From 0d3c7b395678dffd5034b619a0d2ecd5caa0a5ae Mon Sep 17 00:00:00 2001
From: Pig Monkey <pm@pig-monkey.com>
Date: Sat, 6 May 2017 18:25:01 -0700
Subject: [PATCH] replace tor browser pax helper

Existing users will first want to remove the old helper script.

    # rm /usr/local/bin/tor-browser-en
---
 roles/browsers/files/tor-browser-en.sh | 26 --------------------------
 roles/browsers/tasks/main.yml          |  5 +++--
 2 files changed, 3 insertions(+), 28 deletions(-)
 delete mode 100755 roles/browsers/files/tor-browser-en.sh

diff --git a/roles/browsers/files/tor-browser-en.sh b/roles/browsers/files/tor-browser-en.sh
deleted file mode 100755
index 43e5563..0000000
--- a/roles/browsers/files/tor-browser-en.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-#
-# Launch the Tor Browser in a Firejail sandbox, verifying that PaX flags are
-# properly set for a grsec kernel.
-#
-###############################################################################
-
-BROWSER=~/.tor-browser-en/INSTALL/Browser/firefox
-TBB=/usr/bin/tor-browser-en
-
-# Check if Firejail is available.
-FIREJAIL=""
-hash firejail 2> /dev/null
-if [ $? -eq 0 ]; then
-    FIREJAIL=firejail
-fi
-
-# Attempt to run tor-browser-en.
-$FIREJAIL $TBB "$@"
-
-# If it failed with exit code 139, set the PaX flags and run again.
-if [ $? -eq 139 ]; then
-    echo 'setting PAX flags'
-    setfattr -n user.pax.flags -v "m" "$BROWSER"
-    $FIREJAIL $TBB "$@"
-fi
diff --git a/roles/browsers/tasks/main.yml b/roles/browsers/tasks/main.yml
index 84fee31..33c52d3 100644
--- a/roles/browsers/tasks/main.yml
+++ b/roles/browsers/tasks/main.yml
@@ -57,11 +57,12 @@
     - aur
 
 - name: Jail tor-browser-en
-  copy: src=tor-browser-en.sh dest=/usr/local/bin/tor-browser-en mode=0755
+  file: src=/usr/bin/firejail
+        dest=/usr/local/bin/tor-browser-en
+        state=link
   tags:
     - tor-browser
     - firejail
-    - grsec
 
 - name: Push rofi browser chooser
   template: src=browser.sh.j2 dest=/usr/local/bin/browser mode=0755