Tails

#1 Updated by Dr_Whax 2018-02-11 16:37:16

• related to Bug #15303: Ensure Tails 3.6 fixes CVE-2018-6871 added

#2 Updated by bertagaz 2018-03-14 11:32:28

• Target version changed from Tails_3.6 to Tails_3.7

#3 Updated by bertagaz 2018-05-10 11:09:32

• Target version changed from Tails_3.7 to Tails_3.8

#4 Updated by intrigeri 2018-06-26 16:28:04

• Target version changed from Tails_3.8 to Tails_3.9

#5 Updated by intrigeri 2018-09-05 16:27:00

• Target version changed from Tails_3.9 to Tails_3.10.1

#6 Updated by intrigeri 2018-10-24 17:03:45

• Target version changed from Tails_3.10.1 to Tails_3.11

#7 Updated by CyrilBrulebois 2018-12-16 13:57:46

• Target version changed from Tails_3.11 to Tails_3.12

#8 Updated by anonym 2019-01-30 11:59:28

• Target version changed from Tails_3.12 to Tails_3.13

#9 Updated by CyrilBrulebois 2019-03-20 14:34:09

• Target version changed from Tails_3.13 to Tails_3.14

#10 Updated by intrigeri 2019-04-13 06:26:44

• Subject changed from Investigate whether we can disable macros in Libreoffice to Disable non-user macros in Libreoffice
• Status changed from In Progress to Confirmed
• Priority changed from Normal to Low
• Target version deleted (Tails_3.14)
• Type of work changed from Research to Code

Baseline = status quo: according to the doc, opening a document, “When you open a document that contains an unsigned macro, or a signed macro from an unknown source, the Security Warning dialog opens”. So it’s not too bad… except I don’t know what’s a “trusted source”.

It seems doable to disable executing macros by default in loaded documents:

• https://askubuntu.com/questions/1109513/how-to-disable-the-libreoffice-macro-feature-system-wide
• https://ask.libreoffice.org/en/question/168331/completely-disabling-macros/

Note, however, that this won’t forbid a user from writing & running their own macros, nor (presumably) from manually running existing macros if they wish so. I think that’s fine.

So I’m updating the scope of this ticket to implement that. I’m also dropping the target version (that seems not to be very meaningful here) and setting priority to Low, aka. we don’t feel committed to do this but it would be nice if someone did. Also setting Status = Confirmed, because AFAICT this is not WIP.

#11 Updated by Dr_Whax 2019-07-07 15:18:57

• Assignee deleted (Dr_Whax)

I’m no longer going to work on this.

#12 Updated by sajolida 2019-07-08 18:12:58

• Status changed from Confirmed to Rejected

As per intrigeri’s analysis from Bug #15307#note-10, I think we can reject this until we have someone else who really wants to work on it.