Linux desktop sandboxing for dummies?

Johnnyloans

Thank you.

How did you do the collapsible details menu? I only know of the HTML method and failed to get it to work here.

pixelfairy

Johnnyloans Highlight the text. Then, on the bottom, click on the triangle with '!' icon. Its for spoilers. For the code formating, use the </> icon. Some or all discourse forums also let you use markdown. See https://daringfireball.net/projects/markdown/syntax

DeletedGravy

pixelfairy Thank you, this looks like a treasure trove of information, and I indeed have now gone and looked at their User Host Security Reports, but this is entirely terribly over my head. It appears Framework performs a lot better in this than System76, though I can't make heads or tails of the specific implications. I'm really not sure what to do with this, from here, and if I should just give up and switch to planning to order Framework, instead. I know people have made a stink about them not using coreboot.

pixelfairy

DeletedGravy I've been a happy customer of both. Usually I default to frame.work. System76 is good on right to repair, so if theres a model that fits you, go for it.

The closed source boot firmware in frameworks surprised and disappointed me too. Seems like they did the best they could with it. Unless you want reprogram that, and not just change settings, you probably want one thats more locked down and harder to infect. If you want to learn about boot firmware, you can play with qemu or get an ancient thinkpad. https://github.com/tianocore/tianocore.github.io/wiki/How-to-run-OVMF

DeletedGravy

pixelfairy Unless you want reprogram that, and not just change settings, you probably want one thats more locked down and harder to infect.

Are you calling System76 the more locked down one, here, or Framework?

pixelfairy

DeletedGravy Ironically, was referring to framework as the more locked down. The hot swap ports are cool too. I've worn out a usb on a laptop before. Being able to swap that out easily would have been nice. Now I use a hub while its home and wear out those ports instead.

The main drawback is how easily someone could make a malicious expansion card. You could dab some glitter nail polish on yours and use blink comparison. Should be done on any laptops screws anyway.

https://github.com/proninyaroslav/blink-comparison

userofgos

pixelfairy You could dab some glitter nail polish on yours and use blink comparison.

This made me chuckle at first cause I actually thought you were suggesting to blink your eyes and compare. After reading further, I get it now lol.

pixelfairy https://github.com/proninyaroslav/blink-comparison

Really fascinating project. Thanks for the reference.

jukebox626

Given that you sound like somebody who is a regular user who is just worried about privacy, I honestly wouldn't overthink this stuff. You already are on Linux, so your base line is way better than it would be if you were using Windows, especially in terms of privacy because apps available on Linux normally don't try and spy on you anyway.

A few things to keep in mind that won't send you down a rabbit hole:

Don't mess with your repos. Use the official ones from your distro, they are reasonably secure for a normal user. Plus, using third party repos can mess up your system, so be very cautious with that.
When you need an app not available from the official repos, have a look at the official website / github for the app, many offer a flatpak.
Speaking of flatpaks: This is a good way to get packages not available in the official repos and it will leave the apt package system clean, but there are a lot of unofficial ones and stuff that is not maintained well, so stay vigilant (but don't get too paranoid, honestly)
if you feel uncomfortable with a flatpak, use flatseal to check and adjust its permissions

I'm not saying that nothing can happen to you on Linux, obviously. But applying a reasonable balance between convenience and security / pricacy is not the same as being reckless and should be good enough for most users (myself included, so this is what I'm doing).

Blank

edginess518 QubesOs is the best operating system for security out there. Nonetheless I suppose it's what he seeks since this operating system is aimed for users who have some technical knowledge. Maybe he would be overwhelmed ?

DeletedGravy

__Blank__ I have no doubt that Qubes is the best Linux (Linux-ish?) option for security. I have to do a little bit of managing my own expectations and treading with caution and common sense, and I think common sense -- contextually, for me -- is going to dictate that I not bite off more than I can chew with something like Qubes. These are all really helpful notes from y'all, though, and it may well be that by going through something beginner-friendly like Pop, I end up making my way to Fedora and/or Qubes.

edginess518

__Blank__ this operating system is aimed for users who have some technical knowledge. Maybe he would be overwhelmed ?

I actually find it great for beginners since you can learn both Fedora and Debian while using and also Arch if you choose. Any time you break something it's also so easy to just delete your VM and start over instead of having to do a complete reinstall of your OS.

DeletedGravy I have no doubt that Qubes is the best Linux (Linux-ish?)

It's technically a Zen hypervisor that virtualises different Linux distributions or Windows.

Blank

DeletedGravy maybe you can give a try to Fedora Atomic desktop. Although these OS aren't made for security reasons. I figured out it might serve this purposes as well. Fedora atomic are made to have an unbreakable (not unhackable) system. Root files are in read only mode. You're supposed to install apps with flatpak or container (toolbox). You can still install apps at system based (by layering) but you can rollback whenever something goes wrong with your system.

Also when installing services with layering they won't start automatically (unless you enable it manually). So it might prevent some shaddy services running at boot from a package you have layered.

DeletedGravy

Ok, I'm an idiot who keeps digging, using a flimsy trowel, without knowing what kind of dirt I'm shoveling.

What's the story with Redox OS? Unix-like microkernel, not Linux, but works with Linux stuff? Supposedly some sort of connection to System76 or their personnel and works with the Cosmic desktop (as does an aforementioned Fedora Atomic __Blank__ ). Sounds like not quite ready for general use, but something to keep an eye on?

Elgoog

__Blank__ maybe you can give a try to Fedora Atomic desktop. Although these OS aren't made for security reasons.

secureblue is a Fedora atomic desktop designed explicitly for security:

secureblue is for those whose first priority is using Linux, and second priority is security.

pixelfairy

DeletedGravy Qubes-os has been my daily driver for years and I can't imagine going back to a monolithic desktop. But I still find myself working around rough edges and scripting through issues. Thats why I didn't also encourage you use it. After your used to the shell and how linux works, Qubes is great! Once your using it, you can stop thinking about linux distros. Your just using the apps and filesystems.

Whatever distro you start with doesn't matter much. I'd pick whatever is best supported by the laptop you get. Then you can try others in virtual machines and change at will. Even if you never touch qubes-os, its good to get good at virtualization. Its the best sandbox you'll get on linux.

And yes, Qubes is Linux-ish. It boots to xen, a bare metal hypervisor (virtualizer). The vm that controls the hypervisor runs fedora. All the support VMs that control the networks devices also run linux. It supports windows with qubes integration for running apps, but never tried it.

DeletedGravy

(I'm backing off my original aim quite a bit, since I probably just need to get the ball rolling before I can actually implement any of the good advice y'all and others have)

Blank

DeletedGravy i don't know this distribution. But generally I try to avoid any new that aren't been well established distribution as they might have annoying bug ect... But surely it's a project to keep an eye on and see how it evolves.

MuppetScalextric

pixelfairy Let me know how many independent security audits Qubes OS have had? Yeah Debian and Fedora might not neither but at least they are way more popular thus decreasing the risk.

I wouldn't trust Qubes. It is unnecessarily complicated. Just run Debian with Gnome Boxes VM if you need virtualization for peace of mind.

MuppetScalextric

Don't use anything aside from Debian or Fedora. It is a logistical cybersecurity NIGHTMARE to use a gaming distro, because all it adds is it downloaded Steam for you??? Why would you want to trust a bunch of extra people and wait extra long for security updates etc just for auto-download Steam!???

Don't use Flatpak or Firejail, they have many flaws, see flatkill and see how firejail runs on root thus if compromised makes it easier for an attacker. Just run virtualmachines in Gnome Boxes and you're good.

Remember to config Chrony for NTS time servers (Cloudflare, Netnod and PTB DE), dnscrypt-proxy Quad9 if you're not using a VPN, OpenSnitch firewall deny all incoming and boom you are pretty much good to go better than 99.9% of everyone in the whole world. :)

WAU3604

MuppetScalextric Don't use anything aside from Debian or Fedora. It is a logistical cybersecurity NIGHTMARE to use a gaming distro, because all it adds is it downloaded Steam for you???

I understand the use of Fedora here, but I don't necessarily understand why you say Debian when it's stable version consistently leaves packages behind in updates.

Also, I think it is a bit of a Strawman to boil down Gaming distros to "downloaded steam for you" as both CachyOS and Bazzite make optimizations to their kernels and other software for performance. Sure maybe you can say some gaming distros just download steam, and you be right some years ago even. But it is a bit of an oversimplification now, and heck Bazzite is based on Fedora.

Don't use Flatpak or Firejail, they have many flaws

I agree they have many flaws and firejail shouldn't be used, but I think not using flatpak at all can certainly be disputed. And if you use secureblue you can get a proper secure configuration of flatpak.

NoahRaketic

MuppetScalextric Don't use Flatpak or Firejail

Not using flatpak is worse than using it, even despite its flaws. Flatpak sandboxing is better than none at all, especially when configured with a tool like Flatseal.

MuppetScalextric pixelfairy Let me know how many independent security audits Qubes OS have had? Yeah Debian and Fedora might not neither but at least they are way more popular thus decreasing the risk.

I wouldn't trust Qubes. It is unnecessarily complicated. Just run Debian with Gnome Boxes VM if you need virtualization for peace of mind.

This hacked-together virtualization setup is guaranteed to be much less audited (most likely only by one user) and much less secure than Qubes OS is. Xen is very heavily audited, and Qubes OS has a proper development team behind it.

pixelfairy

MuppetScalextric You clearly never tried Qubes. Its really well thought out. The integration between VMs is the best I've seen in the compartmentalized desktop space.

And yes, I have rolled my own. Various combinations of packer, ansible, and bash scripts with vagrant for some projects over the years untill switching to qubes. Qubes is more streamlined and still has a smaller attack surface than any of my hacked together setups. It gets audited constantly, esp Xen. The mailing list regularly shows issues they've found, along with exploit, mitigation and fix. Security audits is what Invisible Things Lab, the company behind qubes, does.

« Previous Page Next Page »