OS setup

Hello /sec/, I come to you with a conundrum. I want to have a laptop with "beefed-up security", but I'm also going to be using it for dev work and general crap like video conferencing. Right now it runs alpine as a temporary solution, I pretty much just use the browser (librewolf), but in the past I have used GuixSD and found it to be much more pleasant for development. The main goals I have are: having long battery life, being able to 'safely' run nonfree software such as zoom, and having 'more than baseline' hardening/security-in-depth. In particular I want to have a way to run applications in *effective* process jails, but I also want flexibility to download and run new applications easily. At the moment, I am waffling between four different choices: -QubesOS, laziest and most battery-draining option. -SpectrumOS or something SpectrumOS-like. This is meant to be a compromise solution between Qubes and a more 'regular' linux setup. Jankier and with more rough edges, but would be substantially lighter weight as the drivers would be running in the host kernel. -As above, but using hardened gentoo + SELinux and containers instead of full virtual machines. I am leaning somewhat towards this option, but it would be a lot of work and I'm not sure if it's worth. -Just use GuixSD (with nonguix) and be assiduous with use of the container option. Their containers drop capabilities and mask files at least, but that's far from a complete solution. My main question is: is SELinux really worth it for desktop systems? How much of an upgrade is SELinux + containers over plain containers? I know a lot of people think it's sort of a set-and-forget thing but based on the gentoo guide, it sounds like a *lot* of work to actually use SELinux effectively. It also basically locks me in to gentoo (I'm not interested in using RedHat), which isn't so bad, but I really do like Guix.

Questions like this are meant for >>25397 . SELinux is too much of a burden to maintain, there are full time jobs dedicated to it and even a team of people can struggle to maintain it. Containers are made for quick deployment, not security. You did not mention your thread model.

>>26937 >this is a simple security question I disagree. This topic could easily spawn a wide range of discussions that go far beyond answering a simple question. >containers are meant for quick deployment, not security They are also almost identical in function to process jails. >you did not mention your threat model My requirements are pretty clear, I believe. I would develop a specific threat model if I had specific things I wanted to do, but I don't. This system will be general-purpose, and its first goal is to be useful.

>>26938 >My requirements are pretty clear, I believe. I would develop a specific threat model if I had specific things I wanted to do, but I don't. This system will be general-purpose, and its first goal is to be useful. threat model isn't for what you want to do, it's for what you are worried about being done TO you e.g: if the feds are after you, you need a much fancier rig than you would for evading your snooping roommate

>>26939 >it's for what you are worried about being done TO you I am worried about anyone (feds, maleware enjoyers, skiddies) exploiting the numerous gaping security holes in the linux kernel and many core system utilities such as firefox. I'm willing to give up some usability to counteract these gaping security holes, but not too much.

>>26938 >They are also almost identical in function to process jails. They are clearly meant for completely different usecases, containers share a lot of resources with the host OS while jails run in a VE with its own files and processes, but now that you shared your threat model in >>26941 and mention that you're afraid of CVEs then you probably shouldn't use jails either since they share the kernel with the host OS which renders them obsolete. You probably shouldn't use Guix either since there are lots of packages who are outdated in their repositories.

>hardened gentoo + SELinux and containers instead of full virtual machines. I am leaning somewhat towards this option, but it would be a lot of work and I'm not sure if it's worth. Isn't this secureblue's approach (but with Fedora)? You could just use their project in that case.