There are some notable security concerns with Linux which you should be aware of. Despite these drawbacks, desktop Linux distributions are still great for most people who want to:

* Avoid telemetry that often comes with proprietary operating systems

* Maintain software freedom (https://gnu.org/philosophy/free-sw.en.html#four-freedoms)

* Use privacy-focused systems such as Tcf362fWhonix or Tcf362fTails

It is a Tcf362fcommon misconception that Linux and other open-source software are inherently secure simply because the source code is available. There is an expectation that community verification occurs regularly, but this isn’t always the case (https://seirdy.one/posts/2022/02/02/floss-security).

In reality, distro security depends on a number of factors, such as project activity, developer experience, the level of rigor applied to code reviews, and how often attention is given to specific parts of the codebase that may go untouched for years.

At the moment, desktop Linux falls behind alternatives (https://discussion.fedoraproject.org/t/fedora-strategy-2028-proposal-fedora-linux-is-as-secure-as-macos/46899/9) like macOS or Android when it comes to certain security features. We hope to see improvements in these areas in the future.

* Verified boot on Linux is not as robust as alternatives such as Apple’s Secure Boot (https://support.apple.com/guide/security/secac71d5623/web) or Android’s Verified Boot (https://source.android.com/security/verifiedboot). Verified boot prevents persistent tampering by malware and evil maid attacks (https://en.wikipedia.org/wiki/Evil_Maid_attack), but is still largely unavailable on even the most advanced distributions (https://discussion.fedoraproject.org/t/has-silverblue-achieved-verified-boot/27251/3).

* Strong sandboxing for apps on Linux is severely lacking, even with containerized apps like Flatpaks or sandboxing solutions like Firejail. Flatpak is the most promising sandboxing utility for Linux thus far, but is still deficient in many areas and allows for unsafe defaults (https://flatkill.org/2020) which permit most apps to trivially bypass their sandbox.

Additionally, Linux falls behind in implementing exploit mitigations (https://madaidans-insecurities.github.io/linux.html#exploit-mitigations) which are now standard on other operating systems, such as Arbitrary Code Guard on Windows or Hardened Runtime on macOS. Also, most Linux programs and Linux itself are coded in memory-unsafe languages. Memory corruption bugs are responsible for the majority of vulnerabilities (https://msrc.microsoft.com/blog/2019/07/a-proactive-approach-to-more-secure-code) fixed and assigned a CVE. While this is also true for Windows and macOS, they are quickly making progress on adopting memory-safe languages such as Rust and Swift, respectively.

Not all Linux distributions are created equal. Our Tcf362fLinux recommendation page is not meant to be an authoritative source on which distribution you should use, but our recommendations are aligned with the following guidelines. These are a few things you should keep in mind when choosing a distribution:

We highly recommend that you choose distributions which stay close to the stable upstream software releases, often referred to as rolling release distributions. This is because frozen release cycle distributions often don’t update package versions and fall behind on security updates.

For frozen distributions such as Debian (https://debian.org/security/faq#handling), package maintainers are expected to backport patches to fix vulnerabilities rather than bump the software to the “next version” released by the upstream developer. Some security fixes (particularly for less popular software) do not (https://arxiv.org/abs/2105.14565) receive a CVE ID (https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures) at all and therefore do not make it into the distribution with this patching model. As a result, minor security fixes are sometimes held back until the next major release.

We don’t believe holding packages back and applying interim patches is a good idea, as it diverges from the way the developer might have intended the software to work. Richard Brown (https://rootco.de/aboutme) has a presentation about this:

* Regular Releases are Wrong, Roll for your life (https://youtu.be/i8c0mg_mS7U) (YouTube)

Traditionally, Linux distributions update by sequentially updating the desired packages. Traditional updates such as those used in Fedora, Arch Linux, and Debian-based distributions can be less reliable if an error occurs while updating.

Distros which use atomic updates, on the other hand, apply updates in full or not at all. On an atomic distribution, if an error occurs while updating (perhaps due to a power failure), nothing is changed on the system.

The atomic update method can achieve reliability with this model and is used for Tcf362fdistributions like Silverblue and NixOS. Adam Šamalík (https://twitter.com/adsamalik) provides a presentation on how 'rpm-ostree' works with Silverblue:

* Let's try Fedora Silverblue — an immutable desktop OS! - Adam Šamalík (https://youtu.be/-hpV5l-gJnQ) (YouTube)

There is often some confusion between “security-focused” distributions and “pentesting” distributions. A quick search for “the most secure Linux distribution” will often give results like Kali Linux, Black Arch, or Parrot OS. These distributions are offensive penetration testing distributions that bundle tools for testing other systems. They don’t include any “extra security” or defensive mitigations intended for regular use.

Arch and Arch-based distributions are not recommended for those new to Linux (regardless of distribution) as they require regular system maintenance (https://wiki.archlinux.org/title/System_maintenance). Arch does not have a distribution update mechanism for the underlying software choices. As a result you have to stay aware with current trends and adopt technologies on your own as they supersede older practices.

For a secure system, you are also expected to have sufficient Linux knowledge to properly set up security for their system such as adopting a mandatory access control system, setting up kernel module (https://en.wikipedia.org/wiki/Loadable_kernel_module#Security) blacklists, hardening boot parameters, manipulating sysctl (https://en.wikipedia.org/wiki/Sysctl) parameters, and knowing what components they need such as Polkit (https://en.wikipedia.org/wiki/Polkit).

Anyone using the Arch User Repository (AUR) (https://wiki.archlinux.org/title/Arch_User_Repository) must be comfortable auditing PKGBUILDs that they download from that service. AUR packages are community-produced content and are not vetted in any way, and therefore are vulnerable to software Tcf362fSupply Chain Attacks, which has in fact happened in the past (https://bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository).

The AUR should always be used sparingly, and often there is a lot of bad advice on various pages which direct people to blindly use AUR helpers (https://wiki.archlinux.org/title/AUR_helpers) without sufficient warning. Similar warnings apply to the use of third-party Personal Package Archives (PPAs) on Debian-based distributions or Community Projects (COPR) on Fedora.

If you are experienced with Linux and wish to use an Arch-based distribution, we generally recommend mainline Arch Linux over any of its derivatives.

Additionally, we recommend against these two Arch derivatives specifically:

* Manjaro: This distribution holds packages back for 2 weeks to make sure that their own changes don’t break, not to make sure that upstream is stable. When AUR packages are used, they are often built against the latest libraries (https://en.wikipedia.org/wiki/Library_(computing)) from Arch’s repositories.

* Garuda: They use Chaotic-AUR (https://aur.chaotic.cx) which automatically and blindly compiles packages from the AUR. There is no verification process to make sure that the AUR packages don’t suffer from supply chain attacks.

We recommend against using the Linux-libre kernel, since it removes security mitigations (https://phoronix.com/news/GNU-Linux-Libre-5.7-Released) and suppresses kernel warnings (https://news.ycombinator.com/item?id=29674846) about vulnerable microcode.

Mandatory access control is a set of additional security controls which help to confine parts of the system such as apps and system services. The two common forms of mandatory access control found in Linux distributions are SELinux (https://github.com/SELinuxProject) and AppArmor (https://apparmor.net). Fedora and Tumbleweed use SELinux by default, with Tumbleweed offering an option in its installer to choose AppArmor instead.

SELinux on Fedora (https://docs.fedoraproject.org/en-US/quick-docs/selinux-getting-started) confines Linux containers, virtual machines, and service daemons by default. AppArmor is used by the snap daemon for sandboxing (https://snapcraft.io/docs/security-sandboxing) snaps which have strict (https://snapcraft.io/docs/snap-confinement) confinement such as Firefox (https://snapcraft.io/firefox). There is a community effort to confine more parts of the system in Fedora with the ConfinedUsers (https://fedoraproject.org/wiki/SIGs/ConfinedUsers) special interest group.

T969389Part 1/2 Tcf362fNext

Tcf362fGuides Home Tcf362fSearch Guides

Tcf362fHome Tcf362fWiki Tcf362fTG Series Tcf362fChat Tcf362fArticles Tcf362fContact

Ta6a49eContent from Privacy Guides (privacyguides.org), commit 0295ab4.

Ta6a49eLicense: CC BY-SA 4.0 - creativecommons.org/licenses/by-sa/4.0