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: allow plugin-container to read file/app association information.\n\nWe already allow the main browser profile to do that but with e10s\nplugin-container now needs it as well.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/cdb290fed89617fe43093d3108060c4e59f6283e"},{"sha":"9c609476b5b34379baff98b561ebf31963becd30","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: allow Firefox to ptrace plugin-container and to send it term signals.\n\nWith e10s Firefox does not need to ptrace itself anymore but instead it needs\nto ptrace and kill its child plugin-container processes.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/9c609476b5b34379baff98b561ebf31963becd30"},{"sha":"d62a692a4a2a885d1410c0d931c08028a61fa246","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: allow plugin-container to receive term signals from the parent Firefox process.\n\nWe already allow Firefox to send term signals to plugin-container;\nthis is the receiving counterpart.\n\nThis requires giving the Firefox profile a proper name (torbrowser_firefox)\nbecause this:\n\n  signal (receive) set=(\"term\") peer=/home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox\n\n… does not work.\n\nNote to package maintainers\n===========================\n\n(This should probably be copied to the release notes.)\n\nDue to the profile renaming, upgrading the\n/etc/apparmor.d/torbrowser.Browser.firefox file requires special care. The best\noption is probably to strongly recommend users to reboot their system after\nthis upgrade.\n\nOther options I can think of have unacceptable consequences:\n\n - if we unload the old profile from the kernel, we will leave any already\n   running Tor Browser's Firefox executable unconfined, which is an unacceptable\n   violation of the user's security expectations;\n\n - if we don't unload the old profile from the kernel, surprising behaviour will\n   happen such as:\n\n    - any already running Tor Browser's Firefox executable will be left confined\n      under the old profile which won't play well with new rules that have\n      peer=torbrowser_firefox;\n    - unpredictable behavior when a new Tor Browser is started, because two\n      profiles matching the Tor Browser's Firefox executable are loaded.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/d62a692a4a2a885d1410c0d931c08028a61fa246"},{"sha":"f40931740dd1644ff61dd29732b0ebe5febc8025","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"Fix comment.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/f40931740dd1644ff61dd29732b0ebe5febc8025"},{"sha":"936aee55ed0b2a6c6d6e0ba0154a95ce07c73a5d","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: allow Firefox to fully manage its fontconfig cache.\n\nSo far we allowed it to do everything in there except a link operation, so let's\nbe consistent.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/936aee55ed0b2a6c6d6e0ba0154a95ce07c73a5d"},{"sha":"dedd45b0be27687eebad55d0749bb5379a4c7edc","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: grant access to mostly innocuous stuff plugin-container tries to read.\n\nSame rationale as commit 68f502c3fbb754742cd23967cf30038ff6ce799a.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/dedd45b0be27687eebad55d0749bb5379a4c7edc"},{"sha":"27289e19e4ab4d8477e885f4aef84aad2e68b85e","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: silence denial logs about PulseAudio.\n\nWe don't currently allow access to the audio subsystem; let's not let AppArmor\nspam the logs about it.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/27289e19e4ab4d8477e885f4aef84aad2e68b85e"},{"sha":"0109e95efcb014da40e9c681ae7ae4b4c4db38d8","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: silence more inherited files access denial.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/0109e95efcb014da40e9c681ae7ae4b4c4db38d8"},{"sha":"b1e082fef0554c64a4a4d414147b962283cb0897","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: drop support for long-obsolete paths.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/b1e082fef0554c64a4a4d414147b962283cb0897"},{"sha":"a9bef63bd8f887049f8525a3f24cb5ef89d05d7e","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: refactor thanks to variables defined in tunables/torbrowser.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/a9bef63bd8f887049f8525a3f24cb5ef89d05d7e"},{"sha":"33fd86fa14be06548e0ebebf193e1ad551cbfa42","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: give the tor profile a stable name.\n\nThis will allow us to handle upgrades more nicely in the future,\ne.g. when the executable path changes. Besides, this makes the output of\naa-status and logs much easier to grasp.\n\nNote to packagers: exactly as for the similar change applied to the Tor\nBrowser's Firefox profile, please consider recommending users to reboot their\nsystem after the upgrade that applies this change.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/33fd86fa14be06548e0ebebf193e1ad551cbfa42"},{"sha":"850d5606b3ffd2a7a9fa64a271a4318c0604e51c","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: support some of the included pluggable transports.\n\nThis fixes support for obfs4 and obfs3.\n\nmeek and fte require vastly more extended permissions and thus dedicated\nchild profiles.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/850d5606b3ffd2a7a9fa64a271a4318c0604e51c"},{"sha":"91652b6436944bd8817900010c2797c29c7eb484","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"AppArmor: remove boilerplate from local override files.\n\nThis matches how recent dh-apparmor behaves.","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/91652b6436944bd8817900010c2797c29c7eb484"},{"sha":"8a7625634876ec535d57353cf72ee1692ad3d6a6","author":{"name":"intrigeri","email":"2ad6bcd9a3fee66f17f7e84d4c667a13ae2c5054@boum.org"},"message":"Merge pull request #310 from intrigeri/apparmor-201801-edition\n\nAppArmor profiles, 2018-01 edition","distinct":true,"url":"https://api.github.com/repos/micahflee/torbrowser-launcher/commits/8a7625634876ec535d57353cf72ee1692ad3d6a6"}]}
{"actor":{"display_login":"intrigeri"}}