Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable Tracker (the GNOME desktop search provider) by default #8372

Closed
DemiMarie opened this issue Jul 28, 2023 · 3 comments
Closed

Disable Tracker (the GNOME desktop search provider) by default #8372

DemiMarie opened this issue Jul 28, 2023 · 3 comments
Assignees
@DemiMarie
Labels
C: templates P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. T: enhancement Type: enhancement. A new feature that does not yet exist or improvement of existing functionality.
Milestone
Release 4.2

Comments

@DemiMarie
Copy link

How to file a helpful issue

The problem you're addressing (if any)

Tracker has significant attack surface: Thunderbird downloads untrusted email attachments to ~/Downloads, which then get parsed by Tracker. If there is an RCE in Tracker, this could be exploited even if the user would have only viewed the file in a disposable VM. Furthermore, Tracker used 61.8MB of RAM in one of my disposable VMs even though it was doing nothing useful.

The solution you'd like

Tracker should be disabled by default, and controlled via qvm-service.

The value to a user, and who that user might be

All users will benefit from less attack surface and lower memory requirements.

Related to #7028.
@DemiMarie DemiMarie added T: enhancement Type: enhancement. A new feature that does not yet exist or improvement of existing functionality. P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. labels Jul 28, 2023
@DemiMarie DemiMarie added this to the Release 4.2 milestone Jul 28, 2023
@DemiMarie DemiMarie self-assigned this Jul 28, 2023
@jamke
Copy link

jamke commented Jul 31, 2023

What is Tracker? It is not obvious from the issue. Is it part of the Gnome or Fedora?

@DemiMarie
Copy link
Author

@jamke Tracker is the GNOME desktop search provider. It’s used primarily by GNOME applications.

@jamke
Copy link

jamke commented Jul 31, 2023

I see, thank you. I am not using GNOME stuff, and manually create KDE-based templates from fedora-minimal for years, so I have never heard about Tracker. Was afraid it is something from future Fedora versions.

@andrewdavidwong andrewdavidwong changed the title Disable Tracker by default Disable Tracker (the GNOME desktop search provider) by default Aug 1, 2023
@andrewdavidwong andrewdavidwong modified the milestones: Release 4.2, Release TBD Aug 1, 2023
DemiMarie added a commit to DemiMarie/qubes-core-agent-linux that referenced this issue Aug 1, 2023
@DemiMarie
Disable Tracker (GNOME desktop search) by default
4432f4a 
Tracker has several problems that make it ill-suited to Qubes OS:

- It parses untrusted email attachments downloaded to ~/Downloads, as
  well as the contents of several other directories.  The parsing code
  is written in C and so may have memory corruption vulnerabilities.  A
  remote code execution flaw in Tracker could be exploited by a
  malicious email attachment, even if the user would have only ever
  opened that attachment in a disposable VM.

- It uses a nontrivial amount of memory (61.8MB in one test).  This is
  significant when multiplied by the number of qubes running at a time.

- Tracker is normally used by GNOME Shell, GNOME Photos, and other GNOME
  applications, but (to the best of my knowledge) no application that
  uses Tracker is frequently used in Qubes OS.  This is very different
  from a default Fedora install, where Tracker provides desktop search
  in GNOME Shell and therefore provides a much larger benefit to the
  user.

For these reasons, disable Tracker by default.  It can be re-enabled via

$ qvm-service VMNAME enable tracker

where VMNAME is the name of the qube in which Tracker should run.

Fixes: QubesOS/qubes-issues#8372
DemiMarie added a commit to DemiMarie/qubes-core-agent-linux that referenced this issue Aug 2, 2023
@DemiMarie
Disable Tracker (GNOME desktop search) by default
3e5358d 
Tracker has several problems that make it ill-suited to Qubes OS:

- It parses untrusted email attachments downloaded to ~/Downloads, as
  well as the contents of several other directories.  The parsing code
  is written in C and so may have memory corruption vulnerabilities.  A
  remote code execution flaw in Tracker could be exploited by a
  malicious email attachment, even if the user would have only ever
  opened that attachment in a disposable VM.

- It uses a nontrivial amount of memory (61.8MB in one test).  This is
  significant when multiplied by the number of qubes running at a time.

- Tracker is normally used by GNOME Shell, GNOME Photos, and other GNOME
  applications, but (to the best of my knowledge) no application that
  uses Tracker is frequently used in Qubes OS.  This is very different
  from a default Fedora install, where Tracker provides desktop search
  in GNOME Shell and therefore provides a much larger benefit to the
  user.

For these reasons, disable Tracker by default.  It can be re-enabled via

$ qvm-service VMNAME enable tracker

where VMNAME is the name of the qube in which Tracker should run.

Fixes: QubesOS/qubes-issues#8372
DemiMarie added a commit to DemiMarie/qubes-core-agent-linux that referenced this issue Aug 2, 2023
@DemiMarie
Disable Tracker (GNOME desktop search) by default
92e5dac 
Tracker has several problems that make it ill-suited to Qubes OS:

- It parses untrusted email attachments downloaded to ~/Downloads, as
  well as the contents of several other directories.  The parsing code
  is written in C and so may have memory corruption vulnerabilities.  A
  remote code execution flaw in Tracker could be exploited by a
  malicious email attachment, even if the user would have only ever
  opened that attachment in a disposable VM.

- It uses a nontrivial amount of memory (61.8MB in one test).  This is
  significant when multiplied by the number of qubes running at a time.

- Tracker is normally used by GNOME Shell, GNOME Photos, and other GNOME
  applications, but (to the best of my knowledge) no application that
  uses Tracker is frequently used in Qubes OS.  This is very different
  from a default Fedora install, where Tracker provides desktop search
  in GNOME Shell and therefore provides a much larger benefit to the
  user.

For these reasons, disable Tracker by default.  It can be re-enabled via

$ qvm-service VMNAME enable tracker

where VMNAME is the name of the qube in which Tracker should run.

Fixes: QubesOS/qubes-issues#8372
@jamke jamke mentioned this issue Aug 7, 2023
Closed
@qubesos-bot qubesos-bot mentioned this issue Aug 7, 2023
Closed
marmarek added a commit to marmarek/qubes-core-agent-linux that referenced this issue Aug 8, 2023
@marmarek
Do not disable tracker and evolution-data-server in AppVMs
a02cdd9 
Contrary to initial tests, disbling those do break some applications.
So, do not disable them by default in AppVMs.
But keep them disabled in system vms, as user applications are not
expected there.

QubesOS/qubes-issues#8372
@marmarek marmarek mentioned this issue Aug 8, 2023
Merged
@andrewdavidwong andrewdavidwong modified the milestones: Release TBD, Release 4.2 Aug 8, 2023
Closed
@qubesos-bot qubesos-bot mentioned this issue Sep 10, 2023
Closed
@legoktm legoktm mentioned this issue Jul 25, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@DemiMarie DemiMarie

Labels
C: templates P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. T: enhancement Type: enhancement. A new feature that does not yet exist or improvement of existing functionality.
Projects
None yet
Milestone
Release 4.2
Development

No branches or pull requests
3 participants
@DemiMarie @andrewdavidwong @jamke