Advanced Plus Security Linux Mint Cinnamon Wayland setup

Last updated
Sep 14, 2026
How it's used?
For work or educational use
Operating system
Linux
Other operating system
Linux Mint 22.3 Zena Cinnamon Wayland
On-device encryption
Other full-disk drive encryption software
Log-in security
    • Biometrics (Windows Hello PIN, TouchID, Face, Iris, Fingerprint)
Security updates
Allow security updates and latest features
Update channels
Allow stable updates only
User Access Control
N/A - Linux / Mac / Other operating system
Smart App Control
N/A - Linux / Mac / Other operating system
Network firewall
Enabled
About WiFi router
TP-Link triband with IPv6 disabled, We use the three WIFI-networks seperately. The 2.4 Ghz is used for IoT-devices and guest (SPI-, NAT, ARP-filtering and intrusion detection enabled). The two 5 Ghz networks are for my wife and I (each uses his/her own) with additionally IP-MAC binding and MAC filtering enabled. I have set the e-mail log message level to critical events (acting as a rudimentary NIDS). The 5Ghz network has eternal lease time while 2.4 Ghz has short lease time (8 hours) and network partitioning enabled.
Real-time security
Non root user using build-in Linux sandboxing (AppArmor, Firejail, Flatpak) as extra protection layer.
Firewall security
Built-in Firewall for Mac/Linux
About custom security
  • Using only official package sources from verified publishers and de-installed all unused accessoires and applications.
  • Installed fapolicyd denying normal users to execute something which does not come from above repositories
  • Mildly hardened Linux by disabling P2P, remote access, old TLS versions and enabling ASLR system wide.
  • Created additional Firejail profiles with firecfg and reduced Flatpak permissions with flatseal.
  • Added OpenSnitch outbound application firewall to compliment inbound GuFW.
  • Installed logcheck with e-mail warning for security alerts & events
  • Using Wayland (experimental) on Cinnamon desktop.
Periodic malware scanners
When I receive files from others I scan them with Virus Total. My half yearly data backups to external USB are scanned with Microsoft Defender :cool:
Malware sample testing
I do not participate in malware testing
Environment for malware testing
None
Browser(s) and extensions
Brave-Origin policies and site-pernissions with Brave adShield enabled
on aggressive, but disabled all filters (and in flags the cosmetic, procedural and CSP filtering, so only network/DNR rules apply)
Secure DNS
  1. NextDNS in the Router with OISD and telemetry blocklists enabled (for IOT devices), allowing only common TopLevelDomains to connect.
  2. We use Quad9 as default DNS (at OS-level and DoH) for our Laptops and smartphones
  3. Cloudflare Zero Trust Free with account as DOH in the browser.
Desktop VPN
Proton VPN free for Linux on-demand (out of home). At home I have little use for VPN because our IP and IP location are changed regularly :-).
Password manager
Build-in (OS and Browser)
Maintenance tools
None
File and Photo backup
  • FreeFileSync quick on-demand backups to a partition on my internal SSD to which sandboxed utilities, desktop accessoires and applications have no access to.
  • The half yearly full backup saves to an external USB-SSD which is checked (afterwards) by Microsoft Defender on my wife's laptop (which has triple USB protection).
Subscriptions
    • None
System recovery
TimeShift (to another partition on 1 TB SSD)
Risk factors
    • Browsing to popular websites
    • Working from home
    • Making audio/video calls
    • Opening email attachments
    • Logging into my bank account
    • Streaming audio/video content from trusted sites or paid subscriptions
    • Coding and development
Computer specs
AMD Ryzen 7 (5700U) laptop with 1 TB SSD and 16GB RAM
Notable changes
To many :)

After jumping back and forth, I finally decided for:
  • Changed from ControlD free to Cloudflare free ZT
  • Replaced 7-zip (unsandboxed) with PeaZip in Flatpak
  • Moved from LibreOffice in Flatpak to LibreOffice in Firejail
  • Moved from Thunderbird to Evolution (both in Flatpak sandbox)
  • Moved from Xfce desktop with X11 to Cinnamon desktop with Wayland
  • Installed fapolicyd (simular to WDAC on Windows) application control (see post)
What I'm looking for?

Looking for maximum feedback.

@Sampei.Nihira


Refactoring my extensions.
- Download Sentinel uses on-download does not use any CPU until download is invoked
- 3P-Matrix-lite uses DNR request but has a guard which invokes (or locked) levels for active (and takes care of icon color change).
DNR rules are applied by browser (so uses zero CPU), but the guard uses minimal CPU (refactored to uses lowest possible)
- uBol-stripped had a hill to climb (challenge to face), because I use AdGuard scriptlets (many more than uBol can process currently),
I could not use the smart (low memory usage) solution of uBol and did not want the (high memory) solution of AdGuard,
found a middle ground with low memory usage and low CPU usage

1784148696361.png


1784148430443.png


Happy man :-) pushing updates tomorrow to chromestore will take a few days.
 
  • Thanks
Reactions: Sampei.Nihira
Congratulations.(y)(y)
I'd be curious to know what your Speedometer 3.1 score is without those three extensions enabled.;)

P.S.

Yes, actually, your most impressive extension when compared to uboL/AG is uBol-Stripped.
You've done an excellent job, and users of these two MV3 extensions should consider switching to uBol-Stripped.
 
Last edited:
Sampei.Nihira said:
Congratulations.(y)(y)
I'd be curious to know what your Speedometer 3.1 score is without those three extensions enabled.;)

P.S.

Yes, actually, your most impressive extension when compared to uboL/AG is uBol-Stripped.
You've done an excellent job, and users of these two MV3 extensions should consider switching to uBol-Stripped.
Click to expand...
I have to investigate this, it is lower (20 when all 3 disabled and 20.4 when all three enabled). I know GorHill reacted like a farmer with toothache (dutch saying) when I confronted him that adding procedural filters caused a drop in Speedometer 3.1 performance. Next I noticed that uBol block counter went bazerk and the old test value was established. When I asked whether uBol blocked something to improve the results, the discussion was locked and removed (well you also have experience how the UBO-clan reacts when you ask something they don´t approve of).

Have to dig through the code of uBol-stripped to check this strange results (I repeated it 3 times and with the 3 extensions it scored 0.3 to 0.4 higher than without, which is impossible). I will do this tonight/

1784203926517.png
 
Last edited:
LinuxFan58 said:
I have to investigate this, it is lower (20 when all 3 disabled and 20.4 when all three enabled). I know GorHill reacted like a farmer with toothache (dutch saying) when I confronted him that adding procedural filters caused a drop in Speedometer 3.1 performance. Next I noticed that uBol block counter went bazerk and the old test value was established. When I asked whether uBol blocked something to improve the results, the discussion was locked and removed (well you also have experience how the UBO-clan reacts when you ask something they don´t approve of).

Have to dig through the code of uBol-stripped to check this strange results (I repeated it 3 times and with the 3 extensions it scored 0.3 to 0.4 higher than without, which is impossible). I will do this tonight/

View attachment 298854
Click to expand...

Yes.;)
Good hunting.
 
Sampei.Nihira said:
Yes.;)
Good hunting.
Click to expand...
Found it:

AdGuard ads an allow all for benchmark websites, so the benchmark results are not influenced by block rules. Speedometer imitates news websited complete with trackers and advertising calls. uBO-lite applies the block rules which influence the benckmark, This is the reason the benchmark scores higher with uBO-lite :-)
 
  • Like
Reactions: Sampei.Nihira
The extensions I am using in Brave Origin (only fingerprinting filter enabled):

  • First-party protection - Osprey browser protection
  • Ad&tracker blocking - uBol-stripped
  • Third-party protection - 3P-Matrix-lite
  • Download protection - Download Sentinel
 
  • Wow
Reactions: Sampei.Nihira
I cleaned up Osprey's providers, using ChatGPT (asking prompt0

When I use Google Safe Browsing and Cloudflare Zero trust and drop open source list (only use professional services) and DNS services (like Cloudflare ZT) which of the remaining services providers should I enable and why (I just copied the list) and this is what ChatGPT suggested

1784275391764.png


So I disabled all others (they are used in Google Safe Browsing as data feed) and disabled BLOCK THRESHOLD to see how many FP's I will get.
 
In my opinion, you don't really need Osprey.
DNS-level filtering + the filter lists in uBol stripped that you use eliminate any malware that might infect websites via ads.
The dynamic filtering you've set up with 3P-Matrix-lite eliminates any third-party malware that might compromise websites.
Google Safe Browsing + Download Sentinel + Download Restriction Policy completely eliminate any malware during the download process.

Users of Osprey certainly don’t have content blocking (with Dynamic Filtering) like the one you use.
 
Last edited:
Sampei.Nihira said:
In my opinion, you don't really need Osprey.
DNS-level filtering + the filter lists in uBol stripped that you use eliminate any malware that might infect websites via ads.
The dynamic filtering you've set up with 3P-Matrix-lite eliminates any third-party malware that might compromise websites.
Google Safe Browsing + Download Sentinel + Download Restriction Policy completely eliminate any malware during the download process.

Users of Osprey certainly don’t have content blocking (with Dynamic Filtering) like the one you use.
Click to expand...
You are right, I de-installed :-)
 
  • Applause
Reactions: Sampei.Nihira
@LinuxFan58

I'd like to discuss an interesting flag in Brave with you:

Code: 
Rust-based ChildProcessSecurityPolicy
Enables the experimental Rust implementation of ChildProcessSecurityPolicy. Provides options to run just the Rust implementation or Rust and C++ implementations side-by-side for validation. The default mode when enabled is Rust-only. Portions of ChildProcessSecurityPolicy that haven't been implemented in Rust yet will fall back to their C++ implementations. This can also be configured to control whether the Rust implementation manages per-process security state. – Mac, Windows, Linux, ChromeOS, Android

The safest option would be

  • Rust only (with ProcessState)
The one that is less secure than the previous one and more compatible should be:

  • Rust only
I'm not sure whether, on a hypothetical safety scale:

  • Default
It is the most compatible but least secure of the two mentioned above.

I'd really like to hear your opinion.
Thank you very much.(y);)
 
Last edited:
  • Like
  • +Reputation
Reactions: lokamoka820, Victor M and LinuxFan58
Sampei.Nihira said:
@LinuxFan58

I'd like to discuss an interesting flag in Brave with you:

Code: 
Rust-based ChildProcessSecurityPolicy
Enables the experimental Rust implementation of ChildProcessSecurityPolicy. Provides options to run just the Rust implementation or Rust and C++ implementations side-by-side for validation. The default mode when enabled is Rust-only. Portions of ChildProcessSecurityPolicy that haven't been implemented in Rust yet will fall back to their C++ implementations. This can also be configured to control whether the Rust implementation manages per-process security state. – Mac, Windows, Linux, ChromeOS, Android

The safest option would be

  • Rust only (with ProcessState)
The one that is less secure than the previous one and more compatible should be:

  • Rust only
I'm not sure whether, on a hypothetical safety scale:

  • Default
It is the most compatible but least secure of the two mentioned above.

I'd really like to hear your opinion.
Thank you very much.(y);)
Click to expand...
Wow, Brave is making progress: I opted for Rust (with Process State)

As I understand, this uses Rust when available with fallback to C++ when not yet implemented
 
  • Like
  • +Reputation
Reactions: lokamoka820 and Sampei.Nihira
LinuxFan58 said:
Wow, Brave is making progress: I opted for Rust (with Process State)

As I understand, this uses Rust when available with fallback to C++ when not yet implemented
Click to expand...

OK, so I'll stick with:

  • Rust only,

just so that we can both check for any potential incompatibilities and bring them to each other's attention.
Thank you so much for this quick advice.;)(y)
 
  • Like
  • Applause
Reactions: lokamoka820 and Victor M
Because I use 3P-Matrix-lite only in level 3 and I added level 3 protection to uBlock Strippes - Dynamic Filtering in worry-free safe browsing mode, I disabled 3P-M and installed MalwareBytes BrowserGuard with ads protection disabled.
 
  • Like
Reactions: lokamoka820
Completed Vibe-coding AdShield extra Power Tools for Brave which is spin-off from uBlock stripped - Dynamic filtering.

Using Brave filters
- Brave default ad filters
- Adblock only mode supplemental list
- Kees 1958 most used tracking parameters removal
- Kees1958 personal blocklist
- Hagezi Most abused domains

Enabled this in AdShield extra
1788684126552.png
 
  • Like
  • Applause
Reactions: Sorrento, lokamoka820, 7Oz-64 and 1 other person
Inspired by @Victor M to install fapolicyd (only allows user to execute programs, scripts and libraries from official repo's) with following changes

1. Only applies to normal (non-root / un-elevated) users
2. Normal users are allowed to read/write executables

I need to backup my extensions, normal fapolicyd does not allow users to even read scripts). Also I normally run as standard user (thanks to tips of members here I run a deamon which auto updates), so the fapolicyd restriction applying only to normal users is sufficient.

fapolicyd on Linux is like Windows Defender Appication Control (Smart Application Control for Business).

This sort of finalizes my Linux Mint Setup
1. Simple Network Intrusion Detection System - my router has an option to send me an e-mail when something severe happens (e.g. failed log-ins or network attacks)
2. Simple Host Intrusion Detection System - logcheck does the same with Linux system logs and send me an e-mail when something severe is logged
3. Inbound firewall GuFW
4. Outbound application Firewall - Little snitch
5. Mildly hardened Linux setup and de-installed stuff I don´t use (attack surface reduction)
6. Installed fapolicyd which allows normal users to only execute software from official repositories
7. Using Linux sandboxing: AppArmor for utilities, Firejail for desktop assecoires and Flatseal stripped Flatpak for applications

Although I don´t run an AV, my e-mail is checked by ISP/Google and my browser has tripple URL filtering and double download protection.

@Mods I use a VPN (on demand) so why don´t I qualify for the highest Advanced Plus level?
 
Last edited:
  • Like
  • +Reputation
Reactions: 7Oz-64, lokamoka820, Sampei.Nihira and 1 other person

You may also like...