Tails

#1 Updated by intrigeri 2019-10-02 07:39:05

• Subject changed from No sound in videos on 4.0~beta2 to No sound in videos played in Tor Browser on 4.0~beta2

#2 Updated by intrigeri 2019-10-02 08:34:33

• Status changed from New to In Progress
• Assignee set to intrigeri

> I get in the journal:

>

> Sep 29 17:39:33 amnesia thunderbird.desktop[10809]: [Child 10016, MediaPlayback #1] WARNING: 71c56309cdc0 OpenCubeb() failed to init cubeb: file /var/tmp/build/firefox-944a0bc18ba6/dom/media/AudioStream.cpp, line 375
> Sep 29 17:39:33 amnesia thunderbird.desktop[10809]: [Child 10016, MediaPlayback #1] WARNING: Decoder=71c56616ca00 [OnMediaSinkAudioError]: file /var/tmp/build/firefox-944a0bc18ba6/dom/media/MediaDecoderStateMachine.cpp, line 3385
> 

Ouch!

The good news is that I can’t reproduce this if I start Tor Browser from the Applications menu (which is reassuring since we do test this at release time).

However, I can reproduce this if I start Tor Browser by clicking on a link in Thunderbird:

thunderbird.desktop[10669]: [Child 12496, MediaPlayback #3] WARNING: 7eb23684d4c0 OpenCubeb() failed to init cubeb: file /var/tmp/build/firefox-944a0bc18ba6/dom/media/AudioStream.cpp, line 375

First, regarding the thunderbird.desktop part, it’s definitely confusing but given how logind/journald work, I don’t know how we can fix this for apps started from another app, as long as we have a /usr/local/bin/tor-browser wrapper used in our the tor-browser.desktop: given the firefox.real processes have no .desktop file, there’s no way for logind/journald to tell whether a child process is “part of” the parent one, or a fully different external process. Creating a (hidden) .desktop file with Exec=/usr/local/lib/tor-browser/firefox.real might fix it but I doubt it’s worth spending much time on it, if any.

Second, process 12496 is /usr/local/lib/tor-browser/firefox.real so it looks like something went wrong in the AppArmor profile transition on exec.
Interestingly though, aa-status tells me that process 12496 is confined by the torbrowser_firefox AppArmor profile, as expected.

I could fix this bug by replacing, in the usr.bin.thunderbird AppArmor profile, the “Allow opening attachments” section with this:

 # Allow opening attachments
 # TODO: create and use abstractions for opening various file formats
/{usr/,}bin/{[^gp],g[^p],gp[^g],p[^s]}* Cx -> sanitized_helper,
/usr/local/bin/{[^t],t[^o],to[^r],tor[^-],tor-[^b],tor-b[^r],tor-br[^o],tor-bro[^w],tor-brow[^s],tor-brows[^e],tor-browse[^r]}* Cx -> sanitized_helper,
/usr/local/bin/tor-browser Uxmr,
/usr/lib/libreoffice/program/soffice Cxr -> sanitized_helper,

The previous version caused this bug because our /usr/local/bin/tor-browser shell wrapper was started under sanitized_helper, which scrubs the environment when our wrapper in turn starts the Firefox process(es).

#3 Updated by intrigeri 2019-10-02 08:37:44

• Subject changed from No sound in videos played in Tor Browser on 4.0~beta2 to No sound in videos played in Tor Browser started by Thunderbird

(Making it clearer what’s the prerequisite to see this problem happens; dropping 4.0~beta2 indication as I bet this affects 3.x as well.)

#4 Updated by intrigeri 2019-10-02 08:37:57

• blocks Feature #16209: Core work: Foundations Team added

#5 Updated by intrigeri 2019-10-03 13:21:17

• Feature Branch set to bugfix/17105-torbrowser-started-from-thunderbird

#6 Updated by intrigeri 2019-10-04 05:51:44

• Status changed from In Progress to Needs Validation
• Assignee deleted (intrigeri)

https://jenkins.tails.boum.org/job/test_Tails_ISO_bugfix-17105-torbrowser-started-from-thunderbird/1/ passed, except Bug #17104.

#7 Updated by segfault 2019-10-04 18:52:42

• Status changed from Needs Validation to Resolved
• % Done changed from 0 to 100

Applied in changeset commit:tails|5b3636ea17c4aa4c522ed77094de8749aa5b5bb8.