I am wondering if texlive-full is bearing any security issues? Why everybody does trust it? Are they checked by anybody?
Thanks for helping and educating me on this point :)
4 Answers
TeX Live consists of a relatively small number of executable items and a large number of 'other things', principally LaTeX packages, fonts and documentation (PDF files). The standard settings for the binary part of the set up are 'cautious' about potential security risks in the (La)TeX parts of the system, but these are likely to be more theoretical than actual. To the best of my knowledge there has not been an attempt to send to CTAN, and thus to TeX Live, a LaTeX package which deliberately tries to use \write18 to cause trouble. The number of people who would be affected is very small, and it's extremely unlikely that a self-replicating approach would be successful. The binary parts of the system are of course of more interest in this regard, but again there are not to my knowledge any actual issues (though see Is luatex as secure as pdftex? for discussion on the affect of Lua scripting on security).
All of that said, there is no-one checking each CTAN upload for security fixes, and the TeX Live team take most of their material more-or-less directly from CTAN. As such, if you are looking for some form of 'assurance' on the code then you will have to find a downstream group doing the work. That I know of, Ubuntu do not do this, although you might be better asking on an Ubunut-specific site about that. Perhaps other operating system teams (most obviously OpenBSD) might do such work if they are very security-focussed, but again that is more about those systems than about TeX.
answered Sep 23, 2013 at 13:43
-
Example for security issues found in a texlive component: rhn.redhat.com/errata/RHSA-2012-0137.html Nov 2, 2016 at 8:24
If you are paranoid enough, then you could download the complete source code, read it and the compile it yourself.
However, due to the fact, that most users are not computer scientists, we have to trust the developers of all software we use. In fact we have to trust the manufacturers of everything we do not build/program/make ourselves.
However, open source software provides you and the rest of the world with the source codes. So, the general idea is, that if there was any flaw in the software, it will be noticed and reported by somebody. With closed source software, there is no such thing.
-
Hello Dohn Joe, thank you for the reply. That is something I also do value on the open source software. What I doubt is that the texlive-full package for linux is used by enough users to disclose any bugs or malware? As I know many would just use the basic packages. Please correct me if I am wrong.– BarbaraSep 23, 2013 at 11:30
-
Who guarantees that there are no security risks in other big software packages? Nobody. However, I put more trust in software developed by the open source community than software made by big profit-hungry and user-data-hungry corporations. You can always go minimalist and install only the packages you really need. Then you avoid having packages on your machine that you don't ever use.– Dohn JoeSep 23, 2013 at 11:44
-
1@user37113 Do you even know what
texlive-fullis? It is a meta package, that just instructs Ubuntu (and similar) so install a long list oftexlive-packages. So asling whethertexlive-fullhas any malware does not make sense.– daleifSep 23, 2013 at 11:45 -
3As mentioned it is a meta package, it does not install anything on its own. It only instructs the system on which packages to install. You will have to check the packages that it lists, but on its own it does not install anything. Why down you just download the corresponding
.deband see for your self. I just did.– daleifSep 23, 2013 at 11:59 -
2@user37113 'Most people' is a tricky term. Like many other 'serious' TeX users, I install TeX Live using the version from TUG, which includes everything that is in
texlive-fullbut is more up to date. That probably applies to many other people active here, but that doesn't mean it's general for all TeX users. Most of the binaries are in a small number of packages: almost all of the TeX code is from CTAN, and that I know of there has not been a security-related dodgy uploaded in the time I've used TeX (~ 10 years).– Joseph Wright ♦Sep 23, 2013 at 12:07
note that everything in tex live comes from ctan, one way or another.
there have, in my time as a ctan manager, been two notifications of virus "detection" on ctan. the first, back in the '90s, complained about a file whose name matched some known virus at the time; its contents were of course, entirely harmless.
the second was more recent, but again proved a false alarm.
i have heard that at least some people run virus scanners over a copy of the ctan stuff; those people don't report any issues to us.
in my opinion, there is no more than a minuscule chance of problems with tex code from ctan, provided that you're careful with any use of \write 18 to get data from outside tex. i've never heard of any problem reports, even from that (admittedly dodgy) facility.
-
Dear wasteofspace, it really a good news. But can you please tell me if all the texlive packages (texlive-full in linux) is checked by ctan/tug before a new version is released?– BarbaraSep 23, 2013 at 18:34
-
@Barbara They are not, but even if they were, it wouldn't really matter since they are not signed. You could never be assured that what you are downloading is actually what was checked. Sep 23, 2013 at 19:56
-
@Barbara: These "packages" come from some other source than CTAN/TUG; typically an operating system vendor. Please contact these sources. Sep 24, 2013 at 8:58
I believe the vast majority of TeX Live is devoted to fonts and macro packages. These are passive files that do not do anything and cannot be "run" and are therefore safe. There are a small number of executable binary files (e.g., pdflatex) and scripts (latexdiff) that are intended to do things and therefore can pose security risks. From this question of mine, I believe the binaries are built from source by the TeX Live team. This means that there is the additional chance that a malicious CTAN contribution that requires compiling will be caught by the CTAN team. All bets are off for scripts on the other hand. You should be wary when running esoteric scripts and binaries.
For packages, it is possible that a LaTeX file could load a package such that when compiled by pdflatex that it acts as malware. Running a new version of pdflatex, where \openout is sandboxed, without shell-escape enabled should reduce these risks. Again, for esoteric packages, you should take a look at what it does.
answered Sep 23, 2013 at 13:14
-
Dear Daniel, do I understand correctly, that I can relly install the sudo apt-get texlive-full without any doubt (it is the 2009 version on Ubuntu 12.04 LTS). Just runnig a TeX-Document/Template can be dangerous?– BarbaraSep 23, 2013 at 13:23
-
I would be willing to go out on a limb and say that installing a signed version of the
texlivepackage is perfectly safe. Running any of the binaries or scripts, on the other hand, has the potential for bad things to happen. Sep 23, 2013 at 13:35
texlive-full. In many cases, Linux users will not be using the TL provided by their Linux, since it is not updated at a good enough pace. That being said, I'm not aware of any security problems. There was an article a few years ago. But those problems was mostly MikTeX related (fixed in a week) and the other issues are deemed academic.\write18to execute harmful code you can runtexwith-no-shell-escape\write18, and easily checked intexmf.cnffor the paranoid.