It works, but this state is far from ideal: GNU guys update generated source
tarballs very infrequently. Ideally, src needs to be generated by running
makeicecat over firefox src. Will do later.
Misc cleanups, but mainly this:
Before:
- `version` could mean either Firefox or TorBrowser version,
- `configureFlags` was hacky.
Now:
- `ffversion` is Firefox version, `tbversion` is TorBrowser version,
- `configureFlags` is much less hacky.
This reverts a part of 5bd12c694b.
Apparently there's no way to specify user for RuntimeDirectory in systemd
service file (it's always root) but tor won't create control socket if the dir
is owned by anybody except the tor user.
These hardenings were adopted from the upstream service file, checked
against systemd.service(5) and systemd.exec(5) manuals, and tested to
actually work with all the options enabled.
`PrivateDevices` implies `DevicePolicy=closed` according to systemd.exec(5),
removed.
`--RunAsDaemon 0` is the default value according to tor(5), removed.
Adaptation of #23058 by @spinus to 1.0.0rc1. See #23058 and #28111 for discussion.
This patch keeps the warnings. But I think it is useful to have a sanely working
version in nixpkgs, even if it is still considered insecure, just to follow the
upstream development by actually running it instead of reading the log.
This reverts a part of commit 559433d0db.
The problem with removing those options completely is that without them
tor-browser's config differs from the official config (which may or may
not be a problem for fingerprinting).
Before this commit default relay configuration could produce unexpected
real life consequences. This patch makes those choices explicit and
documents them extensively.
SLNOS