Advanced Plus Security Victor M Fedora Cosmic Linux config

[Victor M]

Here is my latest build: Fedora 44 Cosmic. Was using Fedora KDE, hated the Windows styled start menu. Previous to that Fedora Gnome, but it has problems with user_u confinement; had to ask chatgpt to fix. And my fault didn't document it properly. This time every configuration hardening step is documented so it's repeatable. ( 20 main steps )

I stick with Fedora because of their fast track updates. Patches arrive sooner.

I find Cosmic is similar to Gnome roughly in appearance. It doesn't have a Switch User feature. Maybe it was deliberately designed out. The login screen doesn't show big icons of user names, instead there's a tiny button which is a pull down menu of users; not as convenient.

Cosmic just came out of 2 yrs development in Dec and is still under development. For example when copying a large number of files, sometimes a progress bar comes up, sometimes not. Things get moved around within a span of a few months ( last time I distro hopped ) and a PAM setting changed file location. I am willing to put up with it as long as they don't break my security configuration or it's easy to fix. Cosmic is built by System76 a hardware vendor, so it is well funded. I think of it like Sun Microsystems.

But, Cosmic is built with RUST. No buffer overflows, no use-after-free, no dangling pointers and all that good stuff that comes with a modern language. Less attackable I believe.

 

[TuxTalk]

Looks nice, tried it before, but went back to my good friends Ubuntu and Gnome.

 

[LinuxFan58]

Wow - fapolicyd really strong next level setup

I have a light NIDS in my router (came build-in with the router) which allows setting alert levels and when those levels are hit, sends you an e-mail. Together with logcheck (light HIDS) and opensnitch (together with build-in FW) it is with Linux sandboxing (AppArmor for print, Firejail for desktop assecoires and Flatseal stripped Flatpak's for applications) the back bone of my security.

I read that fapolicyd also can be used on Ubuntu/Mint distro's. How is your experience with it?

 

[Victor M]

Yes I have fapolicyd deployed on my Ubuntu also. Works silently.

 

[LinuxFan58]

You inspired me to install it also. I noticed that I could not backup mt extensions with FreeFileSync because users are not even allowed to read scripts. Because I am running as standard user fapolicyd only applies to standard users and I allowed standard users to read/write scripts, executbles and libraries (for backup).

Thanks for posting your new setup

 

[Victor M]

To add a file to be trusted, use: fapolicyd-cli --file add <filename>

 

[Victor M]

iI allowed standard users to read/write scripts, executbles and libraries (for !backup)

You mean like the following ?
allow exe=backupApp perm=open : ftype=%languages ( I think this %languages is defined in a higher rule: 10-languages.rules )
allow exe=backupApp perm=open : ftype=application/x-executable
allow exe=backupApp perm=open : ftype=application/x-sharedlib

There is a loophole when it comes to python and other language interpreters when it comes to ftype=text/plain . If you don't regulate it, then they can execute plain text files that has no #! , and attackers can use it to run any file they want. I use:
deny_log exe=python3.14 perm=any : trust=0

Then you will need to make allow rules for specific text files like .conf which aren't part of any .deb and are generated post install.

The baseline for these conf files I found by trying update-manager (software updater) and doing "fapolicyd --debug-deny"

 

[Victor M]

software updater

Sorry I forgot you are not using Ubuntu.