Your message dated Fri, 25 Dec 2020 14:34:26 +0000 with message-id <[email protected]> and subject line Bug#924516: fixed in geoclue-2.0 2.5.7-1 has caused the Debian Bug report #924516, regarding geoclue-2.0: geoclue gets location despite geolocation features turned off (GNOME Privacy) to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 924516: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924516 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: geoclue-2.0 Version: 2.5.2-1 Severity: normal Dear Maintainer, (Testing Debian 10 Buster) Using GNOME Settings > Privacy, turned off the geolocation features on the desktop; however geoclue still contacts location.services.mozilla.com in the background whenever an application requests location services. When geolocation features are turned off, I would expect this to not occur. I would expect no communications with location.services.mozilla.com to be occurring with this privacy setting. Steps to reproduce: 1) "Turn off the geolocation features of your desktop" (as per GNOME Help) GNOME Settings > Privacy > Location Services = Off # optional - verify from command line that location services are turned off: gsettings get org.gnome.system.location enabled # should return: false 2) Monitor geoclue packets using netfilter option A) using iptables iptables -A OUTPUT -m owner --gid-owner geoclue # Launch GNOME Maps (or other app utilizing geoclue, e.g. GNOME Calendar) iptables -nvxL OUTPUT #Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) # pkts bytes target prot opt in out source destination # 13 1697 all -- * * 0.0.0.0/0 0.0.0.0/0 owner GID match 116 option B) using nftables (alternative) nft add table inet geoclue nft "add chain inet geoclue geoclue { type filter hook output priority 0; }" nft add rule inet geoclue geoclue skuid geoclue counter # Launch GNOME Maps (or other app utilizing geoclue, e.g. GNOME Calendar) nft list ruleset #table inet geoclue { # chain geoclue { # type filter hook output priority 0; policy accept; # skuid "geoclue" counter packets 13 bytes 1697 # } #} ...geoclue is communicating with location.services.mozilla.com when it should not. Work around is to disable and mask geoclue.service. Thank you! -- System Information: Debian Release: buster/sid APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-2-amd64 (SMP w/4 CPU cores) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages geoclue-2.0 depends on: ii adduser 3.118 ii libavahi-client3 0.7-4+b1 ii libavahi-common3 0.7-4+b1 ii libavahi-glib1 0.7-4+b1 ii libc6 2.28-8 ii libglib2.0-0 2.58.3-1 ii libjson-glib-1.0-0 1.4.4-2 ii libmm-glib0 1.10.0-1 ii libnotify4 0.7.7-4 ii libsoup2.4-1 2.64.2-2 Versions of packages geoclue-2.0 recommends: ii avahi-daemon 0.7-4+b1 ii iio-sensor-proxy 2.4-2 ii modemmanager 1.10.0-1 ii wpasupplicant 2:2.7+git20190128+0c1e29f-2 geoclue-2.0 suggests no packages. -- no debconf information
--- End Message ---
--- Begin Message ---Source: geoclue-2.0 Source-Version: 2.5.7-1 Done: Laurent Bigonville <[email protected]> We believe that the bug you reported is fixed in the latest version of geoclue-2.0, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Laurent Bigonville <[email protected]> (supplier of updated geoclue-2.0 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Fri, 25 Dec 2020 14:59:35 +0100 Source: geoclue-2.0 Architecture: source Version: 2.5.7-1 Distribution: unstable Urgency: medium Maintainer: Laurent Bigonville <[email protected]> Changed-By: Laurent Bigonville <[email protected]> Closes: 924516 958497 Changes: geoclue-2.0 (2.5.7-1) unstable; urgency=medium . [ Laurent Bigonville ] * New upstream version 2.5.7 - Check the maximum allowed accuracy level even for system applications. Respect the value of the user preference concerning the usage of their geolocation. This should fix the privacy and GDPR conformity concerns as the user explicitly needs to enable the option. Note that there is no distinction between the system applications anymore, turning on the option is allowing them all to get the location. (Closes: #924516, #958497) * debian/README.Debian: Add information about MLS and a link to the service Privacy Notice page * Add debian/salsa-ci.yml file * debian/control: Remove Craig Andrews from the Uploaders. He has not been active since 2009, thanks for his previous work on the package * d/p/: Add a patch to make the Mozilla API key configurable * debian/rules: Use the key that has been allocated to debian for MLS queries * d/gbp.conf: Stop adding the commit-id and set multimaint-merge to True * debian/control: Bump Standards-Version to 4.5.1 (no further changes) * d/p: Add an upstream patch to fix the display of the usage indicator * d/p: Remove the remaining differences between system app and flatpak ones. This fix an issue when geoclue is D-Bus activated by a client and also make sure that a running client is disconnected when the user disables the location services (set the accuracy to 0) . [ Chris McGee ] * debian/control: Add rules requires root . [ Debian Janitor ] * Refer to specific version of license LGPL-2+. * Apply multi-arch hints. + geoclue-doc, libgeoclue-doc: Add Multi-Arch: foreign. Checksums-Sha1: c06f08da2d6cda9428924a67213f0446c4b3daf3 2386 geoclue-2.0_2.5.7-1.dsc 28fec44b0583208a8654296ab39d45f2ab71d318 85764 geoclue-2.0_2.5.7.orig.tar.bz2 a47ac7a0aac0a8f4d365c01bcfdc6e03363f0551 14728 geoclue-2.0_2.5.7-1.debian.tar.xz 8f02df82c85bc4eaa47fe2a4e6f74a0abcacf1ad 9628 geoclue-2.0_2.5.7-1_source.buildinfo Checksums-Sha256: 4732880369a39290c13bfaea09b911e20a54da577f9f31e227c5601ccea6ec08 2386 geoclue-2.0_2.5.7-1.dsc 6cc7dbe4177b4e7f3532f7fe42262049789a3cd6c55afe60a3564d7394119c27 85764 geoclue-2.0_2.5.7.orig.tar.bz2 d0aa565d68d06fd1bb14e6510d160952a05786aff0887a7385e151b13088f522 14728 geoclue-2.0_2.5.7-1.debian.tar.xz 018daa80e6f25d97bb66e71fd0df5a505c8470bea904c7d47f0872b0bcb7ce8d 9628 geoclue-2.0_2.5.7-1_source.buildinfo Files: bf2d8417d044bcbbd59d09a3ef236841 2386 utils optional geoclue-2.0_2.5.7-1.dsc f6e731a21d458168eda613816797eb73 85764 utils optional geoclue-2.0_2.5.7.orig.tar.bz2 2b7d1ac16433a449588d8e5e630cc48a 14728 utils optional geoclue-2.0_2.5.7-1.debian.tar.xz 0e1a49107e01323d6daa9e7ce0c76153 9628 utils optional geoclue-2.0_2.5.7-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQFFBAEBCAAvFiEEmRrdqQAhuF2x31DwH8WJHrqwQ9UFAl/l8bIRHGJpZ29uQGRl Ymlhbi5vcmcACgkQH8WJHrqwQ9XPsAgApaYCc6eiprGM9l/nCpfPmw/b8lvsN+lV 6bGDz7uppeNCdn5yDLXhy6trkw1KaHNt6IutOAeCvoY+F2TvBUhkNw+9B8O0B1WG kEsizhJMaiYHAe10bdDkxPmCvU9Pt1ETJ1qwYrppVtPcWnFDbHT3uygZxPUtYHAV JmKGT2VXiBHjCMigLGybBm8YoqHScg8rVEfr+ajHbmzZ9s2zk0g0EzWphXVIiKn2 27o59Ixh4CbfAsbNATL681qIJF+pu2o/AcPq6kC8OrB2sor9UIktk5nuSmRgd0dt +WmQfLX66j2nY07BlXQmjSqAsNTIxmq3crl1LJ/NG2kKXOIqFzvewQ== =89+P -----END PGP SIGNATURE-----
--- End Message ---
