Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apparmor profile prevents Tor Browser 10 from loading libstdc++.so.6 #502

Closed
rmsacks opened this issue Sep 23, 2020 · 1 comment · Fixed by #503
Closed

Apparmor profile prevents Tor Browser 10 from loading libstdc++.so.6 #502

rmsacks opened this issue Sep 23, 2020 · 1 comment · Fixed by #503

Comments

@rmsacks
Copy link
Contributor

rmsacks commented Sep 23, 2020

As I mentioned at the end of this comment, the apparmor profile torbrowser.Browser.firefox prevents Tor Browser version 10.0 from loading libstdc++.so.6. It results in the following error on the command line

./firefox.real: error while loading shared libraries: libstdc++.so.6: failed to map segment from shared object

and the following message in the audit logs:

AVC apparmor="DENIED" operation="file_mmap" profile="torbrowser_firefox" name="/home/<user>/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Tor/libstdc++/libstdc++.so.6" pid=3883 comm="firefox.real" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000

I tested that this error occurs on both version 0.3.2-13~bpo10+1 in Debian buster-backports and from building from source on develop/HEAD.


After looking at this further, I found that the reason this happens with Tor Browser version 10.0 and not the previous versions is because the system-wide libstdc++ in Debian Buster is too old for this version, so these lines in the shell script firefox (distributed with Tor Browser) decide to use the bundled libstdc++ instead of the system-wide one:

# Check if the system has a more recent version of libstdc++.so.6; if yes, use
# that instead of the bundled version.
"$basedir/abicheck" >/dev/null 2>&1
if [ $? -ne 0 ]; then
  add_LD_LIBRARY_PATH "$basedir/TorBrowser/Tor/libstdc++/"
fi
add_LD_LIBRARY_PATH "$basedir/TorBrowser/Tor/"
export LD_LIBRARY_PATH

To confirm this, running ./abicheck shows that the required versions are indeed not found:

./abicheck: /lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.28' not found (required by ./abicheck)
./abicheck: /lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.26' not found (required by ./abicheck)
@intrigeri
Copy link
Collaborator

Good catch! I did not spot it as I'm running Debian sid.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants