Fixing the Desktop Linux Security Model

[Patrick]

@madaidan

AppArmor can never provide the same kind of security as SELinux.

Even if that is the case, if SELinux is too hard to mortals to write, then that theoretic advantage doesn’t help.

@madaidan

Verified boot only for the kernel is meaningless/security theater/doesn’t help.

Yes. Only a first step. Would require something like ELF signature check.

@madaidan

Debian is a massive issue, doesn’t provide proper security updates and isn’t a viable choice for building anything reasonably secure. It’s a waste of time to start from Debian.

Fatalism.

Similarly it can be argued it’s a waste to build on top of Android: [2]

• Android isn’t “real” Open Source. ASOP may be technically Open Source but the behavior is unique and not Open Source alike at all.
  • I don’t have time to make that argument, but the following articles kinda do it while I don’t agree with all they say.
  • Google’s iron grip on Android: Controlling open source by any means necessary | Ars Technica
  • They don’t act Open Sourcey as they don’t publish their git master branch. After X time there’s a huge dump of new code.
• Developed by a company, Google that is one of the biggest violators of privacy ever, among other evil behavior.

But he’s building GrapheneOS on top of Android anyhow.

I don’t think there’s any base Linux distribution suitable for Whonix to build on top of:

Notes here:

Security-Focused Operating System Comparison as Base for Whonix

Replacing Debian might be worthwhile if there is any distribution that has:

• verified boot (full)
• is stateless
• security-focused
• no other criteria making it unsuitable

@madaidan

We should define a base system, make it read-only and then build verified boot, MAC etc.

[1] I would like to build a space ship, explore the universe, make peaceful contact with other space traveling specifies should they exist. But currently doesn’t look realistic.

@madaidan

• Musl should be used as the libc instead of glibc. Glibc is buggy and overly complex. Musl is missing some very minor security features present in glibc (the glibc implementations aren’t good anyway) so we should add the missing security features to musl.
• Clang/LLVM should be used as the toolchain so we can enable modern mitigations like CFI.

Requires a base distribution which does that.

@madaidan

Systemd is a big problem. They’re hostile towards modern security approaches, adds a huge amount of attack surface / complexity and is developed by incompetent people. PID1 can be tiny and the minimal requirements are like 500 lines of code.

systemd CVE’s don’t look so bad. Not judging by numbers but by issues if they were an actual issue for Whonix. Doesn’t look so bad. More so when limiting it to the core of systemd.

systemd support tons of security features in a usable way such as seccomp, capabilities, limits, private-tmp, private devices, read-only directories, and whatnot.

Unless there’s something really better then systemd (which I doubt) and/or resources to port to it, Whonix is settled with systemd. This is strongly related to the base distribution issue. If there was a more secure base distribution that decided not to use systemd and had something else, then this might be doable.

@madaidan

• Do the applications like how android does APEX so verified boot extends to applications. APEX ships components as little filesystem images that are mounted and use dm-verity.
• So the base OS is a filesystem image, updating with A/B updates using update_engine and applications should be little filesystem images too.

Same as [1]. Basically, re-base on Android? I am not convinced of Android due to [2].