#!/bin/bash
# A second Tor Browser as its own locked-down user, tor-browser-unsafe, at the Safer security
# level: JavaScript runs on https sites (NoScript blocks it on http), so a page has more to
# attack than at Safest. It is for the sites that need some JavaScript, kept apart from the
# Safest browser so a hacked page in it can't reach the Safest one's files.
#  - Its own user, its own home (/home/tor-browser-unsafe) and its own copy of Tor Browser, so
#    it shares nothing with the Safest tor-browser: separate users, each home 0700.
#  - Everything that makes the Safest one safe is here too: its own window (cage, a private X
#    server), a firewall that keeps it off this computer and your network, the clipboard that
#    shows you a line before it crosses, files only through ~/Browsers/tor-browser-unsafe.
#  - The Safer level is locked by the browser's own policy file, and the address bar and the
#    current tab are red (userChrome.css, data/tor-browser-userchrome.css) to remind you some
#    JavaScript runs. The red is the browser's own frame, which pages can't see; the level is
#    visible to sites anyway (through what JavaScript can do), so it adds nothing to fingerprint.
#  - It needs the Safest tor-browser extra: that one installs the shared pieces (torbrowser-
#    launcher's AppArmor profiles, the browser-sandbox command, the Tor DNS fix). Install it first.
# /usr/bin/torbrowser-launcher, by its full path, still runs as you.
# Usage: bash tor-browser-unsafe.sh [--remove | --manual]
# summary: a second Tor Browser, its own user, at Safer
# security: most
# category: web
# status: file:/usr/local/bin/tor-browser-unsafe
# files: lib/browser-sandbox.sh bin/sandbox-net-check data/tor-browser-safer.js data/tor-browser-policies-safer.json data/tor-browser-userchrome.css data/tor-browser-unsafe-firewall.nft
. "$(dirname -- "${BASH_SOURCE[0]}")/../lib.sh"
. "$WREN_DIR/lib/appimage.sh"
. "$WREN_DIR/lib/browser-sandbox.sh"
if [ "${1:-}" = --manual ]; then print_manual; exit; fi
need_user

NAME=tor-browser-unsafe
TB_BASE=/home/$NAME/.local/share/torbrowser/tbb/$(uname -m)
TBB=$TB_BASE/tor-browser
PROFILE=$TBB/Browser/TorBrowser/Data/Browser/profile.default
USERJS=$PROFILE/user.js
# The lib's shared machinery reads these:
OLD_USERJS=
TB_PREFS_SRC=$WREN_DIR/data/tor-browser-safer.js
POLICIES_SRC=$WREN_DIR/data/tor-browser-policies-safer.json
TB_LEVEL_NOTES=("Tor Browser starts at the Safer level: JavaScript runs on https sites. The level"
    "is locked (the shield's dialog and about:config can't change it), and its address bar and"
    "current tab are red, to remind you some JavaScript runs.")
OFFLINE="$OFFLINE_DIR/torbrowser"
USERCHROME=$WREN_DIR/data/tor-browser-userchrome.css

# write_userchrome: the red frame, written by its user (like user.js). Firefox reads
# chrome/userChrome.css at start when the pref (in the Safer user.js, and locked) is on.
write_userchrome() {
    # shellcheck disable=SC2016  # expanded by the inner bash, on purpose
    as_browser "$NAME" bash -c 'umask 077; mkdir -p "$1/chrome"; cat >"$1/chrome/.userChrome.css.wren"; mv -f "$1/chrome/.userChrome.css.wren" "$1/chrome/userChrome.css"' _ "$PROFILE" <"$USERCHROME"
}

if [ "${1:-}" = --remove ]; then
    browser_remove "$NAME"
    remove_net_check
    # The AppArmor fixes are shared with the Safest tor-browser: only undo them if it is gone too
    if ! tor_browser_sibling "$NAME"; then
        unfix_apparmor_browser
        unfix_apparmor_dns
        apt_purge torbrowser-launcher
    else
        # Rewrite the shared AppArmor block so the Safest one keeps its rule (this user's dead
        # paths stay too: harmless, they name a home that is gone)
        fix_apparmor_browser
        note "The Safest tor-browser is still installed, so Tor Browser's shared pieces stay."
    fi
    exit
fi

# The shared pieces come from the Safest extra; it also turns on contrib and the AppArmor fixes
if [ ! -e /usr/local/bin/tor-browser ] || [ ! -x /usr/local/libexec/browser-session ]; then
    die "This needs the Safest Tor Browser first: wrenctl install tor-browser. Then run this again."
fi
[ -f /etc/apparmor.d/torbrowser.Browser.firefox ] ||
    warn "torbrowser-launcher's AppArmor profile isn't here; the browser won't be confined by it."

say "The $NAME user"
browser_user "$NAME" "Wren Linux sandboxed Tor Browser (Safer)"
fix_apparmor_browser
fix_apparmor_dns
browser_files "$NAME"

say "The command"
install_net_check
browser_commands "$NAME"
browser_allow "$NAME"

say "Keeping $NAME off this computer and your network"
browser_firewall "$NAME"

say "Tor Browser (a second copy, for this user)"
install_browser

say "Its security level, the red frame, and bridges"
prepare_profile
write_userchrome

note "Run it with: tor-browser-unsafe   (or Super+d)"
note "It is the less-safe one: some JavaScript runs. Use tor-browser (Safest) when you can."
note "Text in or out: Super+Ctrl+b, which shows it first. Files: ~/Browsers/tor-browser-unsafe."