Advanced Plus Security Victor M Fedora Cosmic Linux config

Last updated
Sep 12, 2026
How it's used?
For work or educational use
Operating system
Linux
Other operating system
Fedora Cosmic 44
On-device encryption
Other full-disk drive encryption software
Log-in security
    • Hardware security key
    • Basic account password (insecure)
Security updates
Allow security updates
Update channels
Allow stable updates only
User Access Control
N/A - Linux / Mac / Other operating system
Smart App Control
N/A - Linux / Mac / Other operating system
Network firewall
Enabled
About WiFi router
ISP supplied
Real-time security
SELinux
systemctl
Firewall security
Built-in Firewall for Mac/Linux
About custom security
SELinux
fapolicyd
Browser Sandbox
Persistence mitigation
Hardening
Libre Office policy
Brave policy
dnf policy
Yubikey login, sudo
SCAP baseline Workstation 2
Periodic malware scanners
n/a
Malware sample testing
I do not participate in malware testing
Environment for malware testing
n/a
Browser(s) and extensions
Brave ( extensions banned by policy )
Secure DNS
Quad9
Desktop VPN
ProtonVPN
Password manager
keepass
Maintenance tools
Cosmic defaults
File and Photo backup
manual
Subscriptions
    • None
System recovery
Clonezilla
Risk factors
    • Browsing to popular websites
    • Working from home
Computer specs
Dell Latitude (2016)
What I'm looking for?

Looking for maximum feedback.

Victor M

Level 27
Thread author
Verified
Top Poster
Well-known
Oct 3, 2022
1,698
6,529
2,569
Here is my latest build: Fedora 44 Cosmic. Was using Fedora KDE, hated the Windows styled start menu. Previous to that Fedora Gnome, but it has problems with user_u confinement; had to ask chatgpt to fix. And my fault didn't document it properly. This time every configuration hardening step is documented so it's repeatable. ( 20 main steps )

I stick with Fedora because of their fast track updates. Patches arrive sooner.

I find Cosmic is similar to Gnome roughly in appearance. It doesn't have a Switch User feature. Maybe it was deliberately designed out. The login screen doesn't show big icons of user names, instead there's a tiny button which is a pull down menu of users; not as convenient.

Cosmic just came out of 2 yrs development in Dec and is still under development. For example when copying a large number of files, sometimes a progress bar comes up, sometimes not. Things get moved around within a span of a few months ( last time I distro hopped ) and a PAM setting changed file location. I am willing to put up with it as long as they don't break my security configuration or it's easy to fix. Cosmic is built by System76 a hardware vendor, so it is well funded. I think of it like Sun Microsystems.

But, Cosmic is built with RUST. No buffer overflows, no use-after-free, no dangling pointers and all that good stuff that comes with a modern language. Less attackable I believe.
 
Last edited:
Looks nice, tried it before, but went back to my good friends Ubuntu and Gnome.

1789206132703.png
 
Wow - fapolicyd really strong next level setup (y)(y)(y)

I have a light NIDS in my router (came build-in with the router) which allows setting alert levels and when those levels are hit, sends you an e-mail. Together with logcheck (light HIDS) and opensnitch (together with build-in FW) it is with Linux sandboxing (AppArmor for print, Firejail for desktop assecoires and Flatseal stripped Flatpak's for applications) the back bone of my security.

I read that fapolicyd also can be used on Ubuntu/Mint distro's. How is your experience with it?
 
Last edited:
You inspired me to install it also. I noticed that I could not backup mt extensions with FreeFileSync because users are not even allowed to read scripts. Because I am running as standard user fapolicyd only applies to standard users and I allowed standard users to read/write scripts, executbles and libraries (for backup).

Thanks for posting your new setup :-)
 
  • Like
Reactions: Sampei.Nihira