replace tor browser pax helper

Existing users will first want to remove the old helper script.

    # rm /usr/local/bin/tor-browser-en

roles/browsers/files/tor-browser-en.sh

@@ -1,26 +0,0 @@
-#!/bin/sh
-#
-# Launch the Tor Browser in a Firejail sandbox, verifying that PaX flags are
-# properly set for a grsec kernel.
-#
-###############################################################################
-
-BROWSER=~/.tor-browser-en/INSTALL/Browser/firefox
-TBB=/usr/bin/tor-browser-en
-
-# Check if Firejail is available.
-FIREJAIL=""
-hash firejail 2> /dev/null
-if [ $? -eq 0 ]; then
-    FIREJAIL=firejail
-fi
-
-# Attempt to run tor-browser-en.
-$FIREJAIL $TBB "$@"
-
-# If it failed with exit code 139, set the PaX flags and run again.
-if [ $? -eq 139 ]; then
-    echo 'setting PAX flags'
-    setfattr -n user.pax.flags -v "m" "$BROWSER"
-    $FIREJAIL $TBB "$@"
-fi

roles/browsers/tasks/main.yml

@@ -57,11 +57,12 @@
     - aur
 
 - name: Jail tor-browser-en
-  copy: src=tor-browser-en.sh dest=/usr/local/bin/tor-browser-en mode=0755
+  file: src=/usr/bin/firejail
+        dest=/usr/local/bin/tor-browser-en
+        state=link
   tags:
     - tor-browser
     - firejail
-    - grsec
 
 - name: Push rofi browser chooser
   template: src=browser.sh.j2 dest=/usr/local/bin/browser mode=0755