Transcription
Good evening, everybody. Welcome back to another wonderful Cyber Sec Tuesday with Null 404. Tonight, we're going to have our wonderful sponsor and friend, Synak, aka Sean, talking about Secure Blue, a hardened Fedora for everyone. Wonderful, secure Linux image that anybody can use. But before we get into that, I'd love to thank our sponsors, Arflight 6 Consulting. They do awesome things for us so we can bring awesome things to you. Sean, go ahead, my friend.
Cool. Thanks, everybody. Um, hopefully my audience coming in okay. Um, doing this talk last minute, so appreciate all your guys' patience and, um, and bearing with me tonight. Um, unfortunately, our original speaker couldn't make it. So, um, I whipped this together like 5 a.m. this morning and, and brought, figured I'd bring something, uh, to you guys that at least interests interests me right now. Something I've been playing around with.
Um, so, um, one thing I'll ask is if everybody can save the questions to the very end, um, and I can answer any questions and I'll, I'll try to go through this. This will be fairly technical. Um, uh, but I should, uh, you know what, I'll actually, I'll make a change to my statement. If you want to ask me questions, feel free to. Uh, if it's anything elaborate, just save them for the end. But if it's like a quick thing, feel free to stop me and I'll get those answered. Um, and then we can have a, a discussion in detail at the very end, just, just to, um, make sure we're fair with everybody's time.
Um, so tonight, I'll be talking about Secure Blue. Um, it's a hardened Fedora, um, operating system, um, for everybody, and it's, um, a fairly new project, uh, that I was, I just, I just found. Um, I've been interested in, you know, in security like the mo like the rest of you guys, and, um, I use Linux as my daily driver, um, for everything outside of work. Um, and, uh, my, my daily driver has been Pop OS for the last couple years. Before that was Ubuntu. Pop OS was, was, um, very clean, very user-friendly, um, very compatible. Um, but, you know, looking into, if you dive into like the security of the Linux desktop, and I'm saying the desktop specifically, not really the server side of things, but the desktop specifically, there are some areas where the Linux desktop, um, has some areas in security that could be a lot better. Um, so I'll kind of go into that, um, throughout this. So, let me move along. Hopefully, this will work.
All right. So, what is Secure Blue? It is, uh, essentially Fedora Silver Blue. Uh, Silver Blue is, um, a hardened, or yeah, it's a, it's a, it's a security-hardened atomic, um, version of Fedora. And I'll go more into like what atomic means, but what it does is, unlike regular Linux, uh, distributions that are out there where you can install packages and modify the system, Secure Blue uses a, I wouldn't say mutable, but they call it an atomic approach where the core system is read-only and updates are atomic. Um, this means that you get the entire system replaced rather than individually individual packages being updated. Um, this, the technology under the hood is a system called RPM OS Tree. Um, and it enables treating the operating system almost like a, a Git repository with commits and branches. Um, I'll emphasize that this is a community project. It's not backed by a corporation and it's completely transparent in regards to the development. They use a lot of cool, um, systems to build that's behind the whole, I believe it's like the Blue system that Fedora uses for these atomic systems. There are many other atomic systems out there, like Nix OS. Um, that's a really common one. I believe like this, the system, the operating system on the, uh, Steam, on the Steam Deck is atomic as well. Um, don't quote me on that, but I think that's what I read. U, but you'll, you're, it's starting to blow up more and more. Um, I know Nix OS is also, um, is becoming more popular as well, um, outside of being, I believe, atomic, there is other, um, features that are like, like a declarative model, um, to kind of guarantee that you're building like the, like the same system every single time. So, um, but when you think of Secure Blue, think of hardened Linux. Um, and they've done a lot of work to limit the attack surface that you'd get on a normal, like, an Ubuntu install or a Fedora install, things like that. Um, so, breaking down some more, um, the hardened, uh, some, some of the security features that come with it is a more hardened kernel with some additional security patches that can be installed. Um, some examples are kernel address space layout randomization and control flow integrity. Um, Secure SELinux, um, is a, um, is a way to set up mandatory access control on the system, and that's active by default on Secure Blue. Um, if you're familiar with like Ubuntu, they use a thing called AppArmor. It's kind of similar. Um, applications, with SELinux, applications can only access what they're explicitly allowed to, uh, based on those rules. And, um, on top of that, there's a, the firewall is enabled by default, and most of the open ports have been restricted. Um, the rule set has been, you know, mostly closed down, but it's all customizable. Um, I'm trying to see if I can turn these notifications off because they're like, my notifications are going crazy. Hold on one second. Get this thing into streamer mode. Usually is on by default, but I'm on a different rig. Streamer mode. Here we go. Yay. Cool. I don't hear everybody coming in and out. Um, there's still notifications, but I think this is as good as it's going to get.
All right. So, going back to this, um, also, Secure Boot is enabled, uh, but it's not required. Um, it allows you to, um, um, if you're using, if you're going to leverage Secure Boot in the system, I personally am not, and I'll go into like why that is in a minute. Um, but if you are using it, uh, it allows you to, Secure Boot ensures that only signed bootloaders and kernels, uh, run on the system. That's kind of a benefit, and I believe, um, uh, Secure Blue also allows, um, custom keys to be added in for Secure Boot, unlike a lot of other, um, operating, operating systems. Uh, the immutable file system means that malware can't modify the system files. Um, going into that, quote-unquote, mutable system, it's not truly immutable. And, um, I can maybe go into some more details on that. But, um, the whole, when I say, when, when I say immutable, just think of the file system itself. The, uh, the core OS files can't be modified, um, explicitly. There are ways to modify them, which I'll go into. Um, but things like the home directory, um, slash Etsy, and a few other directories, those can be modified, um, as well. Um, so, yeah, these features all in all are work together to create a defense-in-depth approach. Watch the next thing.
Um, so, why choose Secure Blue? So, uh, the key proposition is security without complexity. Out of the box, for most users, Secure Blue works very well. It's, it's not very complex. You, um, you know, as a regular Fedora operating system, to, to anybody that just uses Fedora, you logging in, you know, you, you have a choice between Gnome, KDE, uh, Cosmic's coming out pretty soon, is currently in beta, and I think there's one other desktop environment that they support. But, how, what differs Secure Blue over other operating systems, outside of it being quote-unquote mutable/atomic, is that since you don't, since they, they really don't want you to install, um, software, kind of like the old-fashioned way with like, um, `rpm install` or, um, you know, `yum` or, was it `dnf`? Um, typically, you want to keep things more on the user front. That's where you'd go into like leveraging Flatpaks. Uh, leveraging things like Brew and a couple of other solutions. I, I'll talk more about that in a bit. Um, Fedora compatibility means that the latest software and hardware, there's latest software and hardware support. Um, Fedora is a rapid release, uh, operating system. So, it's constantly being updated. U, the cool thing about the system being atomic, though, is, um, the system is easily able to roll back to previous, uh, uh, upgrades. So, if you have a new upgrade that comes out and it breaks your system, you can easily, with a single command, I think it's like `rpm-ostree rollback`, it will roll back to the previous, um, version of itself. Um, so that, that is a big bang. Um, uh, every time you do a system-wide update, you do have to reboot. That's how the, the layers of the, um, of the system get kind of reapplied. So, that is one caveat. But they, they strive to be a container-first, um, workflow, which means, like, leveraging things like Docker containers, Flatpaks, um, Bubblewrap, which I'll talk about in a second, um, to allow applications to run in isolated environments. And this is, this is reduces the attack surface, um, like I mentioned it before. If you install something via like `rpm install`, um, you, whatever on your system, those, uh, there are, it's hard to prevent what those system, those applications get access to. Uh, there are things like custom SELinux rules you could write. Uh, there's things like, I believe, like Firejail that you might be able to leverage. Uh, there's risks of, uh, SUID root binaries that, you know, certain, uh, binaries could, um, if vulnerable, could get be used for elevating access into a root. Um, so a lot of these, this more containerized approach by running applications that are on the user space, um, where they can't be used on the root space, on the admin space, that's, that's a big difference with this operating system.
This is a little diagram I created, kind of showing you like the layers of the system. Um, this is the layered security approach. At the bottom, we have the hardware with Secure Boot. Um, the hardened kernel sits, um, above the, above that with, um, security patches. Um, when I say security patches, these are like the kernel-side patches. Uh, these are all customizable, but these are most of them that are applied by default are, are more so than what you'd get, um, than with like a normal install of Fedora or Ubuntu. Um, the user space, which is above that, that's immutable, like we mentioned. Uh, you can't modify the system files directly. Um, and then above that, you have the application layer. That's the layer that the user will mostly interact with, and that you'll be leveraging things like Flatpaks or containers. Um, this separation means that, that if an application is compromised, um, it can't afford, or can't affect the underlying system, or it's a lot less likely to, um, affect the underlying system. No application, no system is, you know, impenetrable, but this layered approach does, um, provide isolation and additional security boundaries. Um, if you compare this with, uh, traditional systems where applications have, um, more direct access to the system resources, kind of like what I mentioned before, like if you do a normal install via like, um, you know, `apt get`, `rpm`, things like that. So, um, I can go more into like Flatpaks. I don't know how many people are familiar with those. Um, moving on to the next thing.
Um, I think we kind of covered most of this. This is kind of a duplicate. Um, but yeah, the, in regards to the workflow in the system, um, like the way you can interact with applications. Uh, the, there are different tools. Um, I'm, I'm not going to go in order on this list, but, um, there is, uh, if you're doing any like container management or development, um, where you're going to leverage containers, there's a system in here called Podman, which is, um, an alternative to Docker, but it allows you to use, run, like, spin up, do like Docker containers in a more secure environment. It's not installed in, uh, as root or doesn't have any root system privileges. So, that's a big, uh, benefit. I have some more details on that I can talk about too. Um, RPM OS Tree, which I talked about for, um, layering, that's traditionally just used for updates. But I will say the system is flexible. You're not, you, it's not like you can't install, um, like RPM packages on the system. You can totally do that, but you want to take caution and only do it when you really have to. Um, so if you do like `rpm-ostree install vim` for example, you can install Vim as a, you know, RPM package on the system, but what will happen, unlike regular Fedora or Ubuntu systems, the Vim package will be layered into the system itself. Um, and when I say layered, it's just, it's the way the updates are applied on the system. Um, and which allows it to be, you know, which allows certain parts of the system to be immutable and then other parts, uh, to be dynamic and then, um, and some more like that. I, I have some more details on that I can go over. Um, if you're going to use like a CLI tool, like, like I said, Vim, for example, um, instead of installing it via RPM, um, the, the recommended way is using Brew. Um, Brew is a package manager. Um, it originally came out on the Mac, but it's also available on Linux. Um, it's been, uh, audited. Um, it's been, there's been a lot of validation on it. Um, like other systems like Flatpaks and things like that. It is completely, you can go on there and see how the packages are built. It's all transparent. Um, it's all, I believe it's all in Git. So, um, and and that's how you can install pretty much almost all CLI tools that you would use on a daily basis. Like I said, if that doesn't cover it, you could still roll back to going to, using `rpm-ostree` to get like certain things on there. Um, I, for example, um, use, um, uh, what's it called? It's the firewall `portmd`, which is a, uh, application firewall for Linux. I use `rpm-ostree` for that. Uh, and that, and that was fine, but I needed to get down to that lower level where a system, a user-space application wouldn't really fit the bill. Um, and then Flatpaks, those are, that's for like any GUI applications. That's for browsers, for Discord, um, you know, anything on the, on the GUI side that's in the user space. Um, that you'd use Flatpaks. Uh, Flatpaks are a, um, is a way to install, um, an application, uh, regardless of which system it's been compiled for, whether it was like compiled for, um, Debian or for, um, Fedora-based systems, like whether it was like a, um, yeah, like a Debian, a `.deb` file or an RPM package. Um, it, these, these applications are, um, sandboxed to a certain degree by default, default, using a thing called Bubblewrap, I believe, is the, the backend system. Um, but it is, it is completely customizable with a system called Flatseal that you can control what that application actually gets access to. And I'll, I'll give a demo of like how granular you can get. Um, and then there's also the tool called Toolbox, um, and Distrobox. Those are also ways to, um, install, um, pretty much any type of package on your system, whether it was for, you know, like I said, Fedora or, um, for for Ubuntu or Debian-based systems. Um, so it's very flexible. You get a lot of different options in here. Um, for the most part, I think most people will probably install most of their applications that are like CLI-based via Homebrew, and then anything on the GUI side, they'll more than likely use, u, Flatpak.
Um, I went through most of this stuff already. I think what I'm going to do is I'm going to jump over and give a quick, um, demo of the OS. Does anybody have any like pressing questions that they are dying to ask? No. Okay, cool. Um, so, let me, I'm gonna probably have to reshare my screen out because I'm having some issues. So, let me see if I can get this shared. I'm actually, I'm actually the system I'm running this on is a running Secure Blue too. So, um, let's see. I think this should work.
Okay. Can you guys see my, my VM screen where it says Synak and it shows my, my password prompt?
>> Sure can.
>> All right. Cool. So, let me real quick pull up a web browser because I need to look up something. All right. So, um, oh, why is my internet not working? I'm on a, a network I'm not usually on network still. Oh, boy. Well, whatever. All right. So, put in my password, which is, is a VM. So, it's got a really dumb password. So, okay. So, I'm logged in here. I got, um, you know, it's just normal, like I said, when you're on here, it acts as a normal, like Gnome-based Fedora, um, operating desktop experience here. Um, out of the box, they do have a system called, or a browser called, uh, Trivalent. I think that's how it's pronounced. Um, it's a hardened version, version of Chromium with a lot of, um, good security benefits as well. I will say this, this, um, this operating system takes a lot of, um, areas from Graphene OS, even down to like their website looks almost identical. Um, but they have, um, not only are they focusing on a hardened operating system like Graphene is for Android, this is for Linux, of course, the Linux desktop, but they, you know, they have their own custom, um, their own custom hardened browser, but they also are also leveraging, um, the hardened memory allocator, also known as, uh, Hardened Malloc, that's actually built by the Graphene OS team, and that allows, um, OS systems to have more memory, hardened memory allocation, um, and prevents, um, memory leakage or, or leakage of, of, um, different types of, of information, um, by other applications on the system. Um, that's enabled by default across the system. That's something you won't find in any other OS. Um, you can disable it if it doesn't, if it causes your system, like, or your application not to work properly, um, which is the case with a lot of Flatpaks. Um, but they make it pretty easy to do. So, I, I can demo that. Um, I don't know why my internet's not working, but like I said, I'm on a, I'm actually on a guest network right now. So, um, so pretty much, I'm on this, I'm going to open up a terminal here. Um, so they do out of the box provide a tool called `v.just`. Um, that allows you to actually modify a lot of the settings for Secure Blue out of the box. So, if I type in `v.just`, you can see a lot of these commands, um, that allow you to make customizations, like customization options. One of the things you can do is run an audit of Secure Blue, which I'll do.
[Music]
Audit. Here it goes. And what this will do is show, um, security settings, um, and whether or not they've been set, or if they're in a warning state, or they're failing because they haven't been set properly. So, here you can see, um, these memory, these, uh, kernel, um, security, these like hardened sec kernel modules aren't enabled. Um, these can be enabled. Uh, they do talk in the, in the documentation how certain, certain modules, um, may or may not work in your scenario. Um, they, these are not enabled by default, um, specifically because they can break the system. Um, but if, in your use case, if, if it, you can turn them on, and if it doesn't break anything, you can keep them on. Um, you'll just be that much more secured. Um, things like, uh, USB Guard. That's a system that's built into this, into this by default as well. This is a really cool feature, and they allow you to enable it really easily with a command, um, up here. I think it's called like `toggle-usb-guard` here. Oh, yeah, `setup-usb-guard`. And what that does is allows you to allowlist USB devices to be plugged into your system. Um, you see this like on Mac, like when you plug something into a Mac computer, it'll ask you if you want to allow it or not. You don't really have that in Linux by default. Um, but USB Guard is a way to do that. Um, let's see what else we have in here. Um, MAC randomization. So, you can set up a, um, a per-network or per-connection-based random MAC address for your, like, wireless device on your, on your system, or I believe it also works on the Ethernet as well, too. Um, that's, that's not enabled by default, but you can toggle it with the `v.just` command as well. Um, so, if we go through these commands, I'll go actually go through these commands because this tells a lot about the different, uh, security features. Some of the ones I won't talk, I'll skip by because I'm not super familiar with them. Um, but if we go down to DNS selector, this allows you to enable, um, like easily enable, uh, secure DNS options like things with like, uh, DNS over TLS, um, using like Cloudflare or Mullvad, or, um, there's a bunch of options that are set out of the box. Um, FlatHub. FlatHub is the, um, the repository that you use for, you use for downloading Flatpaks. U, by default, they set this, set the repository to be for only verified Flatpaks. Um, that, that in regards to verified Flatpaks, it's like where, um, FlatHub, the organization, verifies the owners of an application are who they say they are. Um, otherwise, it's a, if it's not verified, it will be community-driven. Um, but FlatHub, all the, everything that, every Flatpak that's on FlatHub can be viewed on GitHub. And unfortunately, I can't load, um, this, I can't load anything right now on my browser, I think because of my, my internet connection, um, so I can't show you guys, but yeah, you can literally, like, if you're going to go download VS Code, u, you know, Flatpak, you can see exactly how it's set up. It's kind of like a Docker container, how you can, you can see how the Docker image is built. Same thing with Flatpaks. You can see how, um, it's all configured, and then you can make modifications to it if you want to. Um, I had to do that actually. Um, I use OnlyKey, and, um, somebody out there actually created an OnlyKey Flatpak that wasn't on FlatHub, and I went through that. I verified everything, looked legit. Um, and then I was able to install that on my system, and it works great. Um, so, if you want to, you, it's the, the, the Flat, Flatpak verified is enabled by default, but you can un, unenable that and, you know, trust the community if you want to. Just up to you. Um, enroll Secure Blue, Secure Boot key. This is what I mentioned. If you're going to use Secure Boot, um, you can have a custom key set up for that. Um, Flatpak permissions lockdown. Um, you can harden a Flatpak more so than it is by default. Every Flatpak that you install, um, is hardened, quote-unquote, by default by the, the maintainer. Sometimes they're not, they, they, the access they have are is pretty broad, just for things to work. But if you wanted to limit, like, how tight the system, like, that Flatpak is, let's say it's a browser, and you only want the browser to have access to your, like, downloads directory, not like your whole home directory, that's all customizable. Or if you want the browser to have access to other applications, um, or, you know, to your webcam, you can set that up in, in Flatseal, which I'll show in a bit. Um, you can install Docker. Um, you can install `libvirt`d. And what this is, is, um, this is actually what I'm running right now. This, I'm running a VM. This is what you're seeing as a VM of, of, of Secure Blue on my Secure Blue system. Secure Blue, the way it is and where it's set to be immutable or atomic, it's really hard to install VirtualBox on the system, um, as well as like, you know, VMware Workstation. Um, so out of the box, they do support, uh, `libvirt`d, which is, like, if you've heard of KVM or Xen, um, you can run, or even, uh, LXC containers, you can run that all with `libvirt`d, and it's actually going to get better performance than you would get with, um, VirtualBox because it's, um, built into the kernel, um, it's built into the system, and it will run a lot faster. So, that's one gotcha. You can't, you know, if you want to take anything from this, you can't run VirtualBox. I mean, I'm not saying it's impossible. It's just really hard to set up and it doesn't, doesn't really work with a mutable landscape. So, something to keep in mind. Uh, but let's say you're a gamer. Um, there is a, a command to install Steam on here. So, um, and there's also a way to set up support for Steam anti-cheat. So, some, it's, it's more on a Windows thing, but on some Linux games, or some games that, you know, if you're using like Proton for, for gaming on Steam on Linux, um, if there is some anti-cheat that's compatible with Linux, um, there is a toggle for that as well, which, you know, makes it so you can play more games on this distro, which is really cool. Um, install VPN. This allows you to install easily install, um, I think it's Mullvad, ProtonVPN, and I think IVPN. Um, and it layers that into like an RPM package, and it makes it really easy. It works with the system very well. Um, you can use other VPNs as well. Um, uh, the system does support WireGuard by default. Um, and then you, if you want to install other ones, it just takes a little bit more legwork. Um, what else we have on here that's really good? Um, okay. Um, LUKS. So, you can, by default, um, or not by default, but you have an option in here to enable, uh, LUKS. LUKS is the encryption on the system, um, to leverage, um, you know, by default when you install the system, you'd put in a password to unlock your, your disk encryption on your system. Um, you can, uh, set up, uh, FIDO2 unlock or TPM unlock. And this is something we discussed a couple weeks ago in a talk that I gave, um, as well as Magoo's talk, um, a little bit, where you can leverage a FIDO key to unlock, um, your, your, your encryption on your system. Um, you can also, not through this, but you can also, um, use, uh, your FIDO key to unlock your user profile as well, too. Um, that's another method, but, uh, it is an option supported by, uh, Fedora. So, um, I already talked about USB Guard. Um, Bluetooth, um, the Bluetooth kernels can be, uh, disabled and enabled. I think they're disabled by default. Um, but if you wanted to use Bluetooth on the system, um, you can enable that. Otherwise, the kernel itself, the kernel module for Bluetooth will be completely deactivated, um, which, you know, makes it's just another hard, it makes it really hard for attackers. They got, if they compromise your system, to leverage your, your Bluetooth, um, as well as webcam. There's an option here to disable the webcam. I don't, it's somewhere in this list, but just like it's like the, the Bluetooth module and the webcam module can be, uh, completely disabled or, or enabled. MAC randomization, talked about that. Um, XWayland. So, um, by default, the systems, the default, um, window manager for the system is Wayland-based, but, you know, for those that have used Wayland, Wayland's like a, a new standard for windowing on the system. Most Linux distributions, um, to this day, a lot of them will still ship with X11, which is an older, um, uh, windowing, windowing system, and there is a lot of, um, security concerns with it. Um, let me pull that up. I actually have a document on that. So, um, some of those concerns are, um, no isolation with X11, global, there's, you know, the applications have, have the option or have the potential opportunity to capture keystrokes from other applications that are on the system. Um, other applications could, uh, screen, scrape other, uh, window applications as well. Um, these, this is all in regards to like X11 itself, and if you're using any windowing there. Um, so you can, you can still use X11, but that does, you know, like for, like older applications that don't support it. Um, so you can go that route. You can also use a thing called XWayland, which is disabled by de, by default, but you can toggle it here, and what that'll do is, XWayland is an abstraction layer for Wayland that allows you to use older X11-based applications. Um, there are still security concerns there, but if you need to use that application, um, then you have that ability to use it. So, just something to keep in mind. A lot of applications, uh, don't have Wayland support enabled by default. Sometimes there's like a flag that you'll like put in the application will, which will allow you to run Wayland, but, um, the whole Linux community is moving to the Wayland approach. As Wayland matures more and more applications support it. The biggest problem right now is like, if you, if you've had a bad experience with Wayland, it's typically because the application itself doesn't really support Wayland out of the box, because they just haven't got to developing that part of it. Um, but when we get there, we're going to, it's, it's going to be better security. Um, there'll be more, um, isolation between applications. Um, I think performance will be better, um, and things like that. Uh, there's like, uh, Flatpak compatibility, SELinux integration, container support, um, and more, like better performance with graphics and whatnot. So, um, if you want to learn, you want to know more about X11 and Wayland, let me talk a little bit more about that. Um, and then, yeah, this standard Malloc, like I mentioned, you can use, um, Hardened Malloc, and, and give a little bit more, so I can give some more details on what that is. You can look it up, Hardened Malloc. Um, you type in the Hardened Malloc or Hardened Memory Allocator Graphene OS, you can find the repo on it. Um, what it is, just to kind of explain it, it's a secure replacement for the standard memory management system that's in Linux by default. Um, um, like I said, you can toggle it on and off. It's on by default across most of the system. Um, but for like Flatpaks, for example, it's, it's on by default, but you can disable it. Um, what Hardened Malloc does is it does help protect against a lot of common hacking techniques. Um, it adds guardrails around the memory to detect attacks. Um, it randomizes memory layouts to confuse attackers. It, it detects when programs are trying to, uh, use the memory incorrectly. Uh, this will stop hack, this can help stop hackers from exploiting memory bugs. Um, it works all automatically in the, in the background. Um, it just needs to be enabled for the application. Um, and it prevents many types of malware, um, infections. Um, like I mentioned, yeah, it's developed by the Graphene OS guys. Um, and it works, it works across a large part of the system. There are some applications it doesn't work on, but like I said, you can easily turn it off. Um, I'll stop real quick. Any, any questions?
All right, cool. Um, you guys, you guys still hear me? You guys are awaiting.
>> Just fine.
>> Okay, cool.
>> I have a question, Sean.
>> I don't know if I got like disconnected.
>> Yeah, sure.
>> Uh, can you turn that off per process? So like if there's a specific application that it's not compatible with, can I turn it off for just that one application or is it global?
>> Uh, yeah, I think with this command right here, you can, you can turn it off on a per-application basis, like run a non, non-Flatpak application with standard memory allocator versus the hardened memory allocator.
>> So, yeah, I think that's that, that's what, yeah.
>> Um, yeah, so that talks about, that's all the different options that they, they make built into the system to like customize. Um, another thing too, if you typically, if you're working on using applications, GUI applications in the system, um, the other alternative to Flatpaks, um, and like, you know, RPM or `.deb` installed applications is going to be, um, AppImages. AppImages are, uh, they leverage a system called FUSE um in the background, and FUSE from what I'm aware of hasn't been m maintained very, hasn't been maintained in a couple years, and I guess there are some security ramifications to using, uh, FUSE, and FUSE is like the core framework that's, I, I believe that AppImages leverage, um, so by default, AppImages, or FUSE is disabled in the system. Um, you can reenable it. There is a switch for it in here somewhere. Um, so you can turn it on and use an AppImage if you really want to. Um, but that's another thing to be aware of. Um, most, like I said, most of these things that are that are being turned off are because of these, these security risks. But like I said, you can, everything's flexible. It's why we use Linux. Um, so we can, we have full customization of the system. Uh, another thing too, I'll bring up is the system doesn't have `sudo` installed. Uh, it uses a newer alternative to `sudo` called `runzero`. Um, the reason for that is `runzero`. Um, it's, it integrates with systemd. Um, it, it doesn't require, um, a setUID root permission, which limits the attack, uh, uh, surface. Uh, which it's, `runzero`'s got a smaller codebase. There's no configuration files. Um, it's more the design of the software more modern. There's per, uh, privilege boundaries that are built into it. Better logging, better session isolation. So, that's why the developer of this, like, got away from using `sudo`. For those that aren't aware, the, if `setUID` root is set on a binary, u, and there's lots of binaries that are out there. I think, um, trying to think of the other ones that come to mind. Um, there's, there's a list. I think if you look at like, um, Living Off The Land, um, a lot of those binaries that are, um, installed on a system by default, they're running as root with root, uh, `setUIDs`, also known as, I believe they're also referenced as SUIDs. Um, if those binaries get compromised or, uh, you can, you can exploit them, you can leverage them to do privilege escalation to elevate yourself into into root or a higher privilege than what you normally are in as user space. So, there's a risk, and I know the developer has went to like great lengths to try to limit the amount of, um, `setUID` binaries on the system. I think that's another reason why, uh, they got rid of, it's not leveraging FUSE, uh, for AppImages by default because I think it also, uh, suffers from that issue as well. Um, so, Flatpak. So, um, let me go here. I really wish I had my, I wish my internet was working. Um, let me see real quick. Let me see because I don't have, Flatseal is not installed by default. I might have to just show you this from my main system because, um, which is, which is okay. I don't really have anything sensitive on here. Um, because, yeah, the internet is not working. So, let me, I'm going to change the, trying to think. So, yeah, let me, let me do that. We have what's installed by default. I don't know why Flatseal isn't. I think I think it's because there's actually a, there's a, there's a process that's supposed to run automatically and it hasn't run yet that actually installs, I think Flatseal by default and a couple of other things. Um, there is on here, this is like the, the system for managing the, uh, the firewall. So, it gives you a nice easy-to-use, uh, GUI for you to leverage. Um, so, uh, makes managing the firewall a little bit easier. Um, something I haven't really messed with yet. I usually don't allow anything inbound to my system, so I haven't messed with that. Um, let's see what else we have on here. Also, if you use Gnome, Gnome extensions are disabled by default. You can enable those. Um, there's been, there's been vulnerabilities found in Gnome extensions in the past. I think it was why they disabled it in the first place, but I use Gnome extensions, so I enabled it. Um, that allows me to have, use a bunch of different tools, custom like taskbar options and things like that. Uh, if you guys haven't used Gnome extensions before, they're pretty cool. Um, and they had supported any Gnome-based, um, operating system like, uh, like Ubuntu out of the box, or I think Fedora out of the box. So, um, yeah, let me, let me go. I'm going to switch the session real quick, the video session. So, let me do that. I'm going to show off Flatseal. So, let's see. I changed my stream to Glass Seal. Okay. Looks like.
>> Anyone else lose him?
>> Yep. He just dropped. Yep. Hope.
>> Hopefully he'll return.
>> Hey, there he is. Welcome back.
>> My bad. Yeah, that's for some reason that's causing a problem. Oh my god, look at that. It's probably actually like a Wayland issue. Um, only downside with Wayland is Discord and Wayland don't always get along. Um, and I haven't switched it back to X11. So, um, uh, let me see then how to do this.
>> Um, any, any more questions? Any other questions?
>> Yeah, I had a question. U, is there a dashboard possibly just to be proactive about security events and just to be more involved in the OS happenings?
>> Secure, secure blue has, like I said, there is a way to, to, there, there is this, um, audit you can do on the system that tells you, it gives you some level of, like, where the system's at in regards to, uh, security. There are, uh, third-party tools. Um, I know we talked about in the past, uh, you can run like vulnerability scanning software. Um, Warlock, what's, what's, I can't think of it off the top of my head. What's the one that that Linus? Is it Linus? Linus. Uh, that's another one. I think that's.
>> Well, Linux. That's a, that's a popular tool that like looks at the, like how hard.
>> CIS benchmark.
>> Well, yeah. Yeah, there's CIS benchmarks, but like the, a tool you can use is, uh, Linux, L-Y-N-I-S, and you can run that against your system, and it'll look for, uh.
>> Yeah, areas that are, uh, not hardened on your system. Yeah, basically. Yeah, basically it's just a free tool, Lynis, and you just run it and, uh, it, yeah, just checks all your system against, um, a bunch of, like, a security standard called CIS benchmark, of which I know there's like a level one and level two. Uh, and I actually ran this tool on both, uh, Ubuntu and Red Hat and, uh, got the systems, almost like definitely CIS benchmark level one, almost, it was like minus one thing for, like, CIS benchmark level two on the systems that I, that I were running it on. So, it's open source and it's really good. So, if you know, failing that, you know, use whatever enterprise tools you got for, you know, checking a system for how hardened it is.
>> Cool. Thank you.
>> Yeah. And, um, yeah, good question. I, I think I did a talk on that not too long ago. I know I did a talk about hardening your system with Ansible, and I think Lynis might have came up there as well, too. Uh, there's also LynPEAS. Uh, that's that's more of a tool that's used for like, um, uh, usually used by like, uh, when you're doing like offensive type, um, attacks on a system, but it's, it, it is you can run it like on your system as well, too, as like an end user or as a defender, blue teamer. Um, and it will look for, um, uh, vulnerability or potential areas of privilege, uh, escalation, um, on on your system. So, that's LynPEAS for Linux. There's one called WinPEAS for Windows, is really good. Um, uh, yeah, um, use that a lot when you're doing any sort of like, um, comes in handy when you're doing a lot of like, uh, OCP type stuff or, um, any side of type of privilege escalation. So, it's good to, to run those on your system, get an audit and figure out where things are at. Um, so, since my screen sharing is not working, I will just send you guys, show you guys, post a screenshot. Um, and I'm going to show you, I'll just post this in the Meetup text channel. So, give me one second and I'm going to show you guys, uh, thing called Flatseal. So, um, for those that are using Flatpaks, Flatseal, like I mentioned earlier, is a way to control what the, uh, Flatpak has access to on your system. Um, like I said, out of the box, your, uh, system might, um, oh, you know what? Actually, hold on. I think I know what, I think I might know why my screen sharing is not working. Well, I'll be, I'll be right back. I want to try this. Anyone got any good cyber jokes? Sorry.
All right, let's see if this works. Oh, yeah. Okay, cool. So, the reason why it was crashing is because this is a good example is because I had, because the Hardened Malloc was installed on, on, on Discord. So, like I said, not all applications work well with the Hardened Malloc, but you can just disable it. Um, there's act, there was actually, um, there's actually the, what, where Hardened Malloc is actually used is, uh, is an environment variable that's set, um, on the system, and you just remove that, that disables Hardened Malloc for that Flatpak option. So, uh, for, for example, this, this, I'm showing you guys my, all the Flatpaks I have installed on my system here. Um, so, um, I don't think I have anything sensitive on here, but, um, you can see this. So, every Flatpak that gets installed, it'll show up on, in this tool called Flatseal. Flatseal is a, is a, I believe it's a Flatpak you just install. If you use Secure Blue, it's, it gets installed by default. Um, once you have the system up, there's, like I said, there's a, there's actually like a, um, there's a systemd service that runs and like configures it after install. Just for some reason, it, it does, it doesn't run by default sometimes. I, I don't know. I got brought up to the developer. Um, but so, yeah, I have, let's say I have Chromium here. Um, you can see these are the settings I have. These are, I think, just the default settings. I haven't actually, I just installed Chromium, uh, before the call. Um, so you can see right here I have Chromium set to using, uh, X11. If I wanted to, I can set it to Wayland only, um, or set up a fallback to X11. If I wanted to use, uh, audio, I can give it access to the PulseAudio sound server.
>> Hey.
>> Oh, yeah.
>> Question.
>> Um,
>> Yeah.
>> I'm new to cyber security, so this may be a dumb question. I'm sorry, but when you were looking through the list of the toggles, you could do the Xland, is that that call back to X1 or is XWayland just the Wayland, the Wayland?
>> Um, that's a good question. I don't know the answer. Um, I believe, I believe it uses, if you, on this operating system, I believe if you use X11, it's actually using XWayland under the hood, I believe, because, because I think you can only have Wayland or X11 running. You can't have them both running at the same time. So, if you're using Wayland, XWayland will allow you to run X11 apps on Wayland itself.
>> Okay. Thank you.
>> That's my understanding. Yeah. Yeah, good question. Um, so, yeah, you can come in here. You can give it access if you want to give it access to your GPG agent, your printing system, you know, like for me, I'm not going to probably print anything from from Chromium. So, I can disable this. Um, if I'm not going to use sound for whatever reason, I can disable that. Um, if I was going to use a smart card for whatever reason, I can enable that. Um, you know, uh, having this, this is the default. So, you can see like by default this Chromium is allowed to have access to like all devices. But let's say I don't want that. I can, I can disable that. Um, host OS, it's given it's been by default given, uh, read-only access that probably don't want. I don't.
know if that's required by Chrome OS, uh, or Chromium. So, if I remove this, it may break Chromium, but I can always add it back. The cool thing about it is, anything that you remove, you can, um, hit reset up here, and it'll bring back the defaults.
Um, um, you can give set environment variables, um, uh, system bus, uh, options, session bus options. I'm not super familiar with, with these setups here. Um, if you want to allow the app to run in the background, you can.
Um, if you ever run into an issue, uh, and you don't know which toggle it is, you can run the flatpak from the command line, and you'll get, um, verbose logging, and a lot of times that will tell you what the issue is. Like, it will say, "Hey, I don't have access to, you know, PulseAudio," or "I don't have access to, um, this, this, you know, part, this part of the operating system." And then you, then you know, "Okay, it's not going to work unless I go and enable that." And then you can weigh out the risks whether or not you want to allow that or not, or maybe you should just use a different, um, piece of software instead of, you know, the one that requires tons of permissions.
So that's the cool thing about flatpaks. Like I said, flatpaks are isolated. They're sandboxed. They're a lot more secure than a default install, um, of an application on a system because you have a lot of this control. Um, like I said, if you're doing this with a normal, like RPM installed package, if in order to get this level of control, it's going to be really, really hard. Like I said, there is SELinux that you can set up some rules for, but SELinux is kind of a pain in the butt to configure for anyone that's done that. Um, there's definitely a learning curve. It's like learning IP tables. There's, there's a learning curve. Um, there's other tools out there, too, but this is probably the best one, um, out there.
Um, let's see. Uh, if I have anything else. My laptop is running out of battery, so I have a limited amount of time to talk, which is good. I don't want to keep all you guys here too long. Um, I'm trying to see if there was anything else I wanted to bring up. Any, any other questions?
No. Okay.
>> Yeah, I do.
>> Yeah.
>> So, all right. So, let's say you're like, "Okay, I got to have this RPM. I'm going to use RPM-OS tree." Throw that on there. Do you, were you saying something about needing to reboot to like let it reapply all the layers?
>> You literally have to do that if you added an RPM package to your system.
>> Anything you use with OS tree, whether it's going to be adding an RPM package or doing an update, I, I believe for it to be applied, for that layer to be applied, is only going to be applied. It's a, it's an all or nothing. That's, that's, that's how that's how atomic systems work.
>> Uh
>> Damn.
>> Yeah. So that is, that is it's a cost of using a, of an atomic system.
>> Yeah. And it's just because of the way that, like I mentioned, how it works is like a, it's almost like a, like a Git tree, uh, layered approach. I, I don't know if they're working on fixing that in the future, but that's, and that's just a caveat.
>> Yeah. I mean, just, you know, I get the point of it.
>> That's a little nutty though. I mean, you know, to like, "Oh, I'm gonna install something with RPM. I got to reboot every time I do it." And that's almost Microsoft,
>> you know, like, damn.
>> Like I mentioned, it's, um, it's, it's, you shouldn't be in the best approach is not installing things via RPM. It's like, you use RPM, you install things via RPM as like a last resort.
Um, yeah, most applications you can get away with, um, installing with Brew, um, with, with flatpaks, or like I said, toolbox, Dropbox, um, those don't require restarts. But if you need something that's like system level, hardware level, um, you got to install some sort of firmware or whatnot, that's going to require the reboot. Or if you're going to do some sort of OS upgrade, um, update, that will require a reboot.
>> Okay.
>> So,
>> Thanks. Um, and like I mentioned to the, the, the, um, applica, the, the immutable, the directories that aren't that, that are immutable, aka atomic, aka read-only, um, are the, the user du, the USR directory, which is like what for, like system binaries, libraries, and resources, uh, the bin directory, the sbin directory, the lib directory, boot, um, as well as, um, I think insecure blue. I don't, I think slash ETC as well, but I think I'm, I'm not 100% sure on that. But the, the ones that are mutable, the ones that are, uh, that are dynamic, uh, are the home directory, the var directory, temp directory, and, uh, the run directory.
So, um, anything you install, like if you're going to use Brew or whatnot, that will get end up installing like under your, your home directory typically. Um, and those will survive reboots and stuff like that. Um, you know, things that are going to be installed like on a system level typically be like the, the USR directory, bin directory, lib directory, things like that. Um, so I know I wish I, I personally wish there was a Secure Blue version that didn't force you to use the atomic file system in case that's a way you wanted to go. But that's, I think that's honestly, I see a lot of the industry moving forward in that direction is, is these atomic systems.
Um, so I think even like if you look at macOS, um, a lot of their system is the same way. I think they call it System Integrity, which is a feature you can turn on and off. I believe that's a similar thing where certain parts of the operating system are not modifiable by the user, even if you're root, and that's, it's just comes down to a security choice that was made, and you can disable it, like, like for example, like on Mac, I think you can disable it to a certain extent, but you are opening the doors to a lot more security vulnerabilities.
Um, does anybody have any questions about, uh, flatpaks, atomic, the system, um, wayland, or, you know, setUIDs? Um, anybody want to know more about those? I can, I can share the docs at the end of this too. I compiled a bunch of information on each of those subjects. Um, so I'll share those out. Um, I'll put in in a repo in my GitHub, and if you guys want want that, I can share that out.
>> I have a quick question. Um, I'm working on a project for
>> Overflow and hardening computers. Um, most of what I'm working on is legacy computers and stuff, or legacy systems still being vulnerable. Is that a tool that you could do like an old system or a new user, new tool system?
>> Sorry, your your audio is cutting out, at least for me. I'm not sure if it is for anybody else, but you said, "Can it be used, uh, which way? On ARM-based systems, um, like old legacy systems, or is it just for, um, newer systems?"
>> You talking about for the, the operating system itself?
>> Yes.
>> Uh, yeah, the operating system, the Blue, which, which is an operating system, it can, it can be used, you know, on, I don't know what like the hardware requirements on. I'm assuming you can use it on a pretty old system, like I would guess 2010 and above is my guess.
>> Um, but, um, yeah, um, yeah, I, I, yeah, I think I think, yeah, you should be okay, but you just know you'd have to reboot the, or you'd have to like wipe the whole system, and this is a whole new operating system. So, um, you'd have to kind of like, yeah, wipe the whole thing and start from scratch.
>> Right?
>> Okay. Thank you.
>> Yep.
>> Um, any other questions? I think I have probably about five more minutes. Oh, actually, I have less than five more minutes. Well, if I have time for one more question, anybody have anything else they want to bring, uh, chat about, and any other questions? I'll, I'll answer them on on the Discord, and I'll share the, the, the docs I have on it.
>> Awesome. Well, hey, thanks so much, Sean, for the presentation.
>> Yeah, thanks everybody. Thanks for hanging out. Thanks for letting me do this last minute talk. Hopefully that was interesting. Um, if anybody does end up using Secure Blue, let me know. I'd love to chat with you guys. Uh, they do have a really good Discord that's very active. The developer in there, uh, is very, uh, active in there if you have questions or issues. Um, and, uh, I didn't mention this, but Secure Blue also has a server image. So, it's not just desktop only. Um, so if this is something that interests you for like, uh, running as a server, it's another option as well.
Um, and yeah, I think that's it. I gotta bounce. But thanks everybody for hanging out with me. Thanks for listening. Uh, thanks for spending your Tuesday night with me. And, uh, just a reminder if anybody's look, if anybody's interested in giving a talk, um, we are looking for speakers. I think we have the next like two or three weeks filled, but you know, we have all the time in the world after that. So, yeah, hit us up. But, uh, yeah, catch you guys next week. Thanks everybody.
[Applause]
[Music]
I'm gonna drop you guys. And thank you everybody for joining us for another wonderful cybersecurity.