As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.
I use both privately and professionally and while I accept that security-wise (even with selinux) they feel lacking, feature-wise they far exceed Windows I use as my other is except in gaming experience.
I wish I had something like GrapheneOS on desktops (yes I know about Qubes)
SecureBlue and Kicksecure are the closest equivalents.
> I wish I had something like GrapheneOS on desktops
Secureblue is essentially as close to GrapheneOS as Desktop Linux can get. Neither my response nor the original question required qubes comparisons. It was merely mentioned.
> grsecurity® is the only drop-in Linux kernel replacement offering high-performance, state-of-the-art exploit prevention against both known and unknown threats.
While secureblue is a full desktop distro (not just a kernel) that integrates key grapheneos hardening tools like their hardened malloc and forks of their hardened chromium and works with flatpak as a base for hardened application deployment.
grsecurity does literally none of that.
You do not understand what you are talking about because if you did you'd be embarrassed for how braindead your response is.
To start with, some of the protections in grsecurity (specifically PaX) offer protections that apply to userspace - specifically MPROTECT and PAGEEXEC. Then there's the many kernel level protections: KERNEXEC The 3 different ASLR options (yes, vanilla linux has some watered down versions of these)
Then there's all the options that your little github repo has nothing the eqivilent of (to be fair vanilla linux HAS backported some of these):
[ ] Sanitize all freed memory
[ ] Sanitize kernel stack
[ ] Prevent invalid userland pointer dereference
[ ] Prevent various kernel object reference counter overflows
[ ] Harden memory copies between kernel and userland
[ ] Automatically constify eligible static objects
[ ] Report code regions instrumented for writing to constified data
[ ] Automatically constify eligible allocated objects
[ ] Prevent various integer overflows in function size parameters
[ ] Increase coverage of size overflow checking
[ ] Log missing size overflow hash table entries
[ ] Free more kernel memory after init
[ ] Free more kernel memory after init (verbose mode)
[ ] Generate some entropy during boot and runtime
[ ] Prevent code reuse attacks
[ ] Forward edge defense (deterministic)
└─ Forward edge defense instrumentation method (callabort)
[ ] Backward edge defense (deterministic)
[ ] Backward edge defense (probabilistic)
[ ] Protect kernel stacks from each other
[ ] Report nolocal transformations
[ ] Automatically protect kernel code vulnerable to Spectre v1
[ ] Protect more kernel code vulnerable to Spectre v1
[ ] Automatically protect kernel code vulnerable to Spectre v4
[ ] Protect more kernel code vulnerable to Spectre v4
[ ] Report code found to be potentially vulnerable to Spectre v1/v4
[ ] Convert k\*alloc allocations into their own slabs
[ ] Report autoslab decisions
[ ] Report some potential NULL pointer dereferences
[ ] Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port
[ ] Disable privileged I/O
[ ] Randomize addresses of critical kernel objects
[ ] Harden BPF interpreter
[ ] Disable unprivileged PERF_EVENTS usage by default
[ ] Insert random gaps between thread stacks
[ ] Harden ASLR against information leaks and entropy reduction
[ ] Deter exploit bruteforcing
[ ] Hide kernel symbols
[ ] Randomize layout of sensitive kernel structures
[ ] Use cacheline-aware structure randomization
[ ] Active kernel exploit response
[ ] Dmesg(8) restriction
[ ] Deter ptrace-based process snooping
[ ] Require read access to ptrace sensitive binaries
[ ] Enforce consistent multithreaded privileges
[ ] Disallow access to overly-permissive IPC objects
[ ] Disallow unprivileged use of command injection
[ ] Disable ability of suid root apps to execute unsafe files
[ ] Auto-enable Spectre mitigations for suid-like applications
[ ] Trusted Path Execution (TPE)
So yea - to suggest your little github repo that tweaks a few kernel settings is anywhere near the massive security hardening feature set that grsecurity delivers is also, well, embarassing.
True, it's the price for security.
> need at least 64G of ram to even remotely use it as it's intended
This is false. I'm using it on a 32G machine never meeting the limit. If you use minimal templates, you can easily work on a 8G machine.
> no hardware acc by default
They're working on on it: https://github.com/QubesOS/qubes-issues/issues/8552
> buggy templates
What are you even talking about? I'm using Qubes as my daily driver and don't have any problems with the templates.
> sleep is broken
It works flawlessly on my Librem 14.
> uses X11 for display
Why is this a problem? See also: https://github.com/QubesOS/qubes-issues/issues/3366
> dom0 is not updated as frequently as it should be
Should be for what? No software should be run in dom0, so its updates are not relevant: https://www.qubes-os.org/doc/dom0-secure-updates/#reasons-fo... and https://www.qubes-os.org/doc/how-to-install-software-in-dom0...
> I hardly see any effort in documenting the fact that individual VMs's security matter too
https://github.com/QubesOS/qubes-issues/issues/4233
Also, Kicksecure template is already available: https://forum.qubes-os.org/t/kicksecure-template-for-qubes-t...
Video performance is a fair criticism for sure.
But is perpetual 0day RCE's in browsers and other highly exposed software is not running Qubes really a credible choice?
Unfortunately, there's no popular non-Google distro of it.
It also seems to have a lot of new code every year for very few new features. It's as if they get every new intern to rewrite a bit of the innards, and then next summer another intern rewrites it again.
First CoreOS, which forked into Flatcar Linux (now funded by Microsoft) and Fedora CoreOS (rewrite from Gentoo/ChromeOS base to Fedora base), and Google's Container-Optimized System (used heavily in Google Kubernetes Engine).
Just searching grsecurity on HN turns up some interesting stuff.
I tried Ubuntu last year, and it felt very limited compared to Windows. It lacked very basic features like face/fingerprint login, hybrid sleep, factory reset, live FDE (or post-installation FDE), fast fractional HiDPI, two-finger right-click, "sudo" on dock etc.
And people will say "Yeah, but it is amazing". Then why do so many people feel the need to defend it in terms of _being better than Windows_? Clearly they prioritize the perception of being better than Windows over being actually good, because otherwise they would defend it by pointing out how good it is. Are they all just weirdos, or have they subconsciously picked up on the real but unwritten culture of Linux?
They are still missing something like capability based security like iOS and Android have where apps have to be granted access to use things like files or the camera. It may have been considered secure a couple decades ago, but they have fallen behind the competiton.
...like Capsicum?
I wouldn't consider any of these systems "secure", though, as a practical matter. In terms of preventing a breakout, I'd trust an application on OpenBSD with strict pledge and unveil limits, or a Linux process in a classic seccomp sandbox (i.e. only read, write, and exit syscalls), more than any of those other systems. Maybe Capsicum, too, but I'm not familiar enough with the implementation to know how well it limits kernel code surface area. But any application that can poke at (directly or indirectly) complicated hardware, like the GPU, is highly problematic unless there are proofs of correctness for any series of inputs that can be sent by the process (which I don't think is the case).
The last place in security is iOS.
We need at least the following sets: effective, permitted, bounding (per escalation method?), and the ability to make a copy of all of the preceding to automatically apply to a child (or to ourselves if we request an atomic change). Linux's `inheritable` set is just confusing, and confusion means people will use it wrong. At least we aren't Windows.
Take filesystems, the official filesystems are UFS(1/2) and ZFS. They have GEOM as LVM and LUKS and more.
That being said, the majority of money and development goes into Linux, which by itself may make it a better system (eventually).
Edit: Of course UFS is not deprecated.
The right comparison is not between a particular BSD and Linux, its between a particular BSD and a Linux distro.
The full range of distros are very different from each other. Consider Void, Alpine, Gentoo, Chimera, NixOS.....
Different C libraries, init systems, different default command line utilities....
Try running a FreeBSD binary under OpenBSD.
The general lesson from that seems to be that a simpler, well-understood, well-tested and mostly static attack surface is better than a more complex, more fully-featured and more dynamic attack surface. I wonder whether we'll see a trend towards even more boring Linux distributions which focus on consistency over modernity. I wouldn't complain if we did.
Less code means less possibility for bugs, and is easier to audit.
In my book, WireGuard perfectly follows the UNIX philosophy of making a simple tool that does exactly one thing and does it well.
While I cannot agree nor disagree on the quality of BSDs (haven't used one in 20 years), I find it funny that in this case a design by committee is proof of quality.
I guess it's better than design by headless chicken which is how the Linux user-space is developed. Personally, I am a big fan of design by dictatorship, where one guy at the top either has a vision or can reject silly features and ideas with strong-enough words (Torvalds, Jobs, etc.) - this is the only way to create a cohesive experience, and honestly if it works for the kernel, there's no reason it shouldn't work in userspace.
I don't think "design" is correct word: organized, managed, or ran perhaps.
> The FreeBSD Project is run by FreeBSD committers, or developers who have direct commit access to the master Git repository.[1] The FreeBSD Core Team exists to provide direction and is responsible for setting goals for the FreeBSD Project and to provide mediation in the event of disputes, and also takes the final decision in case of disagreement between individuals and teams involved in the project.[2]
* https://en.wikipedia.org/wiki/FreeBSD_Core_Team
There is no BDFL, à la Linux or formerly Python: it's a 'board of directors'. Decisions are mostly dispute / policy-focused, and less technical for a particular bit of code.
They decide what gets included in the default distribution, they set the goals and provider sponsorships for achieving them.
So yes, board of directors is probably more fitting.
And then of course you have the people with a commit bit. They can essentially work on whatever they like, but inclusion into the main branch is still up to the core team.
There was a huge debate some years ago when Netgate sponsored development/porting of WireGuard to FreeBSD, and the code was of a poor quality, and was ultimately removed from FreeBSD 13.
Not to mention illumos-based systems too.
Since then even more stuff went to the Web, but I really I doubt Illumos got any extra traction.
So while Windows was letting everyone be root?
The answer heavily depends on your configuration. Unprivileged with a spartan syscall filter and a security profile is very different than privileged with the GPU bindmounted in (the latter amounts to a chroot and a separate user account).
And yes, this will most likely be a mess.
You just defined 'life' in general.
That assumes:
1) Attacker already have an account on the system
2) The app `udisks` is installed on the system.
Everyone is fighting the same battle and it's a good thing. It is happening because the rest of the system is hard enough to attack these days. This is true for all major OS:es.
Only fanboys bend reality to make this into a good-vs-bad argument.
What the parent poster meant is that you first need a way to run arbitrary code before local privilege escalation matters, so the exploit chain has to include _something_ that gets you local code execution.
I tend to agree with the parent poster, for most modern single-user linux devices, local privilege escalation means almost nothing.
Like, I'm the only user on my laptop. If you get arbitrary code execution as my user, you can log my keystrokes, steal my passwords and browser sessions, steal my bitcoin wallet, and persist reasonably well.... and once you've stolen my password via say keylogging me typing `sudo`, you now have root too.
If you have a local privilege escalation too, you still get my passwords, bitcoin wallet, etc, and also uh... you can persist yourself better by injecting malware into sshd or something or modifying my package manager? idk, seems like it's about the same.
I haven't actually looked at the numbers, but I strongly suspect that it's true that the overwhelming majority of single-user Linux devices out there are Android devices. If that's true, then it's my understanding that Android does bother to fairly properly sandbox programs from each other... so an escalation to root would actually be a significant gain in access.
Applications have different user IDs and different SELinux contexts.
Android security is tight
> Like, I'm the only user on my laptop. If you get arbitrary code execution as my user, you can log my keystrokes, steal my passwords and browser sessions, steal my bitcoin wallet, and persist reasonably well.... and once you've stolen my password via say keylogging me typing `sudo`, you now have root too.
In this context, "single user system" means either "single human using the system", or "one human physically sat in front of the system's 'console' at one time". It's in contrast with systems that have multiple human users logged in and using the system simultaneously. So, nearly 100% of "single user systems" of this type will have software running under different "user" accounts on the system, but still meet the definition, because those accounts are actually "machine" or "service" accounts.
I do think that this overload of the terminology is bogus and confusing. It should be called something like "single seat system", but here we are.
> Android security is tight
Yep. That's what I said: "[I]t's my understanding that Android does bother to fairly properly sandbox programs from each other... so an escalation to root would actually be a significant gain in access."
Firefox, the desktop environment, your password manager and even `sudo` are traditionally all running as your own user.
This is not true in Android whatsoever.
Being multi-seat or not has little security implications - most traditional Linux systems can handle multi-seat but they’re still limited in security by running everything as a single user
And no nearly all 100% of Linux systems do not run proper multi-user configurations because none of the most popular distributions ship like that. Not in the context of desktop usage anyway.
Servers do use multi-user configuration but that’s not what we’re talking about here
Um. Have you ever run 'ps aux', guy? At minimum you're running everything as two users (root and your user account), and probably three to twenty more, depending on what you have installed. I know that on my desktop system
ps axo user | sort -u | grep -v USER | wc -l
> And no nearly all 100% of Linux systems do not run proper multi-user configurations because none of the most popular distributions ship like that. Not in the context of desktop usage anyway.
In addition to my commentary above, see: <https://help.ubuntu.com/stable/ubuntu-help/user-add.html.en>
Most Linux systems don't run every single program as a separate Linux user. That doesn't mean that those systems are "in fact running everything as one user".
Lmfaoooo
I’m assuming you have actually never ran a linux on your desktop. Lmaooooo.
Yeah sure init runs as root, and maybe you have background services that run as some other user.
BUT YOUR ACTUAL DESKTOP SESSION RUNS AS ONE USER. THIS INCLUDES YOUR BROWSER, YOUR PASSWORD MANAGER AND ALL YOUR OTHER SHIT!
https://paste.centos.org/view/f8e5ec76
so multi-user much secure
You know being a know-it-all only really works if you know what you are talking about.
Feel free to dig into the code of gnome-session if you don’t believe me.
Yes, the things I personally run nearly always run under my user account. I've never said otherwise. I've also said that Android doesn't do things this way, and that that's a good thing. As I mentioned in my comment to TheDong: [0]
> [I]t's my understanding that Android does bother to fairly properly sandbox programs from each other... so an escalation to root would actually be a significant gain in access.
And my comment to you: [1]
> In this context, "single user system" means either "single human using the system", or "one human physically sat in front of the system's 'console' at one time". ... So, nearly 100% of "single user systems" of this type will have software running under different "user" accounts on the system, but still meet the definition, because those accounts are actually "machine" or "service" accounts.
And from that same comment:
> > Android security is tight
> Yep. That's what I said: "[I]t's my understanding that Android does bother to fairly properly sandbox programs from each other... so an escalation to root would actually be a significant gain in access."
Moving on.
> Yeah sure init runs as root, and maybe you have background services that run as some other user.
Correct. That's why I said:
> Most Linux systems don't run every single program as a separate Linux user. That doesn't mean that those systems are "in fact running everything as one user".
Before you succumb to another fit of rage, take a few deep breaths, review my previous comments, and notice my critique about how Android does things, as well as my commentary about how Android is also a "single-user system" (as TheDong was using the term), and how I think the term is pretty bad, but it's the one that's widely used.