6

I'm thinking of a program which would scan packages and report some statistics about them - and report all packages that contain non-free software.

It would of course have to include kernel modules, drivers and other binary blobs that are often allowed in distributions. The wider the scope of the search - the better.

I'd like this functionality on Fedora, but something that works on most distributions would be preferred.

jcora
  • 3,874
  • 7
  • 34
  • 52
  • @jofel gNewsense seems to be an Ubuntu based distribution. Is that what you meant? – terdon Jul 16 '13 at 11:34
  • I don't want to restrict myself over installing any software, I'm just curious. – jcora Jul 16 '13 at 11:49
  • 3
    For Debian, there is [Virtual Richard M. Stallman](http://en.wikipedia.org/wiki/Vrms). If you want to have a strictly free (in sense of FSF) distribution, you can have a look at [gNewsense](http://www.gnewsense.org/). – jofel Jul 16 '13 at 11:51
  • @terdon Thanks, this was clearly a mistake. I added a fixed comment. – jofel Jul 16 '13 at 11:52
  • 2
    Keep in mind that it is not possible to distinguish a binary compiled from a non-free source from one which isn't, so there can't be any *direct* way of detecting such a thing. You would need something that blacklists and whitelists binaries by name (it looks like that is how the "Virtual RMS" thing works). – goldilocks Jul 16 '13 at 14:06
  • Yeah, I'm aware that it couldn't be 100% accurate, if I download random binaries from the net e.g. (I downloaded Catalyst once, for example, and installed it, to get better GPU performance). – jcora Jul 16 '13 at 14:13
  • According to some people at FedoraForums, the firmware package names all contain `-firmware`, which should make them much easier to check for. – goldilocks Jul 16 '13 at 19:48

2 Answers2

3

This is sort of indirect answer, because I don't see why you would have non-free software on the system and not know about it. This is not to say you are wrong to want to check, but maybe first you want to stop and think if you really need to.

I'd like this functionality on Fedora

Fedora repositories are divided into 'free' and 'non-free'. By default, only the free repositories are used. So if you have never added any other repositories, then yum cannot have installed anything from them.

It would of course have to include kernel modules, drivers and other binary blobs that are often allowed in distributions.

See this page. The only exception fedora makes is for "binary firmware", which is not required unless you are using certain hardware. I think you would know that too, but I can't promise.

I believe "firmware" technically is installed to a device, and technically it's already there anyway. Eg., your BIOS runs non-free software. On that level there is nothing you can do. You can also read fedora's discussion of "binary firmware" via the link on that page.

The kernel itself can't contain non-free code, it can only end up in a module. If you download the source from kernel.org and compile your own, I do not think it contains anything of that sort, since Linus's attitude ("I kind of accept them, but I never support them and I don't like them") implies non-free modules are allowed to be used with the kernel but very unlikely to be distributed by Linux proper (that is, kernel.org). The proprietary drivers are independently distributed; distros then include them, not kernel.org (however, according to that "Forbidden Items" page, fedora explicitly does not include proprietary drivers, at least in the default 'free' repos).

You could investigate online all the stuff listed by lsmod. Since any binary blob has to be a module, methinks that's where you'll find it.

Fedora recommends that if you want to build your own kernel, you use a source package from them. However, I've used hand rolled kernels from vanilla kernel.org sources on fedora for years and never had a problem. So if you are comfortable doing that and don't use non-free repositories, you should not have any non-free stuff installed.

goldilocks
  • 86,451
  • 30
  • 200
  • 258
  • Reading this line: "If it is proprietary, it cannot be included in Fedora. (Binary firmware is the only exception to this)" made me curious. Also, sometimes I enable non-free repositories for some programs/drivers, and when I have something installed for over a year, I don't know whether something could've been pulled as a dependency from non-free or installed by me on accident. I'd just like to *check* it, that's all. Also, I'm also familiar with that "firmware = on-device software, not drivers" definition, but I definitely need more information about that. – jcora Jul 16 '13 at 13:42
  • 2
    @Yannbane It would be nice if they had an explicit, maintained list of the "binary firmware" that is included. I imagine if you ask the right person nicely, they might have an answer -- to that end I started a thread here: http://www.forums.fedoraforum.org/showthread.php?p=1660611#post1660611 Reading that "Forbidden Items" page further, it is explicit that Fedora does not include proprietary kernel modules (unless, I guess, if you've gotten them from a non-free repo). – goldilocks Jul 16 '13 at 13:58
  • Still, it'd be great to have a way to make sure. The default installation might not include non-free software - but it might end up there, and even if it's unlikely, I'd still appreciate just making sure. – jcora Jul 16 '13 at 14:00
2

Regardless Kernels And Modules

Package Sorting :

This is tested under Mageia/Redhat etc like systems

1. Get all used licenses from all your packages. 

rpm -qia | grep "License" | sort

2. Find out what license does not match your needs

3. Find out what package are using the problematic license

rpm -qia | grep ": Problematic License" -A 15 -B 20

Notes :

vrms (for debian) and other similar tools are nice in theory, but when it come down to reality they are useless, you have to check everything yourself if you are security/privacy professional

Note 2 :

Now days it's very hard to get a full open system, respecting privacy etc. but still it's always possible, you will need :

  • A machine with opensource bios *

  • Get a nice distro like mageia or so

  • Check all the packages and modules

  • Compile your own kernel

Note * machine with open source bios does not exist for mass market, but still thanks god we still could run an open source bios on compatible mass market machines by flashing the native bios.

One last remaining issue is the closed sources microcodes programmed on the machine chips we can not do a lot about it since only big commercial company are manufacturing the hardwares, we could may be check their functioning on the flow with some software solution (not an easy task).

This related kernel tools could interest you

http://tomoyo.osdn.jp/

http://akari.osdn.jp/

intika
  • 13,920
  • 7
  • 41
  • 79