Advanced Plus Security TuxTalk - Fedora 44 - GNOME Setup

[TuxTalk]

Made the jump back home to Fedora 44 GNOME, leaving Ubuntu LTS behind.

While Ubuntu's LTS releases have their place for pure set-and-forget server workloads, returning to Fedora immediately reminded me why it’s such a powerhouse for a modern daily workstation:

• Security Done Right: Out-of-the-box SELinux enforcement without friction, rapid upstream kernel patching, and proactive hardening defaults that don't cut corners.
• Pure Upstream GNOME: Clean, unadulterated GNOME the way the developers intended—no heavy custom skins or unnecessary middle layers getting in the way.
• Modern Tooling & Standards: Modern package management, seamless Flatpak integration, and bleeding-edge system components without having to wrestle with PPAs or snap-heavy defaults.
• Rock-Solid Freshness: You get current packages, fresh kernels, and real upstream improvements while keeping rock-solid system stability.

It feels great to be back on a distro that leads the curve instead of lagging behind it. Highly recommend giving Fedora a fresh spin if you’ve been sitting on the fence.

 

[TuxTalk]

I use 2 seperate Accounts :

One Standard NON Admin account for daily use.
One Admin Account to approve and install software.

 

[TuxTalk]

Removed CLAMAV since its not very useable, even with CLAMUI installed.

 

[Captain Awesome]

Removed CLAMAV since its not very useable, even with CLAMUI installed.

I also did the same.

 

[Sampei.Nihira]

Congratulations on switching to Fedora, which,with its default settings,is certainly more secure than Ubuntu, also with its default settings.
Of course, customization,which varies from person to person,can offer additional benefits.

 

[TuxTalk]

Just finished a RescueZilla to External drive backup ( full system backup )

 

[Victor M]

You might want to give SELinux user profiles a spin:

For your admin
sudo semanage login -a -s staff_u <adminAccountName>
sudo restorecon -RFv /home/<adminAccountName>

For your user
sudo semanage login -a -s user_u <userAccountName>
sudo restorecon -RFv /home/<userAccountName>

then from then on, instead of just sudo, just type "sudo -r sysadm_r "

You are currently on unconfined. And the profiles have it's benefits. To see that type "id -Z". To see the labels on files type "ls -laZ "

As I remember when using Fedora Gnome, the user account will lose all icons after switching to user_u. You have to ask AI for help on fixing that.
And also, mozilla does not switch to mozilla_t as it should, ask AI for help on that too.

I am now on Fedora KDE with no such icon problems. And I am now using Brave. It doesn't have the equivalent protection of mozilla_t but I have other protections. I prefer Gnome and still don't like KDE after 4 months. (it has a start menu that looks like windows)

 

[TuxTalk]

Thanks @Victor M but i will keep it like it is.

Advisable according to Gemini :

**In most standard environments (workstations, dev machines, general-purpose servers), no.** For dedicated, high-security multi-user servers, it can be advisable if you have a concrete threat model requiring it.

By default, RHEL and Fedora map all standard accounts to `unconfined_u`. Confining users to `user_u` and `staff_u` implements strict Mandatory Access Control (MAC), which introduces significant operational friction.

---

### The Operational Trade-offs

| Factor | Default (`unconfined_u`) | Confined (`staff_u` / `user_u`) |
| --- | --- | --- |
| **GUI & Desktop Apps** | Everything works out of the box (GNOME/KDE, Flatpaks, Wayland/X11). | Frequent permission denials with modern desktop features, audio servers (PipeWire), and browser sandboxes. |
| **Development Tools** | Compilers, local containers (`podman`/`docker`), IDEs, and user-space binaries run freely. | Blocked from executing files in `/tmp`, `~/.local/bin`, or custom paths unless booleans and file contexts are modified. |
| **`sudo` Execution** | Works directly via standard `/etc/sudoers`. | `staff_u` requires specific SELinux role-transition rules in `sudoers` (`TYPE=sysadm_t ROLE=sysadm_r`); `user_u` is completely blocked from `sudo`. |
| **Network & Execution** | Standard POSIX network/socket permissions. | Strict controls over which network ports users can bind to and whether they can run shell scripts or connect out. |

---

### When It Is Advisable

* **Shared Multi-User Production Servers:** Preventing users on a jump host, bastion, or shared build server from interfering with other users, processes, or system-level daemons.
* **Strict Compliance Mandates:** Environments requiring DISA-STIG, PCI-DSS, or government-level RBAC where even root transitions must be explicitly scoped.
* **Kiosk or Restricted Shell Terminals:** Locking down non-admin users so they cannot run unapproved binaries or execute anything in memory.

---

### When to Avoid It

* **Primary Workstations & Laptops:** Day-to-day desktop usage will produce constant SELinux denials (AVC logs) across user services, Flatpak/Snap sandboxes, and peripheral management.
* **Developer Machines:** Common workflows like running virtual environments (`venv`), local web servers, debugging tools (`gdb`/`strace`), and containers will break without writing custom SELinux policy modules.

If the goal is standard workstation or server hardening, enforcing strong standard practices (least-privilege `sudoers`, SSH key-only auth, firewall rules, and container isolation) usually provides a better balance of security without the maintenance overhead of user confinement.

 

[Victor M]

In my daily work. I didn't encounter much friction. But I mainly just use Libre Office, browser, notepad and the terminal. Everything else is mainly via the browser. So I don't agree with Gemini's grim assessment. It depends on what you touch. But I do have to be compliant. But I didn't realize confinement helped..

I think most office workers use the stuff I use. And SELinux wouldn't make workstation work unbearably difficult. I would say Gemini is being overly negative this round and selectively giving you examples.. But realize too that AI learns what you do, and adjusts answers so that it might fit you personally. So depending what you have been asking her about it can be negative against certain things. Like I use CHatGPT for security. And she likes to say "for your threat model, I would recommend ..." Thus reminding one that it is adjusting it's advise to you.

But if you were to ask her more security related things, and she learns what your security tolerance is. For example if she learns that you like to turn your AV settings to the max, then you'll find she would advise differently. Or you can tell her explicitly up front. and use the phrase "remember this: ". Or you could say "answer as a security architect...." thus giving her context.

By the way, a "threat model" is loosely speaking what you’re worried could happen, who could make it happen, and what you’re trying to protect..

 

[TuxTalk]

In my daily work. I didn't encounter much friction. But I mainly just use Libre Office, browser, notepad and the terminal. Everything else is mainly via the browser. So I don't agree with Gemini's grim assessment. It depends on what you touch. But I do have to be compliant. But I didn't realize confinement helped..

I think most office workers use the stuff I use. And SELinux wouldn't make workstation work unbearably difficult. I would say Gemini is being overly negative this round and selectively giving you examples.. But realize too that AI learns what you do, and adjusts answers so that it might fit you personally. So depending what you have been asking her about it can be negative against certain things. Like I use CHatGPT for security. And she likes to say "for your threat model, I would recommend ..." Thus reminding one that it is adjusting it's advise to you.

But if you were to ask her more security related things, and she learns what your security tolerance is. For example if she learns that you like to turn your AV settings to the max, then you'll find she would advise differently. Or you can tell her explicitly up front. and use the phrase "remember this: ". Or you could say "answer as a security architect...." thus giving her context.

By the way, a "threat model" is loosely speaking what you’re worried could happen, who could make it happen, and what you’re trying to protect..

Thanks, but im fine like this. I use it for browsing mostly and some email.

 

[TuxTalk]

I am now on Fedora KDE with no such icon problems. And I am now using Brave. It doesn't have the equivalent protection of mozilla_t but I have other protections. I prefer Gnome and still don't like KDE after 4 months. (it has a start menu that looks like windows)

I really dislike KDE, nothing special just a Windows theme in a Linux environment