Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secureblue: Hardened Immutable Fedora Images

github.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Secureblue: Hardened Immutable Fedora Images

#41

Post by yjftsjthsd-h »

secureblue wrote: post #39
yjftsjthsd-h wrote: post #28

Earlier quoted context omitted.

> I don't follow. The readme specifically says it's not in scope. Let me rephrase: What is your distro doing that would make someone want to degoogle it?

What is your distro doing that would make someone want to degoogle it? Certain users have expressed a preference towards Brave instead of Chromium because in their view Brave's "degoogling" of chromium is preferable. That line is in the readme to clarify that this is not a concern for the project and not in scope.

If that's what you mean, I would strongly suggest just saying that in the readme

Re: Secureblue: Hardened Immutable Fedora Images

#42

Post by secureblue »

yjftsjthsd-h wrote: post #41
secureblue wrote: post #39

Earlier quoted context omitted.

What is your distro doing that would make someone want to degoogle it? Certain users have expressed a preference towards Brave instead of Chromium because in their view Brave's "degoogling" of chromium is preferable. That line is in the readme to clarify that this is not a concern for the project and not in scope.

If that's what you mean, I would strongly suggest just saying that in the readme

Just changed it. Thanks for the feedback!

Re: Secureblue: Hardened Immutable Fedora Images

#43

Post by isp »

0cf8612b2e1e wrote: post #22

What is considered the most security conscious OS today? What is the most secure OS that can be run without enormous pain? I am about to rebuild my machine, and have been toying with switching to Qubes or Fedora Silverblue + distrobox, but would love to hear if there are better options available today. I install so much developer tooling it seems inevitable that a bad actor can slip in and upload my $HOME. Trying to…

Ironically, ChromeOS is likely the most security-conscious OS available for developers. See: https://news.ycombinator.com/item?id=37783081

However, it is definitely not the most privacy-focused OS, due to deep Google integration. This is the main reason that I haven't moved myself over to ChromeOS.

Re: Secureblue: Hardened Immutable Fedora Images

#44

Post by getwiththeprog »

Alupis wrote: post #36
Hizonner wrote: post #34

Earlier quoted context omitted.

> One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Maybe that's clear to you. > With that said - immutable is clearly the future for all operating systems, not just Linux Distros. Kind of a side issue. However... > Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely t…

For everyday usage, like surfing the internet, word processing, emails, gaming, etc - these are all non-issues. Sandboxed app environments are easily accomplished today in various ways on Linux and other immutable OS (there's more than you think, including popular mobile operating systems). The base image never needs to change for any application to be installed and used. Layering is not even a requirement for almost…

Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact with the hardware layer, and the requirement of putting another layer under the immutable software layer (eg the sanboxed OS one actually wants to use.

Why do we not just go to an OS baked into hardware? Because we value updates. The rolling bug-wall that is Linux is a feature, because every OS ever created has holes and flaws and lacks features. It is a nice idea that we could all be on the same system that works flawlessly, but it is not an achievable reality. So while immutable may be the future, it will always be in the future.

Re: Secureblue: Hardened Immutable Fedora Images

#45

Post by cvalka »

secureblue wrote: post #16
apienx wrote: post #8

Could you please explain the thought process that led you to settle on Fedora? Thanks!

Universal blue, the starting point for this project, is fedora based. https://universal-blue.org/ No other distro has the same level of immutable tooling or support for immutable variants at this time. Also, Fedora has selinux tooling and enforcing mode out of the box and they're working on further selinux improvements upstream, so we'll get that for free.

Clearlinux?

Re: Secureblue: Hardened Immutable Fedora Images

#46

Post by secureblue »

cvalka wrote: post #45
secureblue wrote: post #16

Earlier quoted context omitted.

Universal blue, the starting point for this project, is fedora based. https://universal-blue.org/ No other distro has the same level of immutable tooling or support for immutable variants at this time. Also, Fedora has selinux tooling and enforcing mode out of the box and they're working on further selinux improvements upstream, so we'll get that for free.

Clearlinux?

Clearlinux has nothing comparable to this as far as I know: https://github.com/ublue-os/startingpoint

And it's also mainly geared towards server use cases, whereas this project is mainly focused on desktop users.

Re: Secureblue: Hardened Immutable Fedora Images

#47

Post by Alupis »

getwiththeprog wrote: post #44
Alupis wrote: post #36

Earlier quoted context omitted.

For everyday usage, like surfing the internet, word processing, emails, gaming, etc - these are all non-issues. Sandboxed app environments are easily accomplished today in various ways on Linux and other immutable OS (there's more than you think, including popular mobile operating systems). The base image never needs to change for any application to be installed and used. Layering is not even a requirement for almost…

Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact with the hardware layer, and the requirement of putting another layer under the immutable software layer (eg the sanboxed OS one actually wants to use. Why do we not just go to an OS baked into hardware? Because we value updates. The rolling bug-wall that is Lin…

Immutable does not mean "no updates". Immutable means you and I both are running the same base image, given we are running the same version of base image.

As of right now, the system I type this on is updating to "Fedora Kinoite 39.20231215.1". Every single person who has done this same update will be running exactly the same base image, ie. our root filesystems will be identical. Further, the root filesystem was built in a "repeatable/reproducible" way, which means you could go so far as to verify the base image by building it yourself and get an identical output.

This means that base image (read: root filesystem) can be thoroughly tested before it's released. There is no "config drift" with the root filesystem, no drivers/software modifying things in strange ways that might cause unexpected behavior, etc.

In OS-Tree based distributions, you can layer on top of the base image, which creates a new runtime image. Layers can modify the runtime root filesystem, but not the base image's root filesystem! If something breaks, it's as simple as disabling that layer and rebooting, or rolling-back to the previous version. This means in practice it's nearly impossible to actually break your system. You can kind of think of it like "git for operating systems", complete with "git revert" abilities...

The preferred way to install software is via some sort of runtime sandbox, such as Flatpack or similar. This does not modify the root filesystem in any way, and therefore cannot cause an issue at that level. There are additional benefits to running sandboxed applications without access to the root filesystem, such as increased security, but that's a side effect. The main goal is system stability.

I can update entire versions of the OS (say, Fedora 38 -> 39, which I did recently) without any worries my system will be unbootable afterwards. It's not a possibility, barring any hardware issues.

Immutable OS' are a great concept, and will be the future for all "normal" computer users. Many consumer-facing OS' are already immutable, even if they don't advertise as such. These include Android and iOS, ChromeOS and more (with some varying degrees of immutability). These systems are also the least likely to need a wipe/reset once-in-a-while - something Windows users have grown accustomed to.

Re: Secureblue: Hardened Immutable Fedora Images

#48

Post by TheCoelacanth »

getwiththeprog wrote: post #44
Alupis wrote: post #36

Earlier quoted context omitted.

For everyday usage, like surfing the internet, word processing, emails, gaming, etc - these are all non-issues. Sandboxed app environments are easily accomplished today in various ways on Linux and other immutable OS (there's more than you think, including popular mobile operating systems). The base image never needs to change for any application to be installed and used. Layering is not even a requirement for almost…

Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact with the hardware layer, and the requirement of putting another layer under the immutable software layer (eg the sanboxed OS one actually wants to use. Why do we not just go to an OS baked into hardware? Because we value updates. The rolling bug-wall that is Lin…

Immutable = no updates is just a complete misunderstanding of what an immutable OS is.

In fact, it's the exact opposite. It makes it much easier and safer to update because you can immediately roll back to a working version if something breaks.

Re: Secureblue: Hardened Immutable Fedora Images

#49

Post by bravetraveler »

bravetraveler wrote: post #37
INTPenis wrote: post #2

Most of this can be done with Ansible. So why should I download images from a 3rd party outside of the Fedora project? If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Last time I tried that was maybe Fedora 20 something and it broke a lot.

Heck, all of this can be done with the installer - Anaconda, with kickstart. I don't understand these spins/release patterns Most of these several gig ISOs amount to two dozen lines of scripting in the kickstarts

note: I realize this release takes advantage of OSTree - that's pretty solid. Flipping an installation to another is clever.

I can't edit now but thought this deserved mention

Re: Secureblue: Hardened Immutable Fedora Images

#50

Post by secureblue »

Hizonner wrote: post #29

No threat model given. > Adds per-network MAC randomization Where the heck is this thing being used? > Setting more restrictive file permissions (Based on recommendations from lynis) Often results in more code being run privileged... > Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions Introduces a serious DoS vuln…

FYI, both userns and non-userns variants are now available. https://github.com/secureblue/secureblue/commit/38999d4123aa...
Post reply on HN