Package: gnome
Version: 1:3.30+1
Severity: serious
Tags: security
Justification: 5

Dear Maintainer,

It became apparent that despite explicit settings of gnome desktop environment 
"Settings -> All Settings -> Privacy -> Location Services" set to "OFF", 
package 'geoclue-2.0' along with packages depending on it, such as 
'gnome-clocks' ignore settings and continue to send requests via networking 
stack to identify hosts geographical location. 

Could some one from Debian security team review this bug and hopefully provide 
a work around to stop gnome desktop environment along with packages 
'gnome-clocks' & 'geoclue-2.0' from contacting remote services over the 
network, tracing the hosts geo-location?

Any help to stop geo-location tracing/checking/calculating/guestimating - would 
be greatly appreciated.

PS: Debian Dev Team, please note, nether package 'gnome-clocks' or 
'geoclue-2.0' have NO man pages available, and therefore there is no way for a 
user of the host to find out how to disable geo-tracing functionality.

Per Debian regulations:

... Section 5(o) - 'Packages must have a useful extended description.' there 
should be some sort of a documentation that would informed a user of the host 
what options are available to modify unwanted, and this case, privacy related 
behavior to be changes or stopped.

At the same time, while explicit settings for privacy gui element of a GNOME 
environment exist, they appear to be meaningless in terms geo location tracing 
of the host.


-- System Information:
Debian Release: 10.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-5-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages gnome depends on:
ii  avahi-daemon                     0.7-4+b1
ii  cheese                           3.31.90-1
ii  cups-pk-helper                   0.2.6-1+b1
ii  desktop-base                     10.0.2
ii  evolution                        3.30.5-1.1
ii  evolution-plugins                3.30.5-1.1
ii  file-roller                      3.30.1-2
ii  gedit-plugins                    3.30.1-3
ii  gnome-calendar                   3.30.1-2
ii  gnome-clocks                     3.30.1-2
ii  gnome-color-manager              3.30.0-2
ii  gnome-core                       1:3.30+1
ii  gnome-documents                  3.31.92-1
ii  gnome-getting-started-docs       3.30.0-1
ii  gnome-maps                       3.30.3-1
ii  gnome-music                      3.30.2-1
ii  gnome-screenshot                 3.30.0-2
ii  gnome-sound-recorder             3.28.2-1
ii  gnome-todo                       3.28.1-2
ii  gnome-tweaks                     3.30.2-1
ii  gnome-weather                    3.26.0-5
ii  gstreamer1.0-libav     
ii  gstreamer1.0-plugins-ugly        1.14.4-1
ii  libgsf-bin                       1.14.45-1
ii  libproxy1-plugin-networkmanager  0.4.15-5
ii  libreoffice-calc                 1:6.1.5-3
ii  libreoffice-gnome                1:6.1.5-3
ii  libreoffice-impress              1:6.1.5-3
ii  libreoffice-writer               1:6.1.5-3
ii  nautilus-sendto                  3.8.6-3
ii  network-manager-gnome            1.8.20-1.1
ii  orca                             3.30.1-1
ii  rhythmbox                        3.4.3-2
ii  rhythmbox-plugin-cdrecorder      3.4.3-2
ii  rhythmbox-plugins                3.4.3-2
ii  rygel-playbin                    0.36.2-4
ii  rygel-tracker                    0.36.2-4
ii  seahorse               
ii  shotwell                         0.30.1-1
ii  simple-scan            
ii  totem-plugins                    3.30.0-4
ii  vinagre                          3.22.0-6
ii  vino                             3.22.0-5
ii  xdg-user-dirs-gtk                0.10-3

Versions of packages gnome recommends:
ii  gnome-games                 1:3.30+1
ii  nautilus-extension-brasero  3.12.2-5
ii  transmission-gtk            2.94-2

Versions of packages gnome suggests:
pn  alacarte                                 <none>
pn  empathy                                  <none>
pn  firefox-esr-l10n-all | firefox-l10n-all  <none>
pn  gnome-remote-desktop                     <none>
pn  goobox | sound-juicer                    <none>
pn  polari                                   <none>
pn  webext-ublock-origin                     <none>

Versions of packages gnome-core depends on:
ii  adwaita-icon-theme            3.30.1-1
ii  at-spi2-core                  2.30.0-7
ii  baobab                        3.30.0-2
ii  caribou                       0.4.21-7
ii  dconf-cli                     0.30.1-2
ii  dconf-gsettings-backend       0.30.1-2
ii  eog                           3.28.4-2+b1
ii  evince                        3.30.2-3
ii  evolution-data-server         3.30.5-1
ii  firefox-esr                   60.7.2esr-1
ii  fonts-cantarell               0.111-2
ii  gdm3                          3.30.2-3
ii  gedit                         3.30.2-2
ii  gkbd-capplet                  3.26.1-1
ii  glib-networking               2.58.0-2
ii  gnome-backgrounds             3.30.0-1
ii  gnome-bluetooth               3.28.2-3
ii  gnome-calculator              3.30.1-2
ii  gnome-characters              3.30.0-2
ii  gnome-contacts                3.30.2-1
ii  gnome-control-center          1:3.30.3-1
ii  gnome-disk-utility            3.30.2-3
ii  gnome-font-viewer             3.30.0-2
ii  gnome-keyring                 3.28.2-5
ii  gnome-logs                    3.30.0-2
ii  gnome-menus                   3.31.4-3
ii  gnome-online-accounts         3.30.1-2
ii  gnome-online-miners           3.30.0-2
ii  gnome-session                 3.30.1-2
ii  gnome-settings-daemon         3.30.2-3
ii  gnome-shell                   3.30.2-9
ii  gnome-shell-extensions        3.30.1-1
ii  gnome-software                3.30.6-5
ii  gnome-sushi                   3.30.0-2
ii  gnome-system-monitor          3.30.0-2
ii  gnome-terminal                3.30.2-2
ii  gnome-themes-extra            3.28-1
ii  gnome-user-docs               3.30.2-1
ii  gnome-user-share              3.28.0-2
ii  gsettings-desktop-schemas     3.28.1-1
ii  gstreamer1.0-packagekit       1.1.12-5
ii  gstreamer1.0-plugins-base     1.14.4-2
ii  gstreamer1.0-plugins-good     1.14.4-1
ii  gstreamer1.0-pulseaudio       1.14.4-1
ii  gvfs-backends                 1.38.1-5
ii  gvfs-fuse                     1.38.1-5
ii  libatk-adaptor                2.30.0-5
ii  libcanberra-pulse             0.30-7
ii  libglib2.0-bin                2.58.3-2
ii  libpam-gnome-keyring          3.28.2-5
ii  libproxy1-plugin-gsettings    0.4.15-5
ii  libproxy1-plugin-webkit       0.4.15-5
ii  nautilus                      3.30.5-2
ii  pulseaudio                    12.2-4
ii  pulseaudio-module-bluetooth   12.2-4
ii  sound-theme-freedesktop       0.8-2
ii  system-config-printer-common  1.5.11-4
ii  system-config-printer-udev    1.5.11-4
ii  totem                         3.30.0-4
ii  tracker                       2.1.8-2
ii  yelp                          3.31.90-1
ii  zenity                        3.30.0-2

Versions of packages gnome-core recommends:
ii  libproxy1-plugin-networkmanager  0.4.15-5
ii  network-manager-gnome            1.8.20-1.1

gnome-core suggests no packages.

-- no debconf information

Reply via email to