4 ms·

Secureblue: Hardened Immutable Fedora Images

96 points by secureblue 3y ago

INTPenis 3y ago
Most of this can be done with Ansible. So why should I download images from a 3rd party outside of the Fedora project? If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Last time I tried that was maybe Fedora 20 something and it broke a lot.
- secureblue 3y ago
  Most of this can be done with Ansible. All of this can be done in several ways. Ansible, manually, a script, etc. Building it into an image just makes it more convenient. So why should I download images from a 3rd party outside of the Fedora project? All of the CICD is completely open and transparent. You can read through the github actions logs and build config to verify everything for yourself if you want. If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Agreed, that would be a massive improvement. There's a SIG upstream working on it.
  - INTPenis 3y ago
    The ublue images are useful to people, so I'm sure your images will be useful to someone. I'm just making a judgement call for myself. Any other project ontop of Fedora increases the attack vector with its own maintainers. If I can choose between legible Ansible yaml, and an ISO, I find the yaml much easier to grasp and understand. Bundling things you could easily do with yaml into an ISO is almost obfuscation. Because most people are not going to read or understand your build config and logs. While Ansible yaml is clearly labeled and tagged for each action.
    - secureblue 3y ago
      I'm just making a judgement call for myself. Any other project ontop of Fedora increases the attack vector with its own maintainers. Totally understandable. an ISO Small point of correction: we're not publishing ISOs.
- Garcia98 3y ago
  I see this (and other ublue images) as an alternative to Ansible, rather than just an image. I could fork this repo, automate PRs from upstream with a GH action while making my own changes to it and keep an automated CI/CD pipeline. This painless extensibility is a big advantage imo over traditional distributions.
- bravetraveler 3y ago
  Heck, all of this can be done with the installer - Anaconda, with kickstart. I don't understand these spins/release patterns Most of these several gig ISOs amount to two dozen lines of scripting in the kickstarts
  - bravetraveler 3y ago
    note: I realize this release takes advantage of OSTree - that's pretty solid. Flipping an installation to another is clever. I can't edit now but thought this deserved mention
water9 3y ago
Is fedora the best OS to be using as a baseline for security?
- klooney 3y ago
  It's pretty good, they're fairly aggressive with C build tool chain security stuff.
  - water9 3y ago
    Are you not concerned that maybe some of it’s more bleeding edge features are not battle tested?
    - LoganDark 3y ago
      Oh Fedora definitely battle-tests them. RHEL does too.
redder23 3y ago
When I would use an Immutable Linux I would not be able to run Virtualbox right? Because that needs kernel modules loaded and changes to the core system that is immutable or do I get this wrong?
- dijit 3y ago
  immutable means read-only; so if you repackage the OS to have virtualbox in the base image then it would work, theoretically. But why virtualbox over qemu+kvm? KVM is baked into the kernel, is faster, is supported by vagrant (though not all public vagrant boxes) and has a much better track record of security (even now: Virtualbox disables ASLR).
  - yjftsjthsd-h 3y ago
    > KVM is baked into the kernel, is faster, is supported by vagrant (though not all public vagrant boxes) and has a much better track record of security (even now: Virtualbox disables ASLR). Technically supported by Vagrant, but every time I tried it was really painful to try and actually use; it's not built-in, so you have to install the plugin which was awful, and then box support was really poor. (To be fair, I ended up dropping Vagrant rather than KVM)
- yjftsjthsd-h 3y ago
  Immutable is more about the root filesystem not letting you alter it easily; if the modules are included and not blacklisted (this project talks about blacklisting uncommon modules; I haven't looked at the list) there's no reason it wouldn't work fine.
apienx 3y ago
Could you please explain the thought process that led you to settle on Fedora? Thanks!
- secureblue 3y ago
  Universal blue, the starting point for this project, is fedora based. https://universal-blue.org/ https://universal-blue.org/ No other distro has the same level of immutable tooling or support for immutable variants at this time. Also, Fedora has selinux tooling and enforcing mode out of the box and they're working on further selinux improvements upstream, so we'll get that for free.
  - cvalka 3y ago
    Clearlinux?
    - secureblue 3y ago
      Clearlinux has nothing comparable to this as far as I know: https://github.com/ublue-os/startingpoint https://github.com/ublue-os/startingpoint And it's also mainly geared towards server use cases, whereas this project is mainly focused on desktop users.
  - lazylizard 3y ago
    opensuse..tumbleweed..transactional server
yjftsjthsd-h 3y ago
So I'm not against it in the general case, but there are some very specific tradeoffs being made here. > The following are not in scope for this project: > Anything related to increasing "privacy", especially when at odds with improving security > Anything related to "degoogling" Frankly, knowing nothing further, I'm a little concerned that degoogling would be necessary. Like, is that just because the system bakes in Chromium? How much of the user's privacy is this thing selling away in the name of "security"? Then most of the changes described are basically reasonable-sounding (very much trading everything else away in the name of security, but fine so long as the user knows what they're doing), but then there's this: > Disabling unprivileged user namespaces > Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces And that's... again, I'm not going to say wrong, but it's a very specific tradeoff to decide that you trust bubblewrap more than the kernel. It's a plausibly-sensible trade, given the relative number of CVEs in bubblewrap with suid and linux's unprivileged user namespaces, but I'm not sure it sits well with me. And finally, at a slightly more meta-level: Why should I trust this? It's an unofficial respin by an anonymous user; why would a user trust it?
- Retr0id 3y ago
  "degoogling" is nice in theory but I've rarely seen it done well in practice. There are either severe UX tradeoffs, or security pitfalls where maintainers mess with configs they don't actually understand. Having not looked at this project in detail, perhaps it suffers the same fate regardless, but I do find their classification of it as a non-goal to be broadly reassuring. "Not talking to google" might be more important to some people, and perhaps you're one of those people, so it's good that they're clear about priorities.
  - 15457345234 3y ago
    > "degoogling" is nice in theory but I've rarely seen it done well in practice. Install Kali. There - unless you count Firefox - you have a viable 'degoogled' desktop.
  - yjftsjthsd-h 3y ago
    > "degoogling" is nice in theory but I've rarely seen it done well in practice. There are either severe UX tradeoffs, or security pitfalls where maintainers mess with configs they don't actually understand. As heuristics go that's how I feel about many "security" respins
tholdem 3y ago
This is awesome. Hardened_malloc and JITless Chromium OOTB. It's hard to find hardened desktop linux distro, this might be it.
0cf8612b2e1e 3y ago
What is considered the most security conscious OS today? What is the most secure OS that can be run without enormous pain? I am about to rebuild my machine, and have been toying with switching to Qubes or Fedora Silverblue + distrobox, but would love to hear if there are better options available today. I install so much developer tooling it seems inevitable that a bad actor can slip in and upload my $HOME. Trying to ascertain a practical way of segregating personal data from applications. I already run some apps in VMs, but trying to become a bit more rigorous about isolation.
- _factor 3y ago
  An SEL4 kernel based os, but they’re few and far between for desktop use for some reason.
- rustcleaner 3y ago
  [dead]
- xcdzvyn 3y ago
  If only NixOS supported isolating packages/devshells
- sodality2 3y ago
  As mentioned, Qubes would be ideal for this. A new VM for each development project (or same attack levels - for example, VM for professional software dev, VM for side projects, VM for playing around with random interesting GH projects, etc). Requires a ton of RAM though - also a good CPU. And forget about gaming!
- isp 3y ago
  Ironically, ChromeOS is likely the most security-conscious OS available for developers. See: https://news.ycombinator.com/item?id=37783081 https://news.ycombinator.com/item?id=37783081 However, it is definitely not the most privacy-focused OS, due to deep Google integration. This is the main reason that I haven't moved myself over to ChromeOS.
wolverine876 3y ago
> Anything related to "degoogling" Fedora includes Google components?
- secureblue 3y ago
  Some people think that Brave is preferable to Chromium because they "degoogle" it.
  - wolverine876 3y ago
    Ah, so it's just Chromium. Thanks.
Hizonner 3y ago
No threat model given. > Adds per-network MAC randomization Where the heck is this thing being used? > Setting more restrictive file permissions (Based on recommendations from lynis) Often results in more code being run privileged... > Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions Introduces a serious DoS vulnerability. > Disabling unprivileged user namespaces > Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation. > Installing Chromium into the base image (Why chromium?) (Why not flatpak chromium?) Just more attack surface if you didn't remove Firefox. > Including a hardened chromium config (disabling JIT javascript) ... and pushing everybody into a less tested code path. Again, what is this trying to solve?
- Alupis 3y ago
  One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Security is always a trade off with convenience. Nobody will be installing this distro by accident, so your "who's this for? what is it trying to solve" is a bit misdirected. With that said - immutable is clearly the future for all operating systems, not just Linux Distros. It doesn't have much to do with security, although that is a side-effect. It mostly has to do with system stability, testability and repeatability. Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. After you setup your traditional machine, you install various drivers, updates, software, tweak some settings, remove some things - now your environment is unique to only you. This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Immutable solves that.
  - Hizonner 3y ago
    > One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Maybe that's clear to you. > With that said - immutable is clearly the future for all operating systems, not just Linux Distros. Kind of a side issue. However... > Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. ... until you actually want to use it, at which point you're installing software in some kind of user account or application area, and you get to reexperience all the same problems and reinvent the solutions. Except with an extra layer of complexity to separate the "base image" from whatever you're actually trying to use the computer for. > This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Everyone's actual applications and needs are different.

96 points by secureblue 3y ago

Most of this can be done with Ansible. So why should I download images from a 3rd party outside of the Fedora project? If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Last time I tried that was maybe Fedora 20 something and it broke a lot.

secureblue 3y ago
Most of this can be done with Ansible. All of this can be done in several ways. Ansible, manually, a script, etc. Building it into an image just makes it more convenient. So why should I download images from a 3rd party outside of the Fedora project? All of the CICD is completely open and transparent. You can read through the github actions logs and build config to verify everything for yourself if you want. If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Agreed, that would be a massive improvement. There's a SIG upstream working on it.
- INTPenis 3y ago
  The ublue images are useful to people, so I'm sure your images will be useful to someone. I'm just making a judgement call for myself. Any other project ontop of Fedora increases the attack vector with its own maintainers. If I can choose between legible Ansible yaml, and an ISO, I find the yaml much easier to grasp and understand. Bundling things you could easily do with yaml into an ISO is almost obfuscation. Because most people are not going to read or understand your build config and logs. While Ansible yaml is clearly labeled and tagged for each action.
  - secureblue 3y ago
    I'm just making a judgement call for myself. Any other project ontop of Fedora increases the attack vector with its own maintainers. Totally understandable. an ISO Small point of correction: we're not publishing ISOs.
Garcia98 3y ago
I see this (and other ublue images) as an alternative to Ansible, rather than just an image. I could fork this repo, automate PRs from upstream with a GH action while making my own changes to it and keep an automated CI/CD pipeline. This painless extensibility is a big advantage imo over traditional distributions.
bravetraveler 3y ago
Heck, all of this can be done with the installer - Anaconda, with kickstart. I don't understand these spins/release patterns Most of these several gig ISOs amount to two dozen lines of scripting in the kickstarts
- bravetraveler 3y ago
  note: I realize this release takes advantage of OSTree - that's pretty solid. Flipping an installation to another is clever. I can't edit now but thought this deserved mention

water9 3y ago

Is fedora the best OS to be using as a baseline for security?

klooney 3y ago
It's pretty good, they're fairly aggressive with C build tool chain security stuff.
- water9 3y ago
  Are you not concerned that maybe some of it’s more bleeding edge features are not battle tested?
  - LoganDark 3y ago
    Oh Fedora definitely battle-tests them. RHEL does too.

redder23 3y ago

When I would use an Immutable Linux I would not be able to run Virtualbox right? Because that needs kernel modules loaded and changes to the core system that is immutable or do I get this wrong?

dijit 3y ago
immutable means read-only; so if you repackage the OS to have virtualbox in the base image then it would work, theoretically. But why virtualbox over qemu+kvm? KVM is baked into the kernel, is faster, is supported by vagrant (though not all public vagrant boxes) and has a much better track record of security (even now: Virtualbox disables ASLR).
- yjftsjthsd-h 3y ago
  > KVM is baked into the kernel, is faster, is supported by vagrant (though not all public vagrant boxes) and has a much better track record of security (even now: Virtualbox disables ASLR). Technically supported by Vagrant, but every time I tried it was really painful to try and actually use; it's not built-in, so you have to install the plugin which was awful, and then box support was really poor. (To be fair, I ended up dropping Vagrant rather than KVM)
yjftsjthsd-h 3y ago
Immutable is more about the root filesystem not letting you alter it easily; if the modules are included and not blacklisted (this project talks about blacklisting uncommon modules; I haven't looked at the list) there's no reason it wouldn't work fine.

apienx 3y ago

Could you please explain the thought process that led you to settle on Fedora? Thanks!

secureblue 3y ago
Universal blue, the starting point for this project, is fedora based. https://universal-blue.org/ https://universal-blue.org/ No other distro has the same level of immutable tooling or support for immutable variants at this time. Also, Fedora has selinux tooling and enforcing mode out of the box and they're working on further selinux improvements upstream, so we'll get that for free.
- cvalka 3y ago
  Clearlinux?
  - secureblue 3y ago
    Clearlinux has nothing comparable to this as far as I know: https://github.com/ublue-os/startingpoint https://github.com/ublue-os/startingpoint And it's also mainly geared towards server use cases, whereas this project is mainly focused on desktop users.
- lazylizard 3y ago
  opensuse..tumbleweed..transactional server

yjftsjthsd-h 3y ago

So I'm not against it in the general case, but there are some very specific tradeoffs being made here. > The following are not in scope for this project: > Anything related to increasing "privacy", especially when at odds with improving security > Anything related to "degoogling" Frankly, knowing nothing further, I'm a little concerned that degoogling would be necessary. Like, is that just because the system bakes in Chromium? How much of the user's privacy is this thing selling away in the name of "security"? Then most of the changes described are basically reasonable-sounding (very much trading everything else away in the name of security, but fine so long as the user knows what they're doing), but then there's this: > Disabling unprivileged user namespaces > Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces And that's... again, I'm not going to say wrong, but it's a very specific tradeoff to decide that you trust bubblewrap more than the kernel. It's a plausibly-sensible trade, given the relative number of CVEs in bubblewrap with suid and linux's unprivileged user namespaces, but I'm not sure it sits well with me. And finally, at a slightly more meta-level: Why should I trust this? It's an unofficial respin by an anonymous user; why would a user trust it?

Retr0id 3y ago
"degoogling" is nice in theory but I've rarely seen it done well in practice. There are either severe UX tradeoffs, or security pitfalls where maintainers mess with configs they don't actually understand. Having not looked at this project in detail, perhaps it suffers the same fate regardless, but I do find their classification of it as a non-goal to be broadly reassuring. "Not talking to google" might be more important to some people, and perhaps you're one of those people, so it's good that they're clear about priorities.
- 15457345234 3y ago
  > "degoogling" is nice in theory but I've rarely seen it done well in practice. Install Kali. There - unless you count Firefox - you have a viable 'degoogled' desktop.
- yjftsjthsd-h 3y ago
  > "degoogling" is nice in theory but I've rarely seen it done well in practice. There are either severe UX tradeoffs, or security pitfalls where maintainers mess with configs they don't actually understand. As heuristics go that's how I feel about many "security" respins

tholdem 3y ago

This is awesome. Hardened_malloc and JITless Chromium OOTB. It's hard to find hardened desktop linux distro, this might be it.

0cf8612b2e1e 3y ago

What is considered the most security conscious OS today? What is the most secure OS that can be run without enormous pain? I am about to rebuild my machine, and have been toying with switching to Qubes or Fedora Silverblue + distrobox, but would love to hear if there are better options available today. I install so much developer tooling it seems inevitable that a bad actor can slip in and upload my $HOME. Trying to ascertain a practical way of segregating personal data from applications. I already run some apps in VMs, but trying to become a bit more rigorous about isolation.

_factor 3y ago
An SEL4 kernel based os, but they’re few and far between for desktop use for some reason.
rustcleaner 3y ago
[dead]
xcdzvyn 3y ago
If only NixOS supported isolating packages/devshells
sodality2 3y ago
As mentioned, Qubes would be ideal for this. A new VM for each development project (or same attack levels - for example, VM for professional software dev, VM for side projects, VM for playing around with random interesting GH projects, etc). Requires a ton of RAM though - also a good CPU. And forget about gaming!
isp 3y ago
Ironically, ChromeOS is likely the most security-conscious OS available for developers. See: https://news.ycombinator.com/item?id=37783081 https://news.ycombinator.com/item?id=37783081 However, it is definitely not the most privacy-focused OS, due to deep Google integration. This is the main reason that I haven't moved myself over to ChromeOS.

wolverine876 3y ago

> Anything related to "degoogling" Fedora includes Google components?

secureblue 3y ago
Some people think that Brave is preferable to Chromium because they "degoogle" it.
- wolverine876 3y ago
  Ah, so it's just Chromium. Thanks.

Hizonner 3y ago

No threat model given. > Adds per-network MAC randomization Where the heck is this thing being used? > Setting more restrictive file permissions (Based on recommendations from lynis) Often results in more code being run privileged... > Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions Introduces a serious DoS vulnerability. > Disabling unprivileged user namespaces > Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation. > Installing Chromium into the base image (Why chromium?) (Why not flatpak chromium?) Just more attack surface if you didn't remove Firefox. > Including a hardened chromium config (disabling JIT javascript) ... and pushing everybody into a less tested code path. Again, what is this trying to solve?

Alupis 3y ago
One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Security is always a trade off with convenience. Nobody will be installing this distro by accident, so your "who's this for? what is it trying to solve" is a bit misdirected. With that said - immutable is clearly the future for all operating systems, not just Linux Distros. It doesn't have much to do with security, although that is a side-effect. It mostly has to do with system stability, testability and repeatability. Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. After you setup your traditional machine, you install various drivers, updates, software, tweak some settings, remove some things - now your environment is unique to only you. This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Immutable solves that.
- Hizonner 3y ago
  > One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Maybe that's clear to you. > With that said - immutable is clearly the future for all operating systems, not just Linux Distros. Kind of a side issue. However... > Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. ... until you actually want to use it, at which point you're installing software in some kind of user account or application area, and you get to reexperience all the same problems and reinvent the solutions. Except with an extra layer of complexity to separate the "base image" from whatever you're actually trying to use the computer for. > This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Everyone's actual applications and needs are different.