Firejail alone is probably good enough for security and privacy

[amano-kenji]

While AppArmor can provide extra security, as long as you install small softwares from linux distribution repositories, you don't get much benefit from protecting system applications with AppArmor. How likely is it that a window manager or a terminal emulator is going to hack your computer or send your data to remote servers? They don't run remote codes.

On the other hand, big untrusted softwares that may or may not run arbitrary remote codes are web browsers and PDF readers and other user applications that can be sandboxed by firejail. A PDF reader can execute javascript in PDF.

Let's admit that true security is an illusion. Living on earth is not safe. Earthquakes, floods, hurricanes, and other natural disasters can destroy your house anytime. Even with SELinux, locking down the entire system is impossible. Often, hardwares and softwares promising total lockdown are spywares like Intel ME and AMD PSP. Anyone who promises total security wants control. Microsoft tried to use secure boot to prevent computers from replacing windows with linux. Government promises security but constantly threatens violence if people don't pay up or don't adhere to its arbitrarily changing rules without letting people consent to rules. Governments have killed many more people than all criminal organizations combined. Yet, instead of taking responsibility for our own security, we think we need governments to keep us safe. True security doesn't exist on earth. If you give up freedom to big tech or big government for illusion of security, you lose security. Lesson // Don't give up freedom for security.

But, you can get reasonable levels of security and privacy without compromising your natural right to do things without initiating violence. I think firejail is a good tradeoff. It is relatively straightfoward to use for applications that have firejail profiles.

I think creating an AppArmor profile for any system service that runs arbitrary remote code or directly connects to the internet is still worth my time. If you are trying to protect every system application with AppArmor or SELinux, you will be stuck creating and modifying profiles until your death. Perfection is impossible as long as you live in the physical universe.

Most of the time, protection from arbitrary code execution and on networked software is enough.

[Ghost-in-the-RLAIF-GaN-DNA-code-shell]

Dear [amano-kenji], that is exactly my saying and what I mostly try to explain.
I agree mostly, and there are no words that describe how awesome it is that you put this out here !

[amano-kenji]

In my opinion, there should be a "simple" sandboxing model and an operating system that applies it to every application, and every application "may" programmatically interact with the OS sandbox.

It must be "simple". SELinux is not simple for administrators. Firejail is simpler than SELinux, but firejail is also not simple enough. I don't think people can maintain SELinux if the human civilization takes a hit. Software has become so complex that we need to simplify the entire stack.

Jonathan Blow mentioned creating an operating system from scratch. It is likely not going to be linux, BSD, mac, or any existing operating system.

A completely new operating system design that "comes" with a simple sandboxing model from the "beginning".

Write everything from scratch again with completely new models. Either, don't require any "third-party" application profile, or force application developers to write application profile, or don't require any application profile at all.

You can try to improve sandboxing on existing kernels and existing operating systems, but the return on investment has already reached diminishing returns. It's so complex that users just say they would rather have their privacy violated on mac os if that means they can do productive work faster.

Perhaps, creating an entirely new operating system is impossible in the current human condition, but it may be possible in a post-scarcity economy where many people are free to do whatever they want to do.

[topimiettinen]

I like Android's automatic and tight sandboxing model. It works well because the apps are developed to play in the strict sandbox. There's no need to handcraft the sandboxes for each app. The apps for Linux (nor Mac and Windows) don't expect any sandboxing and there's always a chance that something breaks with the sandboxing when the apps evolve.

The downside with Android (like Mac and Windows) is that it's not possible to tighten its sandboxing with something like Firejail (or firewalls or custom SELinux rules). Hopefully Android for PC will be usable at some point with more tinkering possibilities.

[topimiettinen]

It’s not a binary "sandbox vs. no sandbox" situation; it’s a difference in Threat Models. Fedora protects the house from the guests; Android gives every guest a locked room. So the relevant question isn’t “are apps in separate domains?” but rather: What does unconfined_t actually allow?

On Fedora, unconfined_t is broad==true, but it is not equivalent to disabling SELinux entirely. Critical services (e.g., sshd_t, httpd_t, container_t, etc.) are confined. System integrity is still protected by type enforcement on labeled resources.

For some system services, yes. But the user apps aren't in separate domains and therefore for example Firefox has full access to all files in your home directory. The SELinux rules for unconfined_t domain don't stop Firefox from writing to your .bashrc. So I can't say that the SELinux sandboxing as supplied by Fedora/RH is very strong for user apps. The approach is a compromise aiming for low maintenance effort for RH and the system administrators.

Of course nothing would stop some party from writing tight app-specific SELinux rules for the 1000s of user apps and keeping them up to date when the apps happen to change, like the awesome Firejail team does, but so far this hasn't been seen.

[Ghost-in-the-RLAIF-GaN-DNA-code-shell]

@topimiettinen and @amano-kenji ,dears despite I do not recommend flatpak(flathub), because https://flatkill.org/ is a good summary about it, I do use snap and recommend https://documentation.ubuntu.com/snapcraft/stable/. Hope that is a helpful advice and you tell me how secure you consider it,https://snapcraft.io/docs/how-to-guides/manage-snaps/ ?
I.e. you can remove most permissions=connections with i.e. @Debian:~$ sudo snap disconnect Application:connection !

[amano-kenji]

Of course nothing would stop some party from writing tight app-specific SELinux rules for the 1000s of user apps and keeping them up to date when the apps happen to change, like the awesome Firejail team does, but so far this hasn't been seen.

I don't think this is scalable. "Third-party" app profiles cannot scale and must go away. Every application should be put in a "simple" fixed sandboxing model.

First-party app profiles could be configured with a manifest file or programmatically, but I think a simple sandboxing model shouldn't require even first-party app profiles.