Advanced Plus Security Victor M Fedora 44 KDE Configuration

[Victor M]

Have just "finished" preparing my Fedora 44 KDE Plasma machine. It's not that I like KDE; my red team sorta made me rebuild the OS because they were incrementally hacking it. And I lacked detailed steps to re-create Fedora 44 Gnome's SELinux configuration. Since the forum is saying KDE is sleek, much improved, and so forth; I decided to take a look. This time I documented the configuration steps

Out of the box, Fedora makes user accounts with the unconfined profile. It has no restrictions. Just like Windows' first user account.

I confined the admin account to the staff_u profile, and confined my second daily use user account to the user_u profile. The staff_u can do admin things, and can sudo. But there should be some limitations that I haven't experienced yet. The user_u cannot do admin things.

sudo semanage login -a -s staff_u <admin acc name>
sudo restorecon -RFv /home/<admin account name>/

sudo semanage login -a -s user_u <user acc name>
sudo restorecon -RFv /home/<user account name>/

The semanage command changes the profile, and the restorecon command relabels the directories and files. Simplistically speaking, SELinux labels everything and enforce whitelist rules that says what can interact with what.

These profiles are pre-made; comes with SELinux. However, some things aren't fully working. ChatGPT says these profiles are fully supported on Red Hat Linux. But on Fedora it has some rough edges.

To see what label you are, type id -Z
To see what labels are in a directory type ls -laZ

Then I made sudo require Yubikey, and sign in also requires Yubikey. This is a important part that foils remote hacking. One needs to touch the Yubikey as 2FA to complete a sudo command. This is configured via modification to PAM files in /etc/pam.d/

Done hardening it similar to what I did for Ubuntu: Setup Idea - Ubuntu Hardening

Except I cannot use Firejail, because it thinks SELinux profiles are a kind of virtualization and it exits.

Instead of firejail, SELinux has a mozilla_t profile. So instead of firejail's very minimized containment environment, I now have SELinux rules that whitelists allowed tasks.

Also, one has to make staff_u and user_u transition Firefox into mozilla_t. (That's the rough edges I was talking about) This mozilla_t is a pre-made profile. But is lacking a rule to make it work under user_u and staff_u. Ask your AI on how to do that. It needs a small rule file which you then apply.

There is also a SELinux boolean (global selinux var) that can be turned off with 'setsebool -P unconfined_mozilla_plugin_transition off' ChatGPT explains that it is only needed for old browser plugins like Flash and allows much expanded rights for plugins.

Looking for Max Feedback

 

[Victor M]

Speaking of Browser Extensions; it is a hacker trick to install extensions into your browser. Extensions may have high privileges to read all your traffic, stored passwords etc. And it can stay there unseen forever if you don't check. The best thing to do is to make a policy that restricts all the extensions to your list. Firefox has a json file format and Chrome has another one. Ask your AI about the syntax and where to put the policy file.

 

[Sampei.Nihira]

Congratulations on your security setup.
The browser is not specified.
If you're using Firefox, there's no need to use PB, since Firefox already has a built-in anti-tracking feature that can be enhanced using filter lists in uBo.

 

[7Oz-64]

Nice setup @Victor M, just one question in section "about custom security", you said " Firewall-cmd set to zone=drop", i guess is for your LAN (ethernet), you know that FirewallD secure network by zone, so i wonder how did you set the loopback zone (lo) ? normally you must set it to trusted network (to avoid some strengh behaviour) even if the external is set to drop, this what i do for years.

 

[Victor M]

@7Oz-64 I have never touched loopback. It is not reachable from the internet. It is for addresses like 127.0.0.1 .

 

[Victor M]

After doing CIS Baseline, my lynis hardening index = 71

 

[Victor M]

Lesson learned the hard way: never use your browser; which is a very attackable piece, from your admin account. If you have to debug with AI, use the Office Write to ferry pages back and forth from your surfing account.

Let me put it this way. During my previous Fedora 44 KDE install, I used only 3 apps, libreoffice-write, dnf, firefox. And my red team got me. All the frameworks warrned about this, But I thought hey i got to debug so that's acceptable use, right ? Wrong.

 

[7Oz-64]

@7Oz-64 I have never touched loopback. It is not reachable from the internet. It is for addresses like 127.0.0.1 .

This is why i ask :

Configure Firewalld to Trust Loopback Traffic

Datadog, le principal prestataire de services de surveillance à l'échelle du cloud.

docs.datadoghq.com

Important to set as trusted for proper internal action functionning : systemd-resolved (if your using it), PostgreSQL, MariaDB, Redis, Nginx, Apache, Docker, Podman, internals services.

 

[Victor M]

Currently running generation 3 install of Fedora 44 KDE. Except for package installation, was prepared totally offline.

 

[simmerskool]

After doing CIS Baseline, my lynis hardening index = 71

my fedora 44_VM / gnome sudo lynis audit system > Hardening index : 77 [############### ] from april 2026 -- lately I'm running fedora 44 kinoite_VM KDE and its score is 65 but so far haven't made an effort to increase it (other than adding lynis).

 

[Victor M]

I may have shot myself in the foot, but I removed the suid bit from a bunch of programs. I left only sudo, and passwd intact.
People would jump up and say but mount needs suid. And yes it does, but I don't manually mount. And all the mounting during boot is done by root. And USB sticks auto mount correctly when inserted. So I am happy.
I know hackers abuse suid executables.

 

[LinuxFan58]

Stay safe not paranoid (it is a thin red line)

 

[Victor M]

Stay safe not paranoid (it is a thin red line)

Oh I have wandered way past that red line to be salvageable. I blame my red team.

 

[Victor M]

After applying using SCAP to apply CIS Workstation Level 2 , lynis hardening score = 81

 

[Victor M]

Installed and configured fapolicyd. It is App Control security that restricts executables to those installed via dnf, like Windows WDAC. Full write up here: Setup Idea - Ubuntu Hardening

 

[simmerskool]

Installed and configured fapolicyd. It is App Control security that restricts executables to those installed via dnf, like Windows WDAC. Full write up here: Setup Idea - Ubuntu Hardening

yeah I read the ubuntu hardening post. I'll run fapolicyd by chatgpt & maybe now claude-the-lesser since gov't clipped Anthropic

 

[Victor M]

setsebool -P deny_ptrace on
setsebool -P selinuxuser-execstack off
setsebool -P selinuxuser-execmod off

nano /etc/sysctl.d//10-ptrace.conf

kernel.yama.ptrace_scope=3

 

[simmerskool]

fwiw chatGPT suggested not implementing fapolicyd on my fedora44 / Kinoite KDE Plasma. IIRC it thought that since it's an atomic locked-down image, and relies on flatpaks outside that image, it would muck with workflow and not essential...

 

[Victor M]

@simmerskool Yes, if Kinoite uses Flatpaks a lot then it wouldnt be a good fit. Because fapolicyd reads the rpm installation database to confirm whether to alllow an exe to run. And if you aren't using rpm, then you will need to manually add the files to authorize them.
In Ubuntu, fapolicyd is compiled to use their apt installer database instead of dnf/rpm..

 

[Victor M]

So far I have made 27 offline images, each of them accumulating some more security enhancements. Have been keeping notes of all hardening. And lately fed this secure configuration notes to Anthropic Claude (because Mythos made it famous for cybersecurity) to critique the security and suggest compensating controls Resulted in several more pointers. Claude also uses a more serious tone ( is it because I am talking about security ) which is interesting.