Is loading wl driver for macbook wifi at start up safe on Tails OS?

Question

I managed to install wl driver on Tails OS and wanted to make it load at boot automatically.

To achieve that, I configured the persistent volume to save APT PACKAGES and APT LISTS. Then I edited the file /live/persistence/TailsData_unlocked/live-additional-software.conf to include those packages (don't know if they are all needed I just took the packages installed when running apt-get install linux-headers-$(uname -r|sed 's,[^-]*-[^-]*-,,'):

cpp-4.8
gcc-4.8
gcc-4.8-base
libasan0
libgcc-4.8-dev
linux-compiler-gcc-4.8-x86
linux-headers-3.16.0-4-amd64
linux headers-3.16.0-4-common
linux-headers-amd64
linux-kbuild-3.16
broadcom-sta-dkms

So when I start Tails OS with persistent volume ON AND spoofed mac address disabled I can use the macbook wifi. But wl module has to be loaded with modprobe manually which means I need to enable sudo when booting Tails.

Is this a safe practice in regard to privacy and security ?

Does the wl driver in itself can compromise Tails security and privacy ?

Answer 1

"It's complicated" - The real answer to all infosec question.

First of all, having root acccess for every single boot of tails is probably something you should avoid. A root compromise can do some really ugly things, like taint your tails install forever. Having a path for the amnesia user to become root is something that you should definitely try to avoid.

The extra installed packages is a fingerprint but anyone who was in a position to find out what packages you have installed could do worse things, the main issue is the root/sudo access.

There is a reddit thread with a similar looking issue with no definite solution listed.

Unfortunately the best solution may be to use a linux-compatible USB wireless device instead of builtin wireless card as it seems to be explicitly recommended against by Tails to perform the steps you are. Such is the cost of broadcom's so-called intellectual property.