Secureblue: Hardened Immutable Fedora Images
1–10 of 51 posts
Re: Secureblue: Hardened Immutable Fedora Images
#2Most of this can be done with Ansible. So why should I download images from a 3rd party outside of the Fedora project?
If you really want to harden an OS with a good SElinux implementation you should try enabling user roles.
Last time I tried that was maybe Fedora 20 something and it broke a lot.
Re: Secureblue: Hardened Immutable Fedora Images
#3Is fedora the best OS to be using as a baseline for security?
Re: Secureblue: Hardened Immutable Fedora Images
#4When I would use an Immutable Linux I would not be able to run Virtualbox right? Because that needs kernel modules loaded and changes to the core system that is immutable or do I get this wrong?
Re: Secureblue: Hardened Immutable Fedora Images
#5Most of this can be done with Ansible. So why should I download images from a 3rd party outside of the Fedora project? If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Last time I tried that was maybe Fedora 20 something and it broke a lot.
Most of this can be done with Ansible.
All of this can be done in several ways. Ansible, manually, a script, etc. Building it into an image just makes it more convenient.
So why should I download images from a 3rd party outside of the Fedora project?
All of the CICD is completely open and transparent. You can read through the github actions logs and build config to verify everything for yourself if you want.
If you really want to harden an OS with a good SElinux implementation you should try enabling user roles.
Agreed, that would be a massive improvement. There's a SIG upstream working on it.
Re: Secureblue: Hardened Immutable Fedora Images
#6Is fedora the best OS to be using as a baseline for security?
It's pretty good, they're fairly aggressive with C build tool chain security stuff.
Re: Secureblue: Hardened Immutable Fedora Images
#7Re: Secureblue: Hardened Immutable Fedora Images
#8Could you please explain the thought process that led you to settle on Fedora? Thanks!
Re: Secureblue: Hardened Immutable Fedora Images
#9Re: Secureblue: Hardened Immutable Fedora Images
#10So I'm not against it in the general case, but there are some very specific tradeoffs being made here.
> The following are not in scope for this project:
> Anything related to increasing "privacy", especially when at odds with improving security
> Anything related to "degoogling"
Frankly, knowing nothing further, I'm a little concerned that degoogling would be necessary. Like, is that just because the system bakes in Chromium? How much of the user's privacy is this thing selling away in the name of "security"?
Then most of the changes described are basically reasonable-sounding (very much trading everything else away in the name of security, but fine so long as the user knows what they're doing), but then there's this:
> Disabling unprivileged user namespaces
> Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces
And that's... again, I'm not going to say wrong, but it's a very specific tradeoff to decide that you trust bubblewrap more than the kernel. It's a plausibly-sensible trade, given the relative number of CVEs in bubblewrap with suid and linux's unprivileged user namespaces, but I'm not sure it sits well with me.
And finally, at a slightly more meta-level: Why should I trust this? It's an unofficial respin by an anonymous user; why would a user trust it?