[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #19413 [Applications/Tor Browser]: hardened browser does not start on debian with grsec

Subject: [tor-bugs] #19413 [Applications/Tor Browser]: hardened browser does not start on debian with grsec
From: "Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>
Date: Tue, 14 Jun 2016 23:27:56 -0000
Auto-submitted: auto-generated
Delivered-to: archiver@xxxxxxxx
Delivery-date: Tue, 14 Jun 2016 19:28:15 -0400
List-archive: <http://lists.torproject.org/pipermail/tor-bugs/>
List-help: <mailto:tor-bugs-request@lists.torproject.org?subject=help>
List-id: "auto: Tor bug tracker status mails" <tor-bugs.lists.torproject.org>
List-post: <mailto:tor-bugs@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs>, <mailto:tor-bugs-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-bugs>, <mailto:tor-bugs-request@lists.torproject.org?subject=unsubscribe>
Reply-to: tor-assistants@xxxxxxxxxxxxxx
Sender: "tor-bugs" <tor-bugs-bounces@xxxxxxxxxxxxxxxxxxxx>
#19413: hardened browser does not start on debian with grsec
------------------------------------------+----------------------
     Reporter:  tblah                     |      Owner:  tbb-team
         Type:  defect                    |     Status:  new
     Priority:  Medium                    |  Milestone:
    Component:  Applications/Tor Browser  |    Version:
     Severity:  Normal                    |   Keywords:
Actual Points:                            |  Parent ID:
       Points:                            |   Reviewer:
      Sponsor:                            |
------------------------------------------+----------------------
 I am running debian stable with the grsec kernel from backports. The
 hardened browser bundle does not start (with no error message given) but
 the normal browser bundle works fine. Both have MPROTECT (PaX) disabled on
 the bundled firefox executable. TPE is disabled for the user executing tor
 browser. Both browser bundles are the current versions as of today
 (6.5a1-hardened and 6.0.1).

 No errors are displayed in /var/log/messages or dmesg.

 # uname -a
 Linux hostname 4.5.0-2-grsec-amd64 #1 SMP Debian
 4.5.5-1+grsec201605291201+1~bpo8+1 (2016-06-06) x86_64 GNU/Linux

 # strace
 execve("./start-tor-browser.desktop", ["./start-tor-browser.desktop"], [/*
 39 vars */]) = 0
 brk(0)                                  = 0x12e1b90
 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or
 directory)
 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x3ac92627000
 access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or
 directory)
 open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
 fstat(3, {st_mode=S_IFREG|0644, st_size=97489, ...}) = 0
 mmap(NULL, 97489, PROT_READ, MAP_PRIVATE, 3, 0) = 0x3ac9260f000
 close(3)                                = 0
 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or
 directory)
 open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
 read(3,
 "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\34\2\0\0\0\0\0"..., 832)
 = 832
 fstat(3, {st_mode=S_IFREG|0755, st_size=1738176, ...}) = 0
 mmap(NULL, 3844640, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0)
 = 0x3ac92063000
 mprotect(0x3ac92205000, 2093056, PROT_NONE) = 0
 mmap(0x3ac92404000, 24576, PROT_READ|PROT_WRITE,
 MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a1000) = 0x3ac92404000
 mmap(0x3ac9240a000, 14880, PROT_READ|PROT_WRITE,
 MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3ac9240a000
 close(3)                                = 0
 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x3ac9260e000
 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x3ac9260d000
 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x3ac9260c000
 arch_prctl(ARCH_SET_FS, 0x3ac9260d700)  = 0
 mprotect(0x3ac92404000, 16384, PROT_READ) = 0
 mprotect(0x606000, 4096, PROT_READ)     = 0
 mprotect(0x3ac9262e000, 4096, PROT_READ) = 0
 munmap(0x3ac9260f000, 97489)            = 0
 brk(0)                                  = 0x12e1b90
 brk(0x1302b90)                          = 0x1302b90
 brk(0x1303000)                          = 0x1303000
 open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
 fstat(3, {st_mode=S_IFREG|0644, st_size=1607760, ...}) = 0
 mmap(NULL, 1607760, PROT_READ, MAP_PRIVATE, 3, 0) = 0x3ac92483000
 close(3)                                = 0
 execve("./Browser/execdesktop", ["./Browser/execdesktop", "./start-tor-
 browser.desktop"], [/* 39 vars */]) = 0
 brk(0)                                  = 0x2a76e00
 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or
 directory)
 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x37ffabbf000
 access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or
 directory)
 open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
 fstat(3, {st_mode=S_IFREG|0644, st_size=97489, ...}) = 0
 mmap(NULL, 97489, PROT_READ, MAP_PRIVATE, 3, 0) = 0x37ffaba7000
 close(3)                                = 0
 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or
 directory)
 open("/lib/x86_64-linux-gnu/libncurses.so.5", O_RDONLY|O_CLOEXEC) = 3
 read(3,
 "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320l\0\0\0\0\0\0"..., 832)
 = 832
 fstat(3, {st_mode=S_IFREG|0644, st_size=151120, ...}) = 0
 mmap(NULL, 2246824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0)
 = 0x37ffa781000
 mprotect(0x37ffa7a5000, 2093056, PROT_NONE) = 0
 mmap(0x37ffa9a4000, 8192, PROT_READ|PROT_WRITE,
 MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x23000) = 0x37ffa9a4000
 close(3)                                = 0
 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or
 directory)
 open("/lib/x86_64-linux-gnu/libtinfo.so.5", O_RDONLY|O_CLOEXEC) = 3
 read(3,
 "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\316\0\0\0\0\0\0"..., 832)
 = 832
 fstat(3, {st_mode=S_IFREG|0644, st_size=171800, ...}) = 0
 mmap(NULL, 2269152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0)
 = 0x37ffa557000
 mprotect(0x37ffa57d000, 2093056, PROT_NONE) = 0
 mmap(0x37ffa77c000, 20480, PROT_READ|PROT_WRITE,
 MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x25000) = 0x37ffa77c000
 close(3)                                = 0
 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or
 directory)
 open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
 read(3,
 "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\16\0\0\0\0\0\0"...,
 832) = 832
 fstat(3, {st_mode=S_IFREG|0644, st_size=14664, ...}) = 0
 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x37ffaba6000
 mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0)
 = 0x37ffa353000
 mprotect(0x37ffa356000, 2093056, PROT_NONE) = 0
 mmap(0x37ffa555000, 8192, PROT_READ|PROT_WRITE,
 MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x37ffa555000
 close(3)                                = 0
 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or
 directory)
 open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
 read(3,
 "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\34\2\0\0\0\0\0"..., 832)
 = 832
 fstat(3, {st_mode=S_IFREG|0755, st_size=1738176, ...}) = 0
 mmap(NULL, 3844640, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0)
 = 0x37ff9fa8000
 mprotect(0x37ffa14a000, 2093056, PROT_NONE) = 0
 mmap(0x37ffa349000, 24576, PROT_READ|PROT_WRITE,
 MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a1000) = 0x37ffa349000
 mmap(0x37ffa34f000, 14880, PROT_READ|PROT_WRITE,
 MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x37ffa34f000
 close(3)                                = 0
 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x37ffaba5000
 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x37ffaba4000
 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x37ffaba3000
 arch_prctl(ARCH_SET_FS, 0x37ffaba4700)  = 0
 mprotect(0x37ffa349000, 16384, PROT_READ) = 0
 mprotect(0x37ffa555000, 4096, PROT_READ) = 0
 mprotect(0x37ffa77c000, 16384, PROT_READ) = 0
 mprotect(0x37ffa9a4000, 4096, PROT_READ) = 0
 mprotect(0x6f1000, 4096, PROT_READ)     = 0
 mprotect(0x37ffabc6000, 4096, PROT_READ) = 0
 munmap(0x37ffaba7000, 97489)            = 0
 open("/dev/tty", O_RDWR|O_NONBLOCK)     = 3
 close(3)                                = 0
 brk(0)                                  = 0x2a76e00
 brk(0x2a77000)                          = 0x2a77000
 open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
 fstat(3, {st_mode=S_IFREG|0644, st_size=1607760, ...}) = 0
 mmap(NULL, 1607760, PROT_READ, MAP_PRIVATE, 3, 0) = 0x37ffaa1a000
 close(3)                                = 0
 brk(0x2a78000)                          = 0x2a78000
 brk(0x2a79000)                          = 0x2a79000
 getuid()                                = 1000
 getgid()                                = 1000
 geteuid()                               = 1000
 getegid()                               = 1000
 rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
 brk(0x2a7a000)                          = 0x2a7a000
 open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 3
 fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
 0x37ffabbe000
 read(3, "MemTotal:        3999936 kB\nMemF"..., 1024) = 1024
 close(3)                                = 0
 munmap(0x37ffabbe000, 4096)             = 0
 brk(0x2a7b000)                          = 0x2a7b000
 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART,
 0x37ff9fdd0e0}, {SIG_DFL, [], 0}, 8) = 0
 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER|SA_RESTART,
 0x37ff9fdd0e0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x37ff9fdd0e0}, 8) =
 0
 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x37ff9fdd0e0}, {SIG_DFL,
 [], 0}, 8) = 0
 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x37ff9fdd0e0}, {SIG_DFL,
 [], SA_RESTORER, 0x37ff9fdd0e0}, 8) = 0
 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x37ff9fdd0e0}, {SIG_DFL,
 [], 0}, 8) = 0
 rt_sigaction(SIGQUIT, {SIG_DFL, [], SA_RESTORER, 0x37ff9fdd0e0}, {SIG_DFL,
 [], SA_RESTORER, 0x37ff9fdd0e0}, 8) = 0
 rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x37ff9fdd0e0}, {SIG_DFL,
 [], SA_RESTORER, 0x37ff9fdd0e0}, 8) = 0
 uname({sys="Linux", node="hostname", ...})  = 0
 brk(0x2a7c000)                          = 0x2a7c000
 brk(0x2a7d000)                          = 0x2a7d000
 brk(0x2a7e000)                          = 0x2a7e000
 brk(0x2a7f000)                          = 0x2a7f000
 stat("/home/user/tor-browser", {st_mode=S_IFDIR|0700, st_size=4096, ...})
 = 0
 stat(".", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
 getpid()                                = 8176
 open("/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", O_RDONLY) = 3
 fstat(3, {st_mode=S_IFREG|0644, st_size=26258, ...}) = 0
 mmap(NULL, 26258, PROT_READ, MAP_SHARED, 3, 0) = 0x37ffabb8000
 close(3)                                = 0
 brk(0x2a80000)                          = 0x2a80000
 getppid()                               = 8173
 brk(0x2a81000)                          = 0x2a81000
 brk(0x2a82000)                          = 0x2a82000
 getpgrp()                               = 8173
 rt_sigaction(SIGCHLD, {0x4464a0, [], SA_RESTORER|SA_RESTART,
 0x37ff9fdd0e0}, {SIG_DFL, [], SA_RESTORER|SA_RESTART, 0x37ff9fdd0e0}, 8) =
 0
 getrlimit(RLIMIT_NPROC, {rlim_cur=15542, rlim_max=15542}) = 0
 brk(0x2a83000)                          = 0x2a83000
 brk(0x2a84000)                          = 0x2a84000
 rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
 open("./Browser/execdesktop", O_RDONLY) = 3
 ioctl(3, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS,
 0x3dcbdbca8e0) = -1 ENOTTY (Inappropriate ioctl for device)
 lseek(3, 0, SEEK_CUR)                   = 0
 read(3, "#!/bin/bash\n\nTBB_START_PROG=\"$(g"..., 80) = 80
 lseek(3, 0, SEEK_SET)                   = 0
 getrlimit(RLIMIT_NOFILE, {rlim_cur=64*1024, rlim_max=64*1024}) = 0
 fcntl(255, F_GETFD)                     = -1 EBADF (Bad file descriptor)
 dup2(3, 255)                            = 255
 close(3)                                = 0
 fcntl(255, F_SETFD, FD_CLOEXEC)         = 0
 fcntl(255, F_GETFL)                     = 0x8000 (flags
 O_RDONLY|O_LARGEFILE)
 fstat(255, {st_mode=S_IFREG|0755, st_size=284, ...}) = 0
 lseek(255, 0, SEEK_CUR)                 = 0
 brk(0x2a85000)                          = 0x2a85000
 read(255, "#!/bin/bash\n\nTBB_START_PROG=\"$(g"..., 284) = 284
 rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
 brk(0x2a86000)                          = 0x2a86000
 rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
 pipe([3, 4])                            = 0
 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0
 lseek(255, -155, SEEK_CUR)              = 129
 clone(child_stack=0,
 flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD,
 child_tidptr=0x37ffaba49d0) = 8177
 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
 rt_sigaction(SIGCHLD, {0x4464a0, [], SA_RESTORER|SA_RESTART,
 0x37ff9fdd0e0}, {0x4464a0, [], SA_RESTORER|SA_RESTART, 0x37ff9fdd0e0}, 8)
 = 0
 close(4)                                = 0
 read(3, "./Browser/start-tor-browser --de"..., 128) = 37
 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8177,
 si_uid=1000, si_status=0, si_utime=0, si_stime=0} ---
 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG, NULL) = 8177
 wait4(-1, 0x3dcbdbc9c90, WNOHANG, NULL) = -1 ECHILD (No child processes)
 rt_sigreturn()                          = 37
 read(3, "", 128)                        = 0
 close(3)                                = 0
 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
 rt_sigaction(SIGINT, {0x443660, [], SA_RESTORER, 0x37ff9fdd0e0}, {SIG_DFL,
 [], SA_RESTORER, 0x37ff9fdd0e0}, 8) = 0
 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x37ff9fdd0e0}, {0x443660,
 [], SA_RESTORER, 0x37ff9fdd0e0}, 8) = 0
 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
 read(255, "\nshift\n\nif [ \"$#\" -ge 1 ]\nthen\n "..., 284) = 155
 write(1, "Launching './Browser/start-tor-b"..., 52Launching './Browser
 /start-tor-browser --detach'...
 ) = 52
 rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
 brk(0x2a87000)                          = 0x2a87000
 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0
 rt_sigprocmask(SIG_BLOCK, [CHLD], [INT CHLD], 8) = 0
 rt_sigprocmask(SIG_SETMASK, [INT CHLD], NULL, 8) = 0
 clone(child_stack=0,
 flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD,
 child_tidptr=0x37ffaba49d0) = 8182
 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
 rt_sigaction(SIGINT, {0x443660, [], SA_RESTORER, 0x37ff9fdd0e0}, {SIG_DFL,
 [], SA_RESTORER, 0x37ff9fdd0e0}, 8) = 0
 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 8182
 rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x37ff9fdd0e0}, {0x443660,
 [], SA_RESTORER, 0x37ff9fdd0e0}, 8) = 0
 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8182,
 si_uid=1000, si_status=0, si_utime=0, si_stime=0} ---
 wait4(-1, 0x3dcbdbc9ed0, WNOHANG, NULL) = -1 ECHILD (No child processes)
 rt_sigreturn()                          = 0
 read(255, "", 284)                      = 0
 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
 exit_group(0)                           = ?
 +++ exited with 0 +++

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19413>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs
Prev by Author: Re: [tor-bugs] #18320 [Core Tor/Tor]: Clear old entries from the key-pinning journal file
Next by Author: Re: [tor-bugs] #19406 [Core Tor/Tor]: OpenSSL 1.1.0pre5 breaks with maint-0.2.8
Previous by thread: Re: [tor-bugs] #19412 [Applications/Tor Browser]: Windows 10 frame is changing forcing the screen height to change
Next by thread: [tor-bugs] #19414 [- Select a component]: Pointless, nonfuctional options in Tor Browser
Index(es):
- Author
- Thread