tor-browser-bundle-bin: use hardened allocator

This commit is contained in:
Joachim Fasting 2019-09-24 10:28:37 +02:00
parent 2436c27541
commit bd78aa0d9f
No known key found for this signature in database
GPG key ID: 5C204DF675C90294

View file

@ -44,6 +44,10 @@
, shared-mime-info
, gsettings-desktop-schemas
# Hardening
, graphene-hardened-malloc
, useHardenedMalloc ? graphene-hardened-malloc != null && builtins.elem stdenv.system graphene-hardened-malloc.meta.platforms
# Whether to disable multiprocess support to work around crashing tabs
# TODO: fix the underlying problem instead of this terrible work-around
, disableContentSandbox ? true
@ -245,6 +249,9 @@ stdenv.mkDerivation rec {
GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6
EOF
WRAPPER_LD_PRELOAD=${optionalString useHardenedMalloc
"${graphene-hardened-malloc}/lib/libhardened_malloc.so"}
WRAPPER_XDG_DATA_DIRS=${concatMapStringsSep ":" (x: "${x}/share") [
gnome3.adwaita-icon-theme
shared-mime-info
@ -327,6 +334,8 @@ stdenv.mkDerivation rec {
#
# XDG_DATA_DIRS is set to prevent searching system dirs (looking for .desktop & icons)
exec env -i \
LD_PRELOAD=$WRAPPER_LD_PRELOAD \
\
TZ=":" \
TZDIR="\''${TZDIR:-}" \
LOCALE_ARCHIVE="\$LOCALE_ARCHIVE" \