Secure general purpose desktop OS

Outside of QubesOS and ChromeOS, what's the best desktop OS when it comes to security? Can Linux compete with macOS's security model if properly hardened? (MAC on everything that's feasible to confine, bubblewrap sandboxes for every desktop app, sandboxed systemd services for daemons, "minimal" self compiled kernel with the GrapheneOS patches, hardened malloc etc). If not, are the BSDs possible to adequately secure without *too* much effort? I know that Wayland support isn't that great at least in OpenBSD. Does the sound system in these OSes also leak audio to other programs like what pulseaudio does?

>>24476 you are doing nothing but schizoing around if you don't state, or at minimum come up with a threat model

>>24477 The threat model is to prevent a malicious or compromised program from compromising the entire system

>>24478 remove sudo, disable su, nuke polkit or configure it properly and hope your linux kernel doesn't have a privesc (spoiler: it does). also don't forget to upgrade. next step would be ensuring system integrity. anti viruses and such. need to monitor internet traffic, file system operations and so on. maybe even have a separate supervisor idk. you know what i mean. checksumming everything and the like. maybe noexec on every filesystem except root. lots of ways. read books. https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html not only it's a resource in itself it references (a) book(s) from which you can proceed. here look, you are now a security expert

>>24479 Wouldnt you only need to disable init use to different users to prevent privilege escalation via su or is there another reason for concern? What is bad about polkit? While it is concerning it took 13 years for anyone to notice the memory vulnerability in it , what is the rational? That the developers are incompetent? Is SELinux and AppArmor considered in same line of use or are these unrelated in what they do?

>>24480 >polkit pkexec udisks etc. keeping track of all actions is nauseous i just configured it to deny everything except what i know is safe enough for my purposes >Wouldnt you only need to disable init use to different users to prevent privilege escalation via su man su it uses pam on most distros so somewhere in /etc/pam* there's a config.

>>24476 >Outside of QubesOS and ChromeOS, what's the best desktop OS when it comes to security? In most cases, Whonix, then OpenBSD.

the only secure os is the one that doesn't work calm down please

>>24489 >one that doesnt work No wonder so many think any Linux distro is so secure.

>>24476 >Can Linux compete with macOS's security model Linux is more secure than macOS because Apple doesn't have a ring-0 backdoor into linux. >inb4 you're not trying to defend against attacks from Apple That's why you need to define your threat model before making dumb threads like this.

>>24492 Seems to clear to me OP is talking about protection from cybercriminals.

>>24479 I think bubblejail with seccomp already mitigates suid binaries' harmful potential via the no new privs flag, no? I dont think the sudo vulnerability could have been exploited in this environmsnt but I could be wrong. >>24504 Yes. macOS and ChromeOS offer soykaf privacy but are praised for their security practices. I think ChromeOS is better than macOS, as applications can still run unconfined on the former afaik

>>24553 From track record I'd say Apple likely respects some degree of privacy more than Microsoft or Google. For example OneDrive and Google Drive is pretty intrusive but iCloud has user side encryption these days. Apple Maps isnt as invasive as Google Maps from what data they gather. So if someone for some reason is unable or unwilling to use some flavor of Linux or BSD then macOS is likely more trustworthy than Windows or ChromeOS for privacy even though they are getting some info from the user. Im not sure if ChromeOS or macOS is more secure. IIRC when first running a program on mac it wont even execute it until you give an administrator password so malware can only be installed and run by user error as far as I am aware unless it uses some sort of active exploit. If ChromeOS is like Android with permissions control that is good for security but there is a lot of info that can be grabbed without any permissions at all so it's use would be limited.

>>24478 See what https://lainchan.org/%CE%A9/res/80783.html#q80802 mentioned about Pledge and Landlock.

>>24476 OpenBSD is piss easy IF you have adequately supported hardware. I got into it two weeks ago at 7.5, upgraded to 7.6 last week and that was painless. The manpages are very good. 999Mhz of pure win, baby.

>>24982 Does it have the same apps as linux? What would I be missing for switching from linux to bsd as a daily driver?

>>24988 Many programs have been ported to OpenBSD already over the years and many Linux-only programs are easy to port to OpenBSD yourself if you put in enough effort. Yet, and that is probably what you will miss (I'm guessing from your usage of the word "app"), is proprietary software like Steam, which is practically impossible to port to OpenBSD. OpenBSD is not another Linux distribution, the same way Linux is not another Windows version. You will have to learn to do things differently and think differently about your OS, then you would with Linux. If you get into Linux and expect all your computing habits to be the same as on Windows, you will have a very bad experience. Common misunderstandings of newbies, is that they think they can use Linux without terminal programs or even just to a large degree without terminal programs or that they can use the same software as on Windows, but with Wine and virtual machines. This is a fatal misunderstanding, that will lead to a lot of suffering! Everybody who claims you can use Linux without ever touching a terminal emulator, is lying to you. The same way everybody. who claims running everything with Wine or VMs is lying to you. You see, the same applies when switching from Linux to OpenBSD. It is not another Linux distro, therefor settle for a different way of computing or don't use it, but don't complain when things are different, because it literally is a different operating system you are running, not just another different-looking GUI. But I digress....much of Linux software runs well on OpenBSD, but also a lot of it has to be fixed by (You) to run. (You) will have to figure out things yourself. Don't expect Windows programs to run on OpenBSD and read the friendly manual.

>>24988 The main reason to avoid openbsd is lack of security. There are no containers or namespaces or mandatory access controls. In short there is no way to protect yourself from malicious code the openbsd developers just assume that everything you run is 100% trusted to not do anything bad.

>>24988 biggest drawback (which is also a security feature of course) is not being able to run linux executables, they dropped support some years ago, Which means whatever program you find for example on github you can't just use the linux executable. You either need to compile or search on ports(7) (stuff compiled by users) or the pkg_info(1) repo (ports that get reviewed and make it to the repos). OpenBSD uses it's own implementation of libc (literally called 'libc') so you may run into issues similarly to alpine musl as normally linux devs use glibc. Though i never ran into issues, most stuff that requires a specific glibc thing is bloat or crap. It also uses its own system compiler which is a modified version of clang: man.openbsd.org/man1/clang-local.1 but you can install gcc from the repos and many other compilers. also what >>24989 said. People were sold by tech tubers to use linux as a copycat windows (proprietary crap like steam, discord, then bloated DEs, wine...). I don't really need to explain it, once you start to use minimal OSs like alpine or openbsd and you get used to it you start to understand the real difference between UNIX and modern popular distros/macos/windows. >>24990 >There are no containers or namespaces or mandatory access controls https://man.openbsd.org/pledge.2 https://man.openbsd.org/unveil.2 and much more: https://www.openbsd.org/security.html https://www.openbsd.org/innovations.html >openbsd developers just assume that everything you run is 100% trusted to not do anything bad. send this at misc@openbsd.org, you shouldn't get any complaints since you're so sure that you're posting this in every openbsd related thread. Theo is there too!

>>24991 pledge is not a container it is a capability framework. The difference is a container or mac applies the security policy from the outside (me the user is deciding what is and isn't allowed). pledge is a source level capability framework applied from the inside (the developer decides what is and isn't allowed). A malicious developer will just write a malicious pledge policy that allows his malicious code to run. pledge is for developers to protect you from mistakes, it cannot protect you from malicious developers. That's why pledge is not sandboxing. Openbsd has no sandboxing. >and much more All of openbsd's security is centered around preventing attackers executing code you didn't allow. What's missing is to allow code to run while putting restrictions on what it can do. In linux I use a container, in fbsd I use a jail, in solaris I use a zone. In openbsd there is nothing. >send this at misc@openbsd.org. Theo is there too! I'm sure theo understands his own threat model. He didn't add sandboxing or mac or virtualization on purpose. If you don't like the fact that firefox opens your webcam and spies on you then the openbsd solution is to fork firefox and remove the webcam code. It's a bullshit policy but it sure saves theo a lot of work. >you're posting this in every openbsd related thread If somebody else is posting it too then you should take your head out of the sand and think about it. The other problem with openbsd is that it's like a cult, users don't understand security they just think everything is magically safe. But you didn't read the smallprint, openbsd is the most secure operating system only as long as you don't run any malicious code. Otherwise it is less secure than windows.

>>24992 >A malicious developer will just write a malicious pledge policy that allows his malicious code to run What the fuarrrk are you even talking about? A developer would not pledge his program period dumbass. The point of pledge is to restrict system operations of a program. Even the shell is pledged. That means if a binary tries to do soykaf (and it has to be a binary compiled on openbsd, not linux) it will core dump. >If somebody else is posting it too then you should take your head out of the sand and think about it. You literally wrote the same sentences on other threads retard lmao. Do they pay you to spread the gospel?

>>24993 >What the fuarrrk are you even talking about? >A developer would not pledge his program period pledge is a C function added to the source code of a program before compilation. When you install a package it has already been compiled with all the pledge calls inside it. The user has no control over the pledge policy, only the developer can add it. https://man.openbsd.org/pledge.2 >dumbass. You're the one who doesn't understand how his own OS works. >You literally wrote the same sentences on other threads retard lmao. Do they pay you to spread the gospel? This is a well known criticism of pledge and openbsd.

The implementation of the pledge approach for Linux https://justine.lol/pledge is as a general tool to constrain executables. A general tool that has the same interface and effective functionality but for OpenBSD is exactly what many users want.

Fedora, maybe? It’s got okay defaults.

Can anyone give the eli5 / QRD on the truth about BSD vs. Linux? These guys are now fighting over what seems to be ( ( ( semantics ) ) ) about 'mac vs. pledge' both seem to be execution control. I've been seeing this "Don't use BSD" FUD-type stuff on the chans for years. I'm guessing this is a legit Mossad concern. "If you're Unit 8200 use BSD. If you're white or just not a zionist, then DON'T USE BSD", seems to be the internal policy. And if it's true OpenBSD has problems, what about HardenedBSD which seems to solve many weaknesses: https://hardenedbsd.org/content/easy-feature-comparison And to that glowie outside the Ukrainian bar who tried to bait me with White Lives Matter, I know who you are you chuddy fuarrrk. Still embedded at the US Embassy? What will you do when Azov figures that some senile world leader threw 800,000 of their fellow countrymen under the bus when there were more creative alternatives that the world leader couldn't envision because he's senile, and you all lied about it? Are you ready for your Mujaheddin / Taliban 2.0? I must say, for the white race this is truly the best of times to be alive.

There is no "BSD vs Linux" issue anywhere on the internet that I've ever seen, and anyone who saus there is is completely full of soykaf.

>>25005 BSD vs. Qubes then. What say you?

>>25004 >These guys are now fighting over what seems to be ( ( ( semantics ) ) ) about 'mac vs. pledge' both seem to be execution control The difference is about who controls of policy, you are the developers. Mandatory Access Controls (SELinux, AppArmor, Tomoyo etc.) you the user write the policy and then the OS will restrict all programs running on the system. So you can write a policy to stop firefox from using your webcam and there's nothing mozilla can do about it. Pledge is a policy that the developer writes to constrain his own program. The idea is that when firefox runs it makes a "pledge" to the OS to say I will do the following actions and nothing else. So if an attacker gains control of firefox through a vulnerability then tries to do something not allowed by the pledge policy it will be blocked. So the openbsd approach gives you zero protection from untrusted developers. If firefox wants to spy on your webcam openbsd gives you no way to stop it besides opening up the firefox source code and making changes. That makes you double fuarrrked if you need to run closed source software on openbsd. And it's not just mandatory access controls linux has containers, namespaces, virtual machines all of which can also be used to sandbox and restrict untrusted code. Openbsd has had 30 years to develop something similar but refused. All they have is a half finished hypservisor they've been working on for the past decade. >what about HardenedBSD It's based on freebsd and freebsd is a flaming trashfire for security, worse than linux. Their RNG was broken for like 3 months once before anybody noticed, they have trivial buffer overflows in internet facing code every year. And every bug that gets added to freebsd will be pulled into hardenedbsd a week later. The exploit mitigations might save you they might not. It is also a tiny project they don't have enough developers to make such a massive legacy OS like freebsd truly secure. >I've been seeing this "Don't use BSD" FUD-type stuff on the chans for years. It's not like linux is perfect either. I wish someone could change my mind about BSD. The dude who doesn't even understand how pledge works is obviously not the one to do it though. >I'm guessing this is a legit Mossad concern Wait until you find out which country Intel's chip design center is in. >>25005 >There is no "BSD vs Linux" issue anywhere on the internet that I've ever seen People get dumb and tribal about anything if you give them a chance. It's mostly on the BSD side though since they are the underdogs they are the ones who have to justify to themselves why they don't just use linux. So they make up reasons why BSD is better and then double down when they cross paths with a linux user. >>25006 >BSD vs. Qubes Qubes uses linux by default but it's not married to it. In theory you could use any OS that supports xen.

>and ChromeOS ChromeOS is not secure the firmware is which is based off coreboot and "Write Protected" with a physical screw

>>25007 Thanks for all this. Interesting about Pledge. Seems if you have a specific all open source use case for BSD, it could be better in some regards. But if you need to use non-opensource vms in qubes probably is better. You say qubes uses, xen, but it's pretty much just to load Fedora (dom0). Is there something better that could run dom0? Why would it be so hard to port? I'm not convinced that just because it doesn't have networking it can't be hacked. I was reading about heads, and on some random board (probably x230) they found a backdoor through the soundcard to do something to the chip I forget, but don't need networking for that! God only knows what else these chips are secretly programmed to do by electrical engineers trying to cut corners at the fabs. And yea, I see theres a bunch of Intel fabs in the ((( Holy Land ))). Fug. Didn't know. Concerning having a use case that only requires open source, it seems BSD is better suited for firewalls and networking, would you concur?

>>25014 Total International Strategic Failure: https://en.wikipedia.org/wiki/Glue_logic

>>24476 44 65 62 69 61 6e 20 4d 6f 72 70 68 20 6f 72 20 43 4c 49 0a 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 69 63 6b 73 65 63 75 72 65 2e 63 6f 6d 2f

Secureblue is *very* close to what you describe, and no, the BSDs are nowhere close in terms of ootb efforts in increasing security for desktop usage. Secureblue is based off universal blue, which is based off fedora silverblue, so it's one of these new immutable distros, only that ublue includes things like rpmfusion and nvidia drivers if you need them, which plain silverblue doesn't. Secureblue then adds further SELinux confinement, preloads its apps with grapheneos' hardened_malloc, as well as flatpaks, and you can use podman-based distrobox and toolbox containers for other applications. You can choose between virtually every popular Wayland DE or tiling compositor available. The most recent change they did is removing sudo, su, and pkexec in favor of a systemd-managed solution (run0) The lead dev will still likely tell you it's not as secure as macos, but it's good if you want to use linux

>>25382 >The lead dev will still likely tell you it's not as secure as macos, but it's good if you want to use linux Did he actually say that or are you just projecting your own dumb opinions?

>>25383 Not talking glower backdoors, but overall security from exploitation, Joanna Rutkowska (Qubes) would tell you the same thing, why do you think the approach to qubes was virtualization instead of hardening? Linux *desktop* security has only recently began to pick up pace. Answering your question though, they have said macos is ahead in some fields like verified boot. My opinion is that it's a bit more nuanced than "A is always more secure than B". Hope this helps