Tor Browser on Ubuntu thinks httptap is running it as root

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 24.04.1 LTS
Release:	24.04
Codename:	noble

Ubuntu workaround suggested in the README is applied:

$ ./httptap
error creating network namespace: operation not permitted
$ sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
kernel.apparmor_restrict_unprivileged_unconfined = 0
$ sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
kernel.apparmor_restrict_unprivileged_userns = 0

The very first test example from the README works:

$ ./httptap -- curl https://monasticacademy.org
Redirecting...
---> GET https://monasticacademy.org/
<--- 308 https://monasticacademy.org/ (15 bytes)

This works and successfully starts Tor Browser

$ torbrowser-launcher 
Tor Browser Launcher
By Micah Lee & Tor Project, licensed under MIT
version 0.3.7
https://gitlab.torproject.org/tpo/applications/torbrowser-launcher/
QSocketNotifier: Can only be used with threads started with QThread
Launching Tor Browser.
Running /home/user/.local/share/torbrowser/tbb/x86_64/tor-browser/start-tor-browser.desktop
Launching './Browser/start-tor-browser --detach'...

This does not work and prints a bit of additional text:

$ ./httptap -- torbrowser-launcher
Tor Browser Launcher
By Micah Lee & Tor Project, licensed under MIT
version 0.3.7
https://gitlab.torproject.org/tpo/applications/torbrowser-launcher/
QSocketNotifier: Can only be used with threads started with QThread
Launching Tor Browser.
Running /home/user/.local/share/torbrowser/tbb/x86_64/tor-browser/start-tor-browser.desktop
Launching './Browser/start-tor-browser --detach'...
./Browser/start-tor-browser: line 28: [: : integer expression expected

(zenity:100439): Gtk-CRITICAL **: xx:xx:xx.xxx: Unable to connect to the accessibility bus at 'unix:path=/run/user/1000/at-spi/bus,guid=e1475649a73d8830f56f060867a5c67e': Exhausted all available authentication mechanisms (tried: EXTERNAL) (available: EXTERNAL)

Note: xx:xx:xx.xxx is an edited timestamp.

Then Tor Browser displays a dialog with the message:

The Tor Browser should not be run as root.  Exiting.

and an OK button. When pressing OK, the command just exits with no additional text printed to terminal.

[alexflint]

Yep, in creating the user namespace, the subprocess sees an effective user ID and group ID of 0, which is root. In #32 I fix this. However, I need to do a little more testing before merging that change.

It would be of immense help to me if you could try building the code on the branch from that pull request and seeing whether it works for you in this case, though I understand if you're not able to. If you have Go installed on your system then it should be as simple as

git clone git@github.com:monasticacademy/httptap
cd httptap
git checkout match-original-uid
go build
./httptap -- torbrowser-launcher

$ git clone git@github.com:monasticacademy/httptap
Cloning into 'httptap'...
The authenticity of host 'github.com (140.82.121.3)' can't be established.
ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? 
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

I was able to clone through HTTPS though:

$ git clone https://github.com/monasticacademy/httptap/

$ go version
go version go1.22.2 linux/amd64

Everything builds fine, the error is gone:

$ ./httptap -- torbrowser-launcher
at third stage...
switching to gid 1000
switching to uid 1000
third stage now in uid 1000, gid 1000, launching final subprocess...
Tor Browser Launcher
By Micah Lee & Tor Project, licensed under MIT
version 0.3.7
https://gitlab.torproject.org/tpo/applications/torbrowser-launcher/
QSocketNotifier: Can only be used with threads started with QThread
Launching Tor Browser.
Running /home/user/.local/share/torbrowser/tbb/x86_64/tor-browser/start-tor-browser.desktop
Launching './Browser/start-tor-browser --detach'...
$

Yet the Tor Browser main window does not appear.

Given that --detach option, I tried to launch without it:

$ ./httptap -- /home/user/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser/start-tor-browser
at third stage...
switching to gid 1000
switching to uid 1000
third stage now in uid 1000, gid 1000, launching final subprocess...
subprocess exited with code 1