# A second Tor Browser, at Safer (`extras/tor-browser-unsafe.sh`)

## SYNOPSIS

```
wrenctl install tor-browser-unsafe                set it up (needs tor-browser first), or change its bridges
wrenctl remove tor-browser-unsafe                 take it out
wrenctl manual tor-browser-unsafe                 print the manual steps below

tor-browser-unsafe [URL...]                       open it (or Super+d)
```

A second Tor Browser as its own locked-down user, `tor-browser-unsafe`, at the **Safer**
security level: JavaScript runs on `https` sites (NoScript blocks it on `http`), so a page has
more to attack than at Safest. It is for the sites that need some JavaScript, kept in a user of
its own so a hacked page in it can't reach the Safest browser's files. It has its own home
(`/home/tor-browser-unsafe`, which only it can enter) and its own copy of Tor Browser, and shares
nothing with the Safest `tor-browser` but the shared machinery that extra installs. Everything
that makes the Safest one safe is here too: its own window (`cage`, a private X server), a
firewall that keeps it off this computer and your network, a clipboard that shows you a line
before it crosses, and files only through `~/Browsers/tor-browser-unsafe`. The Safer level is
locked by Tor Browser's own policy file, and its address bar and current tab are red
(`userChrome.css`) to remind you some JavaScript runs — the browser's own frame, which pages
can't see.

It needs the Safest `tor-browser` extra, which installs the shared pieces (torbrowser-launcher's
AppArmor profiles, the `browser-sandbox` command, the Tor DNS fix): install that first.

## LIMITS

- Safer runs JavaScript on `https` sites; that is more for a hacked page to use than Safest, which runs none. Use the Safest `tor-browser` when a site lets you.
- The red frame is a reminder, not a wall. The wall is the separate user: the two browsers can't read each other's files.
- Browser and its Tor are one user, so a hacked browser could go straight out and show your address. Whonix is what stops that.
- It is a second full copy of Tor Browser (its own user's), so it uses that much more disk and memory.
- Logging in to a site tells it who you are, Tor or not. The level is visible to sites anyway (through what JavaScript can do).

## MANUAL INSTALL

```
# This needs the Safest tor-browser installed first (wrenctl install tor-browser): it sets up
# torbrowser-launcher's AppArmor profiles, the browser-sandbox command and the Tor DNS fix.

# A system user, no password, no login, home only it can enter (in /home: the AppArmor profile
# attaches to a browser under it)
sudo useradd --system --user-group --create-home --home-dir /home/tor-browser-unsafe \
    --shell /usr/sbin/nologin --comment "Wren Linux sandboxed Tor Browser (Safer)" tor-browser-unsafe
sudo chmod 0700 /home/tor-browser-unsafe
getent group render >/dev/null && sudo usermod -aG render tor-browser-unsafe

# Let its browser reach its own share folder and sound pipe (add these to the shared block in
# /etc/apparmor.d/local/torbrowser.Browser.firefox, then reload the profile)
# /var/lib/wren-browsers/tor-browser-unsafe/ rw,
# /var/lib/wren-browsers/tor-browser-unsafe/** rwk,
# owner /dev/shm/tor-browser-unsafe.*/run/pulse/ r,
# owner /dev/shm/tor-browser-unsafe.*/run/pulse/native rw,
sudo apparmor_parser -r /etc/apparmor.d/torbrowser.Browser.firefox

# The folder you share with it, root's, outside your home
sudo install -d -o root -g root -m 0770 /var/lib/wren-browsers/tor-browser-unsafe
sudo setfacl -m "u:$USER:rwx,u:tor-browser-unsafe:rwx" /var/lib/wren-browsers/tor-browser-unsafe
sudo setfacl -d -m "u:$USER:rwx,u:tor-browser-unsafe:rwx" /var/lib/wren-browsers/tor-browser-unsafe

# The command, and your user allowed to run only the session script as it
sudo ln -sfn browser-sandbox /usr/local/bin/tor-browser-unsafe
printf '%s ALL=(tor-browser-unsafe) NOPASSWD: /usr/local/libexec/browser-session\n' "$USER" |
    sudo tee /etc/sudoers.d/wren-tor-browser-unsafe   # (check with visudo -cf first)
sudo chmod 0440 /etc/sudoers.d/wren-tor-browser-unsafe

# Its firewall, loaded before the network comes up (data/tor-browser-unsafe-firewall.nft)
sudo install -d -o root -g root -m 0755 /etc/wren
sudo install -o root -g root -m 0644 @WREN_DIR@/data/tor-browser-unsafe-firewall.nft /etc/wren/tor-browser-unsafe.nft
# ... a wren-tor-browser-unsafe-firewall.service like the Safest one's, enabled and started

# Its own copy of Tor Browser, checked against the developers' key, unpacked by its user
B=/home/tor-browser-unsafe/.local/share/torbrowser/tbb/$(uname -m)
(cd / && sudo -u tor-browser-unsafe mkdir -p "$B")
sudo -u tor-browser-unsafe tar -xJ -C "$B" <@WREN_DIR@/offline/torbrowser/tor-browser-linux-$(uname -m)-VERSION.tar.xz

# Safer, JavaScript on https only, before its first start; its policy file locks the level; its
# userChrome.css makes the frame red (the pref that turns stylesheets on is in the user.js, locked)
P=$B/tor-browser/Browser/TorBrowser/Data/Browser/profile.default
(cd / && sudo -u tor-browser-unsafe mkdir -p "$P/chrome" "$B/tor-browser/Browser/distribution")
sudo -u tor-browser-unsafe tee "$P/user.js" <@WREN_DIR@/data/tor-browser-safer.js >/dev/null
sudo -u tor-browser-unsafe tee "$B/tor-browser/Browser/distribution/policies.json" <@WREN_DIR@/data/tor-browser-policies-safer.json >/dev/null
sudo -u tor-browser-unsafe tee "$P/chrome/userChrome.css" <@WREN_DIR@/data/tor-browser-userchrome.css >/dev/null
```