Bug 2369205 - RFE: ibus-engine-stt and ibus-setup-stt appear to be lacking selinux confinement
Summary: RFE: ibus-engine-stt and ibus-setup-stt appear to be lacking selinux confinement
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: ibus-speech-to-text
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Manish Tiwari
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-29 15:50 UTC by Gregory Lee Bartholomew
Modified: 2025-05-29 15:50 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Gregory Lee Bartholomew 2025-05-29 15:50:12 UTC
The ibus-speech-to-text package (https://src.fedoraproject.org/rpms/ibus-speech-to-text) claims to be an offline speech-to-text engine. However, at a glance I see some code in its repo that appears to be establishing online connections at runtime.

From https://github.com/Manish7093/IBus-Speech-To-Text/blob/main/engine/sttvoskmodelmanagers.py#L126 :
<snip>
    def _download_model_thread(self, download_link, destination, status):
        with urllib.request.urlopen(download_link) as response:
            length_str = response.getheader('content-length')
            blocksize = 4096
<snip>

IMHO, software that claims to work offline should not establish a network connection of any sort after the package is installed. I am also concerned about the possibility of private user data (this application has access to the user's microphone) being leaked to online services, possibly in future versions even if the current version does not leak such data.

Furthermore, I do not see any matches for the ibus-engine-stt or ibus-setup-stt binaries when searching the SELinux contexts.

$ grep -r 'ibus-\(engine\|setup\)-stt' /etc/selinux/targeted/contexts

I would like SELinux policies to be provided with the ibus-speech-to-text package and I would like those policies to deny any online connections at runtime.

I mentioned this concern in the change proposal that introduced the ibus-speech-to-text package:

https://discussion.fedoraproject.org/t/f42-change-proposal-ibus-speech-to-text-self-contained/143151/11

Reproducible: Didn't try


Note You need to log in before you can comment on or make changes to this bug.