Tails

#3 Updated by cypherpunks 2016-02-21 12:36:44

intrigeri wrote:
> * GIMP: no idea what it uses webkitgtk+ for; does it use it on untrusted data?
> * Liferea: I think we should simply stop shipping it; last time we looked at it seriously, we gave up on making its internal web browser safe enough for our needs and the only resulting action item was Bug #9429; apart of that, we were simply waiting for Icedove to drop Liferea (Feature #7626).

I think worrying about vulnerabilities in GIMP’s WebKit engine is the absolute least thing we should be worrying about with regards to security issues in GIMP. There are so many complex and obscure formats it supports, many of which do have extant security issues. Also, I believe it uses WebKitGTK+ in order to convert documents of various kinds to image formats, and for its internal help system. If necessary though I could check the source sometime this week and tell you what it uses it for with more certainty.

I plan to write an AppArmor policy for GIMP in the near or near-ish future for Tails so that issue should be moot anyway, depending on threat model (which I assume merely involves confining a hijacked GIMP process from the rest of the system).

#4 Updated by cypherpunks 2016-02-21 12:52:27

Also, I think that Tails 2.0 ships more than just GIMP and Liferea. It also ships Yelp. I’m not sure why anyone would care about auditing it though, because it’s not used on untrusted data. It only reads configuration files in $HOME and stuff like that, and if someone can already write to arbitrary files in $HOME, they own that user. The only issue I could think of is if the files read by Yelp are also writable by the AppArmor policy of a sensitive program like Totem or the browser.

#8 Updated by Anonymous 2018-08-18 11:04:18

liferea will be removed in 3.12 and deprecated in 3.9.

#14 Updated by hefee 2019-01-06 16:33:53

Okay we have following packages have to seem to ship a WebKit instance. Search in packages.d.o WebKit in filename:

For buster:

• gambas3-runtime (not used in Tails)
• gambas3-gb-qt5-webkit (not used in Tails)
• libkf5webkit5 (not used in Tails)
• libqtwebkit4 (not used in Tails)
• libvtk6.3-qt (not used in Tails)
• libwebkit2gtk-4.0-37-gtk2
• libwebkit2gtk-4.0-doc (not used in Tails)
• gir1.2-webkit2-4.0
• qtwebkit5-doc-html (not used in Tails)

root@amnesia:~# apt purge libwebkit2gtk-4.0-37 gir1.2-webkit2-4.0 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  accountsservice apg cheese-common evolution-data-server-common gir1.2-accountsservice-1.0 gir1.2-gck-1
  gir1.2-gcr-3 gir1.2-gdm-1.0 gir1.2-geoclue-2.0 gir1.2-gmenu-3.0 gir1.2-gnomebluetooth-1.0
  gir1.2-gweather-3.0 gir1.2-javascriptcoregtk-4.0 gir1.2-mutter-3 gir1.2-nm-1.0 gir1.2-nma-1.0
  gir1.2-polkit-1.0 gir1.2-rsvg-2.0 gir1.2-soup-2.4 gir1.2-upowerglib-1.0 gnome-backgrounds
  gnome-control-center-data gnome-session-bin gnome-session-common gnome-shell-common libaccountsservice0
  libcamel-1.2-62 libcaribou-gtk3-module libcheese-gtk25 libcheese8 libcolord-gtk1 libebackend-1.2-10
  libebook-1.2-19 libebook-contacts-1.2-2 libecal-1.2-19 libedata-book-1.2-25 libedata-cal-1.2-29
  libedataserver-1.2-23 libgdm1 libgnome-bluetooth13 libgnome-menu-3-0 libical3 libjavascriptcoregtk-4.0-18
  libmutter-3-0 libphonenumber7 libpipewire-0.2-1 libprotobuf17 libwoff1 libxcb-res0 mutter-common
  python3-distro ttf-unifont xwayland yelp-xsl zenity-common
Use 'apt autoremove' to remove them.
The following packages will be REMOVED:
  evolution-data-server* gdm3* gir1.2-webkit2-4.0* gnome-control-center* gnome-session* gnome-shell*
  gnome-shell-extension-desktop-icons* gnome-shell-extension-top-icons-plus* gnome-shell-extensions*
  gnome-user-docs* libedataserverui-1.2-2* libgoa-backend-1.0-1* libwebkit2gtk-4.0-37* libyelp0* mutter*
  tails-greeter* yelp* zenity*
0 upgraded, 0 newly installed, 18 to remove and 0 not upgraded.
After this operation, 129 MB disk space will be freed.

==> evolution-data-server - really? other stuff looks like to be GNOME internal stuff depending on WebKit, that would be fine for feature/buster Tails 4.0

for Tails 3.11:

• gambas3-gb-qt5-webkit (not used in Tails)
• libkf5webkit5 (not used in Tails)
• libqtwebkit4 (not used in Tails)
• libvtk6.3-qt (not used in Tails)
• libwebkitgtk-1.0-0
• libwebkitgtk-3.0-0
• libwebkit2gtk-4.0-37
• libqtscript4-webkit (not used in Tails)
• libwebkit2gtk-4.0-doc (not used in Tails)
• gir1.2-webkit2-4.0
• qtwebkit5-doc-html (not used in Tails)

root@amnesia:~# apt purge gir1.2-webkit2-4.0 libwebkit2gtk-4.0-37       
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  accountsservice apg cheese-common evolution-data-server evolution-data-server-common
  gir1.2-accountsservice-1.0 gir1.2-gck-1 gir1.2-gcr-3 gir1.2-gdm-1.0 gir1.2-gmenu-3.0
  gir1.2-gnomebluetooth-1.0 gir1.2-gweather-3.0 gir1.2-javascriptcoregtk-4.0 gir1.2-mutter-3.0
  gir1.2-networkmanager-1.0 gir1.2-nmgtk-1.0 gir1.2-polkit-1.0 gir1.2-soup-2.4 gir1.2-telepathyglib-0.12
  gir1.2-telepathylogger-0.2 gir1.2-upowerglib-1.0 gnome-backgrounds gnome-control-center-data
  gnome-session-bin gnome-session-common gnome-shell-common libaccountsservice0 libcamel-1.2-59
  libcaribou-gtk3-module libcheese-gtk25 libcheese8 libcolord-gtk1 libebackend-1.2-10 libebook-1.2-16
  libebook-contacts-1.2-2 libecal-1.2-19 libedata-book-1.2-25 libedata-cal-1.2-28 libedataserver-1.2-22
  libgdm1 libglib2.0-bin libgnome-bluetooth13 libgnome-menu-3-0 libical2 libjavascriptcoregtk-4.0-18
  libmutter0i libnm-glib4 libnm-gtk0 libnm-util2 libnma0 libphonenumber7 libtelepathy-glib0
  libtelepathy-logger3 libxcb-res0 liferea-data mutter-common ttf-unifont xwayland yelp-xsl zenity-common
Use 'apt autoremove' to remove them.
The following packages will be REMOVED:
  gdm3* gir1.2-webkit2-4.0* gnome-control-center* gnome-session* gnome-shell*
  gnome-shell-extension-top-icons-plus* gnome-shell-extensions* gnome-user-guide* libgoa-backend-1.0-1*
  libwebkit2gtk-4.0-37* libyelp0* liferea* mutter* network-manager-gnome* tails-greeter* yelp* zenity*
0 upgraded, 0 newly installed, 17 to remove and 0 not upgraded.
After this operation, 127 MB disk space will be freed.

==> only liferea is not GNOME interal stuff, so NOT fine for Tails 3.11

#15 Updated by hefee 2019-01-06 16:54:39

And finally against Tails 3.12 (tails-amd64-devel-3.12-20190104T1005Z-53094b0ede.iso):

root@amnesia:~# apt purge gir1.2-webkit2-4.0 libwebkit2gtk-4.0-37 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  accountsservice apg cheese-common evolution-data-server
  evolution-data-server-common gir1.2-accountsservice-1.0 gir1.2-gck-1
  gir1.2-gcr-3 gir1.2-gdm-1.0 gir1.2-gmenu-3.0 gir1.2-gnomebluetooth-1.0
  gir1.2-gweather-3.0 gir1.2-javascriptcoregtk-4.0 gir1.2-mutter-3.0
  gir1.2-networkmanager-1.0 gir1.2-nmgtk-1.0 gir1.2-polkit-1.0 gir1.2-soup-2.4
  gir1.2-telepathyglib-0.12 gir1.2-telepathylogger-0.2 gir1.2-upowerglib-1.0
  gnome-backgrounds gnome-control-center-data gnome-session-bin
  gnome-session-common gnome-shell-common libaccountsservice0 libcamel-1.2-59
  libcaribou-gtk3-module libcheese-gtk25 libcheese8 libcolord-gtk1
  libebackend-1.2-10 libebook-1.2-16 libebook-contacts-1.2-2 libecal-1.2-19
  libedata-book-1.2-25 libedata-cal-1.2-28 libedataserver-1.2-22 libgdm1
  libglib2.0-bin libgnome-bluetooth13 libgnome-menu-3-0 libical2
  libjavascriptcoregtk-4.0-18 libmutter0i libnm-glib4 libnm-gtk0 libnm-util2
  libnma0 libphonenumber7 libtelepathy-glib0 libtelepathy-logger3 libxcb-res0
  mutter-common ttf-unifont xwayland yelp-xsl zenity-common
Use 'apt autoremove' to remove them.
The following packages will be REMOVED:
  gdm3* gir1.2-webkit2-4.0* gnome-control-center* gnome-session* gnome-shell*
  gnome-shell-extension-top-icons-plus* gnome-shell-extensions*
  gnome-user-guide* libgoa-backend-1.0-1* libwebkit2gtk-4.0-37* libyelp0*
  mutter* network-manager-gnome* tails-greeter* yelp* zenity*
0 upgraded, 0 newly installed, 16 to remove and 0 not upgraded.
After this operation, 126 MB disk space will be freed.