- 0 Posts
- 3 Comments
Hardening Linux is very hard IMO.
Privacy wise, if you use free software you should generally be fine, though look into either hardening Firefox’s settings (you can use something like arkenfox user.js) or use a fork which does this for you (Librewolf or Mullvad browser).
Sandboxing solutions available to regular users (as in usable after a sane amount of effort) have some major drawbacks (which means random programs, especially proprietary ones, aren’t as safe to run as on your phone):
- They all sandbox applications which were developed and designed assuming they will run unconfined (in contrast to something like Android, where apps assume they are in a sandbox). This leads to many problems, some of which are solved by portals.
- Flatpaks are often poorly sandboxed by default, and it can be hard/impossible to properly sandbox them (for example, if your Flatpak needs access to game controllers it will likely need access to all devices to work properly).
- Firejail has a large attack surface and is an SUID binary.
- Bubblewrap has a smaller attack surface and can also use unpriviliged user namespaces instead of being an SUID binary if supported by the kernel (though this has its own security implications), but it is very hard to use (it is used by Flatpak internally).
- I don’t know much about Snaps, but I doubt they’re better than Flatpaks in this regard.
An important part of Linux security is Mandatory Access Control (implemented by SELinux and AppArmor, for example). MAC is an additional permission mechanism that is checked after the usual Unix permissions (user, group based) grant access, and is used to confine processes, so if an attacker exploits them they will only be able to access a minimal amount of information. Most distros don’t configure a MAC, and it is extremely hard and time consuming to do so (though it’s relatively easy to confine specific “high risk” processes with AppArmor if your distro has basic support for it). Fedora has SELinux configured OOTB, and allows for simple further hardening by having predefined confined SELinux users you can assign to Linux users to limit what they can do. OpenSUSE has AppArmor configured and enabled by default though it is not a full system policy AFAIK (the init process runs unconfined), in contrast to SELinux (though Fedora runs many processes and users by default unconfined too). Both have good docs (though for Fedora look at RedHat’s docs for SELinux, it goes much more in depth). From my experience, it is much easier to configure AppArmor, but it would still require an extreme amount of work to do properly, so I’d recommend sticking with a distro that does that for you.
The situation is improving, just very slowly. Solutions are slowly being figured out to various usability issues created by sandboxing (for example, there has been discussion for a while regarding how to solve the game controller issue I mentioned), which will allow the more user-friendly solutions to be more hardened by default. Also, even though I have many issues with Flatpak, with a bit of configuration (even graphically with Flatseal) it can effectively sandbox many programs already, as long as you use Wayland.
On the MAC front, there is a 3rd party project (apparmor.d) that’s trying to build a portable set of AppArmor profiles for all common programs/environments on desktop Linux. As you might imagine this is a huge project and far from done, but it’s actually surprisingly complete already.