3

I installed pdf-tools through MELPA, and then labels it as installed on a restart but kept viewing pdfs through doc-view. So using M-x pdf-tools-install it requested the sudo password in order to install :

    -*- mode: compilation; default-directory: "~/.emacs.d/elpa/pdf-tools-20190413.2018/build/server/" -*-
Comint started at Wed Apr 24 22:14:06

/home/xel/.emacs.d/elpa/pdf-tools-20190413.2018/build/server/autobuild -i /home/xel/.emacs.d/elpa/pdf-tools-20190413.2018/
---------------------------
    Installing packages    
---------------------------
apt-get install autoconf
              automake
              g++
              gcc
              libpng-dev
              libpoppler-dev
              libpoppler-glib-dev
              libpoppler-private-dev
              libz-dev
              make
              pkg-config
[sudo] password for usr1: 
Reading package lists... Done
Building dependency tree    

and then finalizes with the message:

===========================
   Build succeeded. :O)    
===========================

Comint finished at Wed Apr 24 22:16:38

1) Is this typical?

2)It was not expected that Emacs would ask for that level of access. Would this have been protected as a direct communication to the terminal?

3) regardless of this, DocView is still the default when opening a pdf file

4

The reason you were asked for your password was that apt-get install was being invoked to install the additional software (poppler and friends) needed by pdf-tools.

1) Is this typical?

No -- the vast majority of elisp packages do not attempt to automatically install other system requirements. It's not uncommon for other system software to be required by an elisp library, but pdf-tools is unusual in attempting to streamline the entire process from inside Emacs.

2) It was not expected that Emacs would ask for that level of access. Would this have been protected as a direct communication to the terminal?

Emacs itself wasn't asking directly; the install process was running a make command which included that sudo apt-get install command (which of course will prompt for a password). I would expect the password entry to have been as secure as it would be in any other such interaction with an external process in Emacs, but I don't have sufficient knowledge to make statements about these mechanisms.

3) regardless of this, DocView is still the default when opening a pdf file

That does seems unexpected. Have you tried restarting Emacs?

  • I did restart and nothing changed in having pdf-tools work. Is there reason to believe that malicious content is obtained or that some security hole is introduced? – Vass Apr 25 at 4:17
  • 1
    I wouldn't be alarmed. Certainly the apt-get install packages should be as secure as any other. You'd need to look at the pdf-tools build scripts to see what it's doing in detail. Did you add (pdf-tools-install) to your init file, per the instructions? – phils Apr 25 at 4:36
  • 1
    "To complete the installation process, you need to activate the package by putting (pdf-tools-install) somewhere in your [init file]. Alternatively, and if you care about start-up time, you may want to use (pdf-loader-install)" -- github.com/politza/pdf-tools#installing – phils Apr 25 at 4:41
  • thanks for the reassurance. I have (pdf-tools-install) and it does not change the loading tool when a pdf is selected to be seen in a buffer. I have looked at the various issues that could be causing the failure and tried solutions by copying other init.el contents with no luck. The security issue is my main concern – Vass Apr 25 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.