[SRU - Noble] Tor Browser - keyboard not functioning

[Craig Carnell]

[Impact]
Due to various changes in AppArmor, and the AppArmor policy for Tor Browser installed by the launcher, the default ibus/dbus abstractions don't include user-space access to DBUS/IBUS.

This results in Tor Browser being unable to read keyboard input in userspace, resulting in a Non-Functional application. While Tor Browser *launcher* still works, the underlying Tor Browser inherits the AppArmor profile from torbrowser-launcher, hence this needs updated here.

[Test Plan]
This fix has already been tested and implemented in Debian upstream. However, it was not available before FeatureFreeze, and was not available in Debian until post-Noble release.

This has already been tested manually by others, but as soon as a version with the patch present is available, a user should install the updated torbrowser-launcher package and the updated AppArmor profile should apply, and the program should work as usual.

[Regression Potential]
Extremely limited. This simply allows access to userspace dbus/ibus access for Keyboard input.

Note that this exact same line being added to the AppArmor profile here exists in the Firefox AppArmor ruleset as well, and since Tor Browser and Firefox share much of the same code, this should have limited to no impact as this has existed in Firefox for a long time.

[Where problems could occur]

The only thing that might happen is extra access to dbus/ibus interfaces for input handling. However, as this change being added by SRU is already in the Firefox apparmor profile, this shouldn't cause any issues.

[Other Info]
This is already available in Debian Unstable, and also in Oracular due to the sync.

Simon Quigley is handling the upload and prep of the SRU debdiff to noble-updates as a favor to Thomas Ward who is having computer scuff at the time of the uploading.

[Original Description]

I have installed tor browser v13.0.11 on 24.04 (noble). The keyboard does not operate, when typing no characters are appearing.

I have tried to enter a search and also type in a URL but this is not working.

I am using default Ubuntu desktop with wayland.

ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: torbrowser-launcher 0.3.7-1
ProcVersionSignature: Ubuntu 6.8.0-11.11-generic 6.8.0-rc4
Uname: Linux 6.8.0-11-generic x86_64
ApportVersion: 2.28.0-0ubuntu1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Fri Mar 8 16:01:36 2024
InstallationDate: Installed on 2024-03-08 (0 days ago)
InstallationMedia: Ubuntu 24.04 LTS "Noble Numbat" - Daily amd64 (20240306)
ProcEnviron:
 LANG=en_US.UTF-8
 PATH=(custom, no user)
 SHELL=/bin/bash
 TERM=xterm-256color
 XDG_RUNTIME_DIR=<set>
SourcePackage: torbrowser-launcher
UpgradeStatus: No upgrade log present (probably fresh install)

[Craig Carnell (craig-carnell)]

torbrowser-launcher:
  Installed: 0.3.7-1
  Candidate: 0.3.7-1
  Version table:
 *** 0.3.7-1 500
        500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages
        100 /var/lib/dpkg/status

[Thomas Ward (teward)]

torbrowser-launcher is only a tool to help download and update (and run) Tor Browser. It is not actually Tor Browser.

If you are having issues with Tor Browser, I suggest you enlist the help of the Tor community as issues with Tor Browser itself are not related to the Launcher tool.

[Chris Guiver (guiverc)]

I'll add for FYI sake.. I've experienced this myself on my primary box (two weeks now); Lubuntu noble using LXQt/Xorg

I tried to re-create it using what was the Lubuntu current daily (this was a few days ago now); and the torbrowser-launcher worked perfectly in installing torbrowser for me to test & use.. No keyboard issues either on the live system.

[AsciiWolf (asciiwolf)]

I can reproduce this issue on a clean installation of latest Ubuntu 24.04 Beta (installed in a vm) with torbrowser-launcher-0.3.7-1build2.

No problem when using the Flatpak version. This may be an AppArmor profile related issue. Reopening the ticket.

Thomas, please look into this if possible. Thanks!

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[AsciiWolf (asciiwolf)]

If this is an AppArmor issue, it should be fixed ASAP. I can provide help if necessary.

[AsciiWolf (asciiwolf)]

We should also patch it in Debian and upstream afterwards.

[AsciiWolf (asciiwolf)]

Got it! Not sure why, but it is caused by the " #include if exists <abstractions/dbus-session>" line that we added in a downstream patch. Removing this line fixes the keyboard issue.

[AsciiWolf (asciiwolf)]

I have found the real reason and fix for this issue!

It seems that it is caused by no permissions for ~/.cache/ibus/dbus-* socket. But for some weird reason, the issue happens only if abstractions/dbus-session is included in the torbrowser.Browser.firefox AppArmor profile file.

Adding this line into torbrowser.Browser.firefox seems to fix the issue without any side effects:

  owner @{HOME}/.cache/ibus/dbus-* rw,

(This line is also present in the official Firefox AppArmor profile, but missing from the torbrowser-launcher one.)

[Martin D. Weinberg (martin-weinberg-5)]

Thanks for solving this. I made the change and confirm that keyboard input now works again!

[Chris Guiver (guiverc)]

I'll add another affirmation that what Asciiwolf reports in comment #10 is working for me too on this (my primary) install where I've not had keyboard working for some time (see comment #4; late February 2024)

Add line & restart apparmor, and start torbrowser & I can use it for the first time in ages.

Thank you Asciiwolf - appreciate the solution.

I wonder if the package this bug report is filed against is incorrect; but sorry I don't know.

[AsciiWolf (asciiwolf)]

Thanks for the confirmation! Don't worry, the package is correct and the issue will hopefully be fixed soon.

[d1bro (d1bro)]

can also confirm comment #10 solves the issue

[Gafford Pearce (gypearce)]

Just downloaded and installed Ubuntu 24.04 yesterday and had the issue with keyboard not operating. I am brand new to Ubuntu/Linux and loving it so this is for new folks who don't understand a lot. Step by step:
first: the torbrowser.Browser.firefox file is found in the Ubuntu/etc/apparmor.d directory.
second: edit the file with a text editor and add the line in #10.

owner @{HOME}/.cache/ibus/dbus-* rw,

I added it after a bunch of other lines starting with owner @{HOME}...
third: Save the file.
Many thanks to AsciiWolf #10 for the above solution, it works perfectly.

fourth: you must now stop and restart apparmor using the command line

sudo /etc/init.d/apparmor stop
sudo /etc/init.d/apparmor start

Many thanks to Chris Guiver #12 for this subtle tip. You DO need to restart apparmor for it to work!
All of the above solutions are from other people, I hope I have put it in a format that will be easier for new users to follow. PLEASE let me know.

[Nico R (u-nico-c)]

Thanks #15!

I had the exact same issue on Kubuntu after upgrading from 23.10 to 24.04, and just adding the

owner @{HOME}/.cache/ibus/dbus-* rw,

line into /etc/apparmor.d/torbrowser.Browser.firefox anywhere inside the curly brackets of the "profile" segment - e.g. immediately after the line

profile torbrowser_firefox @{torbrowser_firefox_executable} {
[...]

and restarting the apparmor service (or rebooting the computer) does the trick.

[AsciiWolf (asciiwolf)]

Debian fix: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/fd38d605bc9160edaea2e5eaff665e550340f38e

Ubuntu (24.04) SRU should be ready soon.

[Thomas Ward (teward)]

Note that this is not yet released in Debian. I have a bunch of things to fix in the packaging first such as lintian issues and copyright files.

I can debdiff this into Ubuntu as an SRU after the Debian package is fully functional and compliant with policy.

[Thomas Ward (teward)]

Fixed in Oracular by a sync from Debian.

Because my system is being derp with signing keys and uploads, I've enlisted another Ubuntu Developer to handle the SRU debdiff.

[Lolo Repsol (lolorepsol)]

Thank you very much gypearce, that worked just fine :)

I added the line right after:

# KDE 4
  owner @{HOME}/.kde/share/config/* r,

Thank you again for made the fix accessible for the noobs! <3

[Mauricio Faria de Oliveira (mfo)]

Marking Oracular as Fix Released.

torbrowser-launcher (0.3.7-2) unstable; urgency=medium

  [ Daniel Rusek ]
  * debian/patches:
    - Add patch 05 to fix keyboard input issue.
...

[Mauricio Faria de Oliveira (mfo)]

Thanks for mentioning that the proposed change is present in Firefox AppArmor profiles.
Looking at its snap profiles, this can be traced back to snapd; that builds confidence.
For documentation purposes:

$ sudo apt update && sudo apt install -y firefox

$ dpkg -s firefox | grep ^Description:
Description: Transitional package - firefox -> firefox snap

$ snap list firefox
Name Version Rev Tracking Publisher Notes
firefox 127.0-2.1 4424 latest/stable mozilla✓ -

$ grep -rw ibus /var/lib/snapd/apparmor/profiles/
...
/var/lib/snapd/apparmor/profiles/snap.firefox.firefox:# when running with glib >= 2.75.0, ibus uses a regular socket
/var/lib/snapd/apparmor/profiles/snap.firefox.firefox:owner @{HOME}/.cache/ibus/dbus-* rw,

$ snap download firefox
$ unsquashfs -d firefox-snap firefox_4424.snap
... grep doesn't find it in firefox-snap/, but finds it in /snap/snapd/
$ grep -a -B1 '^owner .*/ibus/dbus-\*' /snap/snapd/21759/usr/lib/snapd/snapd
# when running with glib >= 2.75.0, ibus uses a regular socket
owner @{HOME}/.cache/ibus/dbus-* rw,

... confirmed it is in snapd source
$ apt source snapd
$ grep -r -B1 'owner.*/ibus/dbus-*' snapd-2.63+24.04/
snapd-2.63+24.04/interfaces/builtin/desktop_legacy.go-# when running with glib >= 2.75.0, ibus uses a regular socket
snapd-2.63+24.04/interfaces/builtin/desktop_legacy.go:owner @{HOME}/.cache/ibus/dbus-* rw,

$ dpkg -s libglib2.0-dev | grep Version:
Version: 2.80.0-6ubuntu3.1

[Mauricio Faria de Oliveira (mfo)]

Thanks for the upload as well.

Ideally, the version should be `0.3.7-1ubuntu0.1` (not `ubuntu1`), as this
is for stable release (see [1]), but in this case it's fine -- the version
hasn't been used (see [2]), and will not be used anymore, as devel release
is already at `0.3.7-2`.

Now, I'd suggest the following _style_ changes, which helps Ubuntu maintenance
over time. This isnt' required, but is recommended and has been popularly used.

Changelog entry with related files:
  * d/p/05-Add-IBus-socket-access.patch: Fix non-functional keyboard (LP: #2056578).

DEP-3 tags in .patch file [3]:
  Bug-Ubuntu: https://bugs.launchpad.net/bugs/2056578
  Origin: vendor, https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/fd38d605bc9160edaea2e5eaff665e550340f38e

Since the first point is fine in this case, and the remaining points are style,
this can be accepted as is into Noble.

Thanks for your contribution!
Mauricio

[1] https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging
[2] https://launchpad.net/ubuntu/+source/torbrowser-launcher/+publishinghistory
[3] https://dep-team.pages.debian.net/deps/dep3/

[Mauricio Faria de Oliveira (mfo)]

Hello Craig, or anyone else affected,

Accepted torbrowser-launcher into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/torbrowser-launcher/0.3.7-1ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[AsciiWolf (asciiwolf)]

I did set up two (clean installation, fully updated) 24.04 VMs: one with noble-proposed disabled and the other one with noble-proposed enabled. Installed latest torbrowser-launcher on both of them.

- On the VM without noble-proposed enabled and using torbrowser-launcher version 0.3.7-1build2, the keyboard input in Tor Browser does not work.
- On the VM with noble-proposed enabled and using torbrowser-launcher version 0.3.7-1ubuntu1, the keyboard input in Tor Browser *works fine*.

In other words, the 0.3.7-1ubuntu1 build fixes the issue. Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package torbrowser-launcher - 0.3.7-1ubuntu1

---------------
torbrowser-launcher (0.3.7-1ubuntu1) noble; urgency=medium

  * Fix non-functional keyboard (LP: #2056578).

 -- Thomas Ward <email address hidden> Thu, 06 Jun 2024 19:15:35 -0500

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for torbrowser-launcher has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.