1

Do PDF files have the ability to ping a remote server such that the remote server will know that I opened the PDF file? If so, how do I stop that? I am using the Evince PDF reader on my computer that is running the Ubuntu operating system. I am concerned about the privacy implications if PDF files are able to contact other computers.

3

1 Answer 1

2

Yes. It's possible for a pdf to link to resources on the internet or include javascript that would interact with a remote server.

It's possible that Evince doesn't support such "features", though.

The easiest solution would be to confine evince so that it is unable to talk to other servers.

For example you can use firejail --noprofile --net=none evince to run evince with no access to the network. However, doing this every time is prone to error.

A better solution would be to do that using apparmor.¹ The evince package in Ubuntu² comes with an AppArmor profile for evince. However, it allows network connections:

  # TCP/UDP network access for NFS
  network inet  stream,
  network inet6 stream,
  network inet  dgram,
  network inet6 dgram,

You can undo that by creating a /etc/apparmor.d/local/usr.bin.evince file containing:

  deny network inet  stream,
  deny network inet6 stream,
  deny network inet  dgram,
  deny network inet6 dgram,

and reloading the profile. Easiest way is to do sudo systemctl reload apparmor.service which will reload all profiles. Afterwards, the next time you open evince it should have no access to the network.

¹ You probably have AppArmor enabled already, check with apparmor_status

² evince 42.1-3 in jammy (22.04LTS)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .