Group: Software/FSDG distributions/Security

From LibrePlanet
Jump to: navigation, search
(→‎Access control: Add Trisquel tomoyo status)
(→‎Access control: Remove Trisquel 11 because it is empty. It can still be added later on if needed.)
 
(36 intermediate revisions by the same user not shown)
Line 12: Line 12:
 
! Comments
 
! Comments
 
|-
 
|-
−
! Dragora 3.0-beta1
+
! Dragora 3.0-beta2
−
| {{no|Checksums only}}<ref>https://mirror.fsf.org/dragora/v3/iso/beta1/</ref>
+
| {{yes|Yes, signed images}}<ref>Signing key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x35bdb9d46b56b5facb647c9b3aaf1cec203a99d5</ref>.
 
|  
 
|  
−
* There are [https://git.savannah.nongnu.org/cgit/dragora.git/tree/BOOTSTRAPPING.md instructions to build the release yourself] but there is no instructions to verify the source code.
 
−
* As a workaround it might be possible to download the checksums through various ways (using multiple Tor routes, local connection), and compare them. Also make sure to download the checksums from the official website or a trusted mirror.
 
 
|-
 
|-
−
! Dynebolic 3.0-beta
+
! Dynebolic 4.0.0-beta
−
| {{no|Broken: signed broken checksums (md5)}}<ref>https://files.dyne.org/dynebolic/</ref>
+
| {{yes|Yes, signed images}}<ref>See [[Group:Software/FSDG_distributions/Dynebolic_signing_key]] for the public key that signed the images.</ref>
−
| You could still download the images multiple time and compare them with cmp. Though it's far from ideal.
+
|
 
|-
 
|-
−
! Guix 1.4.0
+
! Guix 1.5.0
 
| {{yes|Yes, signed images}}<ref>https://guix.gnu.org/en/download/</ref>
 
| {{yes|Yes, signed images}}<ref>https://guix.gnu.org/en/download/</ref>
 
|
 
|
Line 28: Line 26:
 
! Guix "latest"
 
! Guix "latest"
 
| {{no}}<ref>https://guix.gnu.org/en/download/latest/</ref>
 
| {{no}}<ref>https://guix.gnu.org/en/download/latest/</ref>
−
| Workaround: Use Guix 1.4.0 and update it.
+
| Workaround: Use Guix 1.5.0 and update it.
 
|-
 
|-
 
! Hyperbola v0.4.2
 
! Hyperbola v0.4.2
Line 47: Line 45:
 
|-
 
|-
 
! PureOS 10 (byzantium)
 
! PureOS 10 (byzantium)
−
| {{no|Checksums only}}.<ref>https://downloads.puri.sm/byzantium/gnome/2022-06-02/</ref>
+
| {{no|Checksums only}}.<ref>https://downloads.puri.sm/byzantium/gnome/2023-06-14/ . There is also [https://tracker.pureos.net/T116 a bugreport about it].</ref>
 
|  
 
|  
−
* Workaround: Install PureOS from Parabola with debootstrap and pureos-archive-keyring
+
* Workaround: Install PureOS from Guix or Parabola with debootstrap and pureos-archive-keyring
 +
* As a workaround it might also be possible to download the checksums through various ways (using multiple Tor routes, local connection), and compare them. Also make sure to download the checksums from the official website or a trusted mirror.
 +
|-
 +
! PureOS 11 (crimson)
 +
| {{no|Checksums only}}.<ref>https://downloads.puri.sm/crimson/gnome/2024-05-10/ . There is also [https://tracker.pureos.net/T116 a bugreport about it].</ref>
 +
|
 +
* Workaround: Install PureOS from Guix or Parabola with debootstrap and pureos-archive-keyring
 
* As a workaround it might also be possible to download the checksums through various ways (using multiple Tor routes, local connection), and compare them. Also make sure to download the checksums from the official website or a trusted mirror.
 
* As a workaround it might also be possible to download the checksums through various ways (using multiple Tor routes, local connection), and compare them. Also make sure to download the checksums from the official website or a trusted mirror.
 
|-
 
|-
Line 56: Line 60:
 
|
 
|
 
|-
 
|-
−
! Trisquel 10.0.1
+
! Trisquel 11 (aramo)
 +
| {{yes|Yes, signed images}}<ref>https://cdimage.trisquel.info/trisquel-images/</ref>
 +
|
 +
|-
 +
! Trisquel 12 (ecne)
 
| {{yes|Yes, signed images}}<ref>https://cdimage.trisquel.info/trisquel-images/</ref>
 
| {{yes|Yes, signed images}}<ref>https://cdimage.trisquel.info/trisquel-images/</ref>
 
|
 
|
Line 72: Line 80:
 
|-
 
|-
 
! Dragora
 
! Dragora
−
| ?
+
| {{no|No policies requiring to sign commits}} <ref name="signed-commits-but-no-policy">Most commits are signed by the maintainer but other commits are not signed and there are no documented policies requiring to sign commits.</ref>.
 
|-
 
|-
 
! Dynebolic
 
! Dynebolic
Line 96: Line 104:
 
|-
 
|-
 
! Replicant
 
! Replicant
−
| {{no|No policies requiring to sign commits}}
+
| {{no|No policies requiring to sign commits}}<ref name="signed-commits-but-no-policy"></ref><ref>Replicant also consist of many repositories, and even if all commits were or are signed, it would be complicated to verify each repository without any tools for that. While in theory Replicant has a manifest file with repositories and commits/branches to use, it doesn't always use fixe revisions as this makes rebasing the changes easier. In addition there are Apache rewrite rules in place to redirect repositories when they were renamed between Android versions, so that also complicates things.</ref>.
 
|-
 
|-
 
! Trisquel
 
! Trisquel
Line 115: Line 123:
 
! Protection against mirrors with outdated packages
 
! Protection against mirrors with outdated packages
 
! Known security issues
 
! Known security issues
 +
! Security related bug reports
 
! Comments
 
! Comments
 
|-
 
|-
Line 121: Line 130:
 
|  
 
|  
 
|
 
|
−
|  
+
|
 +
|
 +
|
 
|-
 
|-
−
! Dynebolic 3.0-beta
+
! Dynebolic 4.0.0-beta
 
| {{no}}<ref>From [https://www.gnu.org/distros/free-distros.html free-distros.html]" "This is a “static” distro, normally run from a live CD. Since it will not receive security updates, it should be used offline."</ref>
 
| {{no}}<ref>From [https://www.gnu.org/distros/free-distros.html free-distros.html]" "This is a “static” distro, normally run from a live CD. Since it will not receive security updates, it should be used offline."</ref>
 
| {{no}}<ref>From [https://www.gnu.org/distros/free-distros.html free-distros.html]" "This is a “static” distro, normally run from a live CD. Since it will not receive security updates, it should be used offline."</ref>
 
| {{no}}<ref>From [https://www.gnu.org/distros/free-distros.html free-distros.html]" "This is a “static” distro, normally run from a live CD. Since it will not receive security updates, it should be used offline."</ref>
Line 131: Line 142:
 
|  
 
|  
 
* No security updates
 
* No security updates
 +
|
 
|
 
|
 
|-
 
|-
−
! Guix 1.4.0
+
! Guix 1.5.0
 
| {{no}}<ref>There is no backport of the security fixes to stable releases. Instead users are encouraged to run guix pull to get the latest Guix version along with security fixes.</ref>
 
| {{no}}<ref>There is no backport of the security fixes to stable releases. Instead users are encouraged to run guix pull to get the latest Guix version along with security fixes.</ref>
 
| {{no}}<ref>There is no backport of the security fixes to stable releases. Instead users are encouraged to run guix pull to get the latest Guix version along with security fixes.</ref>
 
| {{no}}<ref>There is no backport of the security fixes to stable releases. Instead users are encouraged to run guix pull to get the latest Guix version along with security fixes.</ref>
Line 144: Line 156:
 
|
 
|
 
* No security updates
 
* No security updates
−
| Guix 1.4.0 can easily be updated to Guix "latest".
+
|
 +
| Guix 1.5.0 can easily be updated to Guix "latest".
 
|-
 
|-
 
! Guix "latest"
 
! Guix "latest"
Line 156: Line 169:
 
* Mirrors build packages and the signatures are enforced. Guix challenge can be used to check if the packages are reproducible.
 
* Mirrors build packages and the signatures are enforced. Guix challenge can be used to check if the packages are reproducible.
 
|
 
|
−
|  
+
| [https://codeberg.org/guix/guix/issues?state=open&labels=425664 link]
 +
|
 
|-
 
|-
 
! Hyperbola v0.4.2
 
! Hyperbola v0.4.2
Line 171: Line 185:
 
** uses secondary mirrors first<ref>Reference: [https://repo.hyperbola.info:50000/other/mirrorlist/mirrorlist.txt the default /etc/pacman.d/mirrorlist]</ref>
 
** uses secondary mirrors first<ref>Reference: [https://repo.hyperbola.info:50000/other/mirrorlist/mirrorlist.txt the default /etc/pacman.d/mirrorlist]</ref>
 
** It Doesn't enforce package database signatures<ref>Reference: [https://git.hyperbola.info:50100/packages/core.git/tree/pacman/pacman.conf /etc/pacman.conf] has "SigLevel = [...] DatabaseOptional"</ref>
 
** It Doesn't enforce package database signatures<ref>Reference: [https://git.hyperbola.info:50100/packages/core.git/tree/pacman/pacman.conf /etc/pacman.conf] has "SigLevel = [...] DatabaseOptional"</ref>
 +
|
 
|
 
|
 
|
 
|
Line 182: Line 197:
 
|  
 
|  
 
|  
 
|  
 +
|
 
|-
 
|-
 
! Parabola
 
! Parabola
Line 195: Line 211:
 
* Doesn't enforce package database signatures<ref>However even if the redirector uses https, the package database signatures are not enforced since Parabola has "SigLevel = [...] DatabaseOptional" in /etc/pacman.conf by default.</ref>
 
* Doesn't enforce package database signatures<ref>However even if the redirector uses https, the package database signatures are not enforced since Parabola has "SigLevel = [...] DatabaseOptional" in /etc/pacman.conf by default.</ref>
 
|
 
|
−
* [https://labs.parabola.nu/issues/3261 Still has log4j]
 
 
* [https://labs.parabola.nu/issues/1867 boot flow hijack possible in some situations]
 
* [https://labs.parabola.nu/issues/1867 boot flow hijack possible in some situations]
−
* Some outdated packages, Needs help to update them
 
 
|  
 
|  
 +
* [https://labs.parabola.nu/projects/packages/issues?tracker_id=12 packages]
 +
* [https://labs.parabola.nu/projects/documentation/issues?tracker_id=12 documentation]
 +
|
 
|-
 
|-
 
! ProteanOS
 
! ProteanOS
Line 208: Line 225:
 
|  
 
|  
 
|  
 
|  
 +
|
 
|-
 
|-
 
! PureOS 10 (byzantium)
 
! PureOS 10 (byzantium)
Line 217: Line 235:
 
|
 
|
 
|  
 
|  
 +
|
 
|-
 
|-
 
! Replicant 6.0 0004
 
! Replicant 6.0 0004
Line 227: Line 246:
 
* Based on Android 6.0 which is not maintained anymore
 
* Based on Android 6.0 which is not maintained anymore
 
* Use an old version of Webview which is full of security vulnerabilities. Many applications use the builtin Webview, including non-browser applications.
 
* Use an old version of Webview which is full of security vulnerabilities. Many applications use the builtin Webview, including non-browser applications.
 +
|
 +
|
 +
|-
 +
! Trisquel 10 (nabia)
 +
| {{yes}}
 +
| {{yes|can be enabled}}<ref>This can be done by installing and configuring the unattended-upgrades package</ref>
 +
|
 +
| {{yes}}
 +
|
 +
|
 +
|
 
|  
 
|  
 
|-
 
|-
−
! Trisquel 10.0.1
+
! Trisquel 11 (aramo)
 
| {{yes}}
 
| {{yes}}
 
| {{yes|can be enabled}}<ref>This can be done by installing and configuring the unattended-upgrades package</ref>
 
| {{yes|can be enabled}}<ref>This can be done by installing and configuring the unattended-upgrades package</ref>
 
|
 
|
 
| {{yes}}
 
| {{yes}}
 +
|
 
|
 
|
 
|
 
|
Line 239: Line 270:
 
|-
 
|-
 
! Ututo S
 
! Ututo S
 +
|
 
|
 
|
 
|
 
|
Line 252: Line 284:
 
{| class="wikitable"  border="1"
 
{| class="wikitable"  border="1"
 
! Distribution
 
! Distribution
−
! Reproducible builds officially supported<ref name="supported-definition">If reproducible builds officially supported, we should be able to open bugs about non reproducible packages and/or send patches to fix them. If it is not supported we could try to send patches to enable reproducible builds and/or help the distribution supporting it instead.</ref>
+
! Reproducible builds officially supported<ref name="supported-definition">If reproducible builds officially supported, the distribution [https://reproducible-builds.org/who/projects/ should be listed on https://reproducible-builds.org], users should be able to open bugs about non reproducible packages and/or send patches to fix them. If it is not supported we could try to send patches to enable reproducible builds and/or help the distribution supporting it instead.</ref>
 
! Comments
 
! Comments
 
|-
 
|-
 
! Dragora
 
! Dragora
−
| ?
+
| {{no}}
 
|
 
|
−
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"> The official lists of projects supporting reproducible is at https://reproducible-builds.org/projects/ . Note that not all theses projects are FSDG compliant and that some might even contain nonfree software and other really problematic issues. </ref>.
+
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"> The official lists of projects supporting reproducible is at https://reproducible-builds.org/who/projects/ . Note that not all theses projects are FSDG compliant and that some might even contain nonfree software and other really problematic issues. </ref>.
 
|-
 
|-
 
! Dynebolic
 
! Dynebolic
−
| ?
+
| {{no}}
 
|
 
|
 
* Not mentioned in the list of project supporting reproducible builds<ref name=reproducible-projects-list/>.
 
* Not mentioned in the list of project supporting reproducible builds<ref name=reproducible-projects-list/>.
Line 273: Line 305:
 
|-
 
|-
 
! Hyperbola
 
! Hyperbola
−
| ?
+
| {{no}}
 
|
 
|
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/> but Arch Linux is mentioned there so maybe it's easier to add reproducible builds to Hyperbola.
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/> but Arch Linux is mentioned there so maybe it's easier to add reproducible builds to Hyperbola.
 
|-
 
|-
 
! LibreCMC
 
! LibreCMC
−
| ?
+
| {{no}}
 
|
 
|
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/> but OpenWRT is mentioned, so it might be easier to add reproducible builds to LibreCMC.
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/> but OpenWRT is mentioned, so it might be easier to add reproducible builds to LibreCMC.
 
|-
 
|-
 
! Parabola
 
! Parabola
−
| ?
+
| {{orange|partial (Arch packages only)}}
 
|
 
|
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/> but Arch Linux is mentioned there, and for x86_64 some of the stock Arch Linux are reused. So at least part of Parabola is reproducible.
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/> but Arch Linux is mentioned there, and for x86_64 some of the stock Arch Linux are reused. So at least part of Parabola is reproducible.
Line 290: Line 322:
 
|-
 
|-
 
! ProteanOS
 
! ProteanOS
−
| ?
+
| {{no}}
 
|
 
|
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/>.
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/>.
 
|-
 
|-
 
! PureOS
 
! PureOS
−
| ?
+
| {{no}}
 
|
 
|
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/> but Debian is mentioned there so maybe it's easier to add reproducible builds to PureOS.
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/> but Debian is mentioned there so maybe it's easier to add reproducible builds to PureOS.
Line 309: Line 341:
 
|
 
|
 
* Mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/>.
 
* Mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/>.
 +
* [https://gitlab.com/debdistutils/reproduce/trisquel/ Does cross-distribution reproducibility tests with Ubuntu]
 
|-
 
|-
 
! Ututo S
 
! Ututo S
−
| ?
+
| {{no}}
 
|
 
|
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/>.
 
* Not mentioned in the list of project supporting reproducible builds<ref name="reproducible-projects-list"/>.
 
|-
 
|-
 
|}
 
|}
 +
 +
Note that a "Yes" for reproducible means that the distribution cares about reproducibility.
 +
 +
So volunteers are welcome to report bugs on specific packages and/or to help fixing these bugs (maintainers also don't have an infinite time).
 +
 +
If we look in more details at the status of reproducibility, what "reproducible" means can vary a lot across time and distributions or operating systems.
 +
 +
Most distribution take 2 different setup and have some variations (like a different hostname, time of build, etc) and see if they manage to reproduce the same binary.
 +
 +
But some distributions have way more variations than that. For instance Guix have packages that can be reproduced with Guix being built differently (like the Guix being built by Trisquel, and the one being built by Guix).
 +
 +
So in these cases the binaries that are reproducible are safer as they are less likely to have malicious modifications when the whole compilation chain has been done from multiple distributions because according to the Trusting Trust paper, if the binary is the same, it either has the same malicious modification(s) or no malicious modifications. And carrying around the same malicious modification across widely different distributions and architectures is probably harder to achieve than to do it on a single distribution.
  
 
== Security features ==
 
== Security features ==
Line 325: Line 370:
 
! Lockdown
 
! Lockdown
 
! SELinux
 
! SELinux
 +
! Smack
 
! Tomoyo
 
! Tomoyo
 +
! Yama
 
|-
 
|-
 
! Dragora
 
! Dragora
 +
| {{no}}<ref name="dragora-apparmor">Dragora currently has 'CONFIG_SECURITY_APPARMOR is not set' inside [https://repo.or.cz/dragora.git/blob/HEAD:/archive/kernel/config-amd64_generic config-amd64_generic]</ref>
 
| ?
 
| ?
 +
| {{no}}<ref name="dragora-selinux">Dragora currently has 'CONFIG_SECURITY_SELINUX is not set' inside [https://repo.or.cz/dragora.git/blob/HEAD:/archive/kernel/config-amd64_generic config-amd64_generic]</ref>
 +
| {{no}}<ref name="dragora-smack">Dragora currently has 'CONFIG_SECURITY_SMACK is not set' inside [https://repo.or.cz/dragora.git/blob/HEAD:/archive/kernel/config-amd64_generic config-amd64_generic]</ref>
 +
| {{no}}<ref name="dragora-tomoyo">Dragora currently has 'CONFIG_SECURITY_TOMOYO is not set' inside [https://repo.or.cz/dragora.git/blob/HEAD:/archive/kernel/config-amd64_generic config-amd64_generic]</ref>
 +
| {{no}}<ref name="dragora-yama">Dragora currently has 'CONFIG_SECURITY_YAMA is not set' inside [https://repo.or.cz/dragora.git/blob/HEAD:/archive/kernel/config-amd64_generic config-amd64_generic]</ref>
 +
|-
 +
! Dynebolic
 
| ?
 
| ?
 
| ?
 
| ?
−
| ?
 
−
|-
 
−
! Dynebolic
 
 
| ?
 
| ?
 
| ?
 
| ?
Line 343: Line 394:
 
| {{no}}<ref>git grep -i lockdown in guix source code shows 'CONFIG_SECURITY_LOCKDOWN_LSM is not set'</ref>
 
| {{no}}<ref>git grep -i lockdown in guix source code shows 'CONFIG_SECURITY_LOCKDOWN_LSM is not set'</ref>
 
| {{no}}<ref>While there are SELinux policies for Guix, they are meant to use with a host distribution that supports SELinux. In addition there are many limitations that prevent this policy to make it practical or secure to use Guix. See the [https://guix.gnu.org/en/manual/devel/en/guix.html#SELinux-Support SELinux Support part in the Guix manual] for more details.</ref>
 
| {{no}}<ref>While there are SELinux policies for Guix, they are meant to use with a host distribution that supports SELinux. In addition there are many limitations that prevent this policy to make it practical or secure to use Guix. See the [https://guix.gnu.org/en/manual/devel/en/guix.html#SELinux-Support SELinux Support part in the Guix manual] for more details.</ref>
 +
| {{no}}<ref>On x86_64 the kernel has 'CONFIG_SECURITY_SMACK=y' but there is no package for the smack userspace utilities.</ref>
 
| {{no}}<ref>No tomoyo package</ref>
 
| {{no}}<ref>No tomoyo package</ref>
 +
| {{yes}}<ref>On x86_64 the kernel has 'CONFIG_SECURITY_YAMA=y' and Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.</ref>
 
|-
 
|-
 
! Hyperbola
 
! Hyperbola
Line 349: Line 402:
 
| {{no}}<ref>It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.i686 i686 configuration] and [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.x86_64 x86_64 configuration] have '# CONFIG_SECURITY_LOCKDOWN_LSM is not set'.</ref>
 
| {{no}}<ref>It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.i686 i686 configuration] and [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.x86_64 x86_64 configuration] have '# CONFIG_SECURITY_LOCKDOWN_LSM is not set'.</ref>
 
| {{no}}<ref>It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.i686 i686 configuration] and [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.x86_64 x86_64 configuration] have  'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"' and no CONFIG_SECURITY_SELINUX.</ref>
 
| {{no}}<ref>It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.i686 i686 configuration] and [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.x86_64 x86_64 configuration] have  'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"' and no CONFIG_SECURITY_SELINUX.</ref>
 +
| {{no}}<ref>It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.i686 i686 configuration] and [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.x86_64 x86_64 configuration] have '# CONFIG_SECURITY_SMACK is not set'. In addition there is no package for the smack userspace utilities.</ref>
 
| {{no}}<ref>It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.i686 i686 configuration] and [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.x86_64 x86_64 configuration] have '# CONFIG_SECURITY_TOMOYO is not set'.</ref>
 
| {{no}}<ref>It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.i686 i686 configuration] and [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.x86_64 x86_64 configuration] have '# CONFIG_SECURITY_TOMOYO is not set'.</ref>
 +
| {{yes}}<ref>It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.i686 i686 configuration] and [https://git.hyperbola.info:50100/packages/core.git/tree/linux-libre-lts/config.x86_64 x86_64 configuration] have 'CONFIG_SECURITY_YAMA=y' and Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.</ref>
 
|-
 
|-
 
! LibreCMC
 
! LibreCMC
 +
| ?
 +
| ?
 
| ?
 
| ?
 
| ?
 
| ?
Line 362: Line 419:
 
  'CONFIG_SECURITY_LOCKDOWN_LSM=y', '# CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is not set' and 'CONFIG_LSM="landlock,lockdown,yama,integrity,bpf'. So on x86, lockdown is enabled by default if UEFI secure boot is on. However Parabola doesn't support UEFI Secure boot so we can assume it's disabled by default. Lockdown is not available on armv7h as all armv7h/aarch64 kernel have 'CONFIG_SECURITY_LOCKDOWN_LSM is not set'. There is documentation on how to enable lockdown manually in the [https://wiki.archlinux.org/title/Security#Kernel_lockdown_mode Security#Kernel_lockdown_mode] ArchLinux wiki page.</ref>
 
  'CONFIG_SECURITY_LOCKDOWN_LSM=y', '# CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is not set' and 'CONFIG_LSM="landlock,lockdown,yama,integrity,bpf'. So on x86, lockdown is enabled by default if UEFI secure boot is on. However Parabola doesn't support UEFI Secure boot so we can assume it's disabled by default. Lockdown is not available on armv7h as all armv7h/aarch64 kernel have 'CONFIG_SECURITY_LOCKDOWN_LSM is not set'. There is documentation on how to enable lockdown manually in the [https://wiki.archlinux.org/title/Security#Kernel_lockdown_mode Security#Kernel_lockdown_mode] ArchLinux wiki page.</ref>
 
| {{no}}<ref>Parabola has some SELinux related packages in the pcr repository, but they were only added to enable the development of SELinux policies for other distributions (Replicant). At the time of writing Parabola still doesn't have proper SELinux integration.</ref>
 
| {{no}}<ref>Parabola has some SELinux related packages in the pcr repository, but they were only added to enable the development of SELinux policies for other distributions (Replicant). At the time of writing Parabola still doesn't have proper SELinux integration.</ref>
 +
| {{no}}<ref>At least one kernel package has 'CONFIG_SECURITY_SMACK=y' but only for armv7h ([https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.armv7h armv7h configuration for linux-libre-vanilla]). Both i696 and x86_64 linux-libre-vanilla kernels have '# CONFIG_DEFAULT_SECURITY_SMACK is not set'  ([https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.x86_64 x86_64 configuration for linux-libre-vanilla] and [https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.i686 i686 configuration for linux-libre-vanilla]). There is also no packages for smack userspace utilities.</ref>
 
| {{yes|Can be enabled for x86_64 and i686}}<ref>There is a [https://www.parabola.nu/packages/pcr/x86_64/tomoyo-tools/ tomoyo-tools package] and at least one kernel package has 'CONFIG_SECURITY_TOMOYO=y' ([https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.x86_64 x86_64 configuration for linux-libre-vanilla] and [https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.i686 i686 configuration for linux-libre-vanilla]), Some armv7h kernel configuration have '# CONFIG_SECURITY_TOMOYO is not set' though like [https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.armv7h armv7h configuration for linux-libre-vanilla]).</ref>
 
| {{yes|Can be enabled for x86_64 and i686}}<ref>There is a [https://www.parabola.nu/packages/pcr/x86_64/tomoyo-tools/ tomoyo-tools package] and at least one kernel package has 'CONFIG_SECURITY_TOMOYO=y' ([https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.x86_64 x86_64 configuration for linux-libre-vanilla] and [https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.i686 i686 configuration for linux-libre-vanilla]), Some armv7h kernel configuration have '# CONFIG_SECURITY_TOMOYO is not set' though like [https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.armv7h armv7h configuration for linux-libre-vanilla]).</ref>
 +
| {{yes}}<ref>At least one kernel package has 'CONFIG_SECURITY_YAMA=y' for both x86_64 and i686 ([https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.x86_64 x86_64 configuration for linux-libre-vanilla] and [https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.i686 i686 configuration for linux-libre-vanilla]), Some armv7h kernel configuration have '# CONFIG_SECURITY_YAMA is not set' though like [https://git.parabola.nu/abslibre.git/tree/libre/linux-libre-vanilla/config.armv7h armv7h configuration for linux-libre-vanilla]). Note that Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.</ref>
 
|-
 
|-
 
! ProteanOS
 
! ProteanOS
 +
| ?
 +
| ?
 
| ?
 
| ?
 
| ?
 
| ?
Line 375: Line 436:
 
'CONFIG_SECURITY_LOCKDOWN_LSM=y', 'CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y', 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"'. So on x86, lockdown is enabled by default if UEFI secure boot is on. Since PureOS supports UEFI Secure boot, it can be enabled if UEFI secure boot is enabled, but it can't be deactivated easily if UEFI secure boot can't be deactivated (it may be possible by passing kernel argument through grub).</ref>
 
'CONFIG_SECURITY_LOCKDOWN_LSM=y', 'CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y', 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"'. So on x86, lockdown is enabled by default if UEFI secure boot is on. Since PureOS supports UEFI Secure boot, it can be enabled if UEFI secure boot is enabled, but it can't be deactivated easily if UEFI secure boot can't be deactivated (it may be possible by passing kernel argument through grub).</ref>
 
| {{yes|Can be enabled}}
 
| {{yes|Can be enabled}}
 +
| {{no}}<ref>On x86_64 there no package for the userspace utilities and at least the linux-libre-amd64 has '# CONFIG_SECURITY_SMACK is not set'.</ref>
 
| {{yes|Can be enabled}}<ref>On x86_64 there is a tomoyo-tools package and at least the linux-libre-amd64 has 'CONFIG_SECURITY_TOMOYO=y'.</ref>
 
| {{yes|Can be enabled}}<ref>On x86_64 there is a tomoyo-tools package and at least the linux-libre-amd64 has 'CONFIG_SECURITY_TOMOYO=y'.</ref>
 +
| {{yes}}<ref>On x86_64 there at least the linux-libre-amd64 has 'CONFIG_SECURITY_YAMA=y' and Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.</ref>
 
|-
 
|-
 
! Replicant 6.0
 
! Replicant 6.0
Line 381: Line 444:
 
| {{no}}<ref>checked by running 'grep LOCKDOWN */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.</ref>
 
| {{no}}<ref>checked by running 'grep LOCKDOWN */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.</ref>
 
| {{yes|Yes, difficult to disable}}<ref>There is no information on how to disable it so it's unknown if we just needs to edit some init files, or if we need to patch some files and recompile Replicant, etc. If you recompile Replicant 6.0, you will also have to generate scripts to migrate the data to your new signing key.</ref>
 
| {{yes|Yes, difficult to disable}}<ref>There is no information on how to disable it so it's unknown if we just needs to edit some init files, or if we need to patch some files and recompile Replicant, etc. If you recompile Replicant 6.0, you will also have to generate scripts to migrate the data to your new signing key.</ref>
 +
| {{no}}<ref>checked by running 'grep SMACK */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.</ref>
 
| {{no}}<ref>checked by running 'grep TOMOYO */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.</ref>
 
| {{no}}<ref>checked by running 'grep TOMOYO */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.</ref>
 +
| {{no}}<ref>checked by running 'grep YAMA */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.</ref>
 
|-
 
|-
 
! Replicant 11
 
! Replicant 11
Line 388: Line 453:
 
'# CONFIG_SECURITY_LOCKDOWN_LSM is not set', so lockdown is disabled.</ref>
 
'# CONFIG_SECURITY_LOCKDOWN_LSM is not set', so lockdown is disabled.</ref>
 
| {{no}}
 
| {{no}}
 +
| {{no}}<ref>After running 'make ARCH=arm replicant_defconfig' in the kernel source, it creates a .config with 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"' and '# CONFIG_SECURITY_SMACK is not set', so yama is disabled.</ref>
 
| {{no}}<ref>After running 'make ARCH=arm replicant_defconfig' in the kernel source, it creates a .config with 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"' and '# CONFIG_SECURITY_TOMOYO is not set', so tomoyo is disabled.</ref>
 
| {{no}}<ref>After running 'make ARCH=arm replicant_defconfig' in the kernel source, it creates a .config with 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"' and '# CONFIG_SECURITY_TOMOYO is not set', so tomoyo is disabled.</ref>
 +
| {{no}}<ref>After running 'make ARCH=arm replicant_defconfig' in the kernel source, it creates a .config with 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"' and '# CONFIG_SECURITY_YAMA is not set', so yama is disabled.</ref>
 
|-
 
|-
−
! Trisquel 10 (nabia)
+
! Trisquel 12 (ecne)
 
| {{yes|Enabled by default, easy to disable}}<ref>On Ubuntu [https://ubuntu.com/server/docs/security-apparmor AppArmor is enabled by default], and Trisquel is based on Ubuntu.</ref>
 
| {{yes|Enabled by default, easy to disable}}<ref>On Ubuntu [https://ubuntu.com/server/docs/security-apparmor AppArmor is enabled by default], and Trisquel is based on Ubuntu.</ref>
−
| {{yes|Can be enabled at least on x86}}<ref>linux-image-5.13.0-52-generic has the following on x86_64:  
+
| {{yes|Can be enabled at least on x86}}<ref>linux-image-6.17.0-23-generic has the following on x86_64:  
 
  'CONFIG_SECURITY_LOCKDOWN_LSM=y', 'CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y' and 'CONFIG_LSM="lockdown,yama,integrity,apparmor'. So at least on x86_64 lockdown is enabled by default if UEFI secure boot is on. However Trisquel 10 doesn't support UEFI Secure boot so we can assume it's disabled by default. Trisquel 10 also doesn't support i686 but it supports aarch64 and someone needs to check the status on aarch64. There is documentation on how to enable lockdown manually in the [https://wiki.archlinux.org/title/Security#Kernel_lockdown_mode Security#Kernel_lockdown_mode] ArchLinux wiki page.</ref>
 
  'CONFIG_SECURITY_LOCKDOWN_LSM=y', 'CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y' and 'CONFIG_LSM="lockdown,yama,integrity,apparmor'. So at least on x86_64 lockdown is enabled by default if UEFI secure boot is on. However Trisquel 10 doesn't support UEFI Secure boot so we can assume it's disabled by default. Trisquel 10 also doesn't support i686 but it supports aarch64 and someone needs to check the status on aarch64. There is documentation on how to enable lockdown manually in the [https://wiki.archlinux.org/title/Security#Kernel_lockdown_mode Security#Kernel_lockdown_mode] ArchLinux wiki page.</ref>
 
| {{yes|Can be enabled}}
 
| {{yes|Can be enabled}}
 +
| {{no}}<ref>On x86_64 at least the linux-generic has 'CONFIG_SECURITY_SMACK=y' but there is no package for smack userspace utilities.</ref>
 
| {{yes|Can be enabled}}<ref>On x86_64 there is a tomoyo-tools package and at least the linux-generic has 'CONFIG_SECURITY_TOMOYO=y'.</ref>
 
| {{yes|Can be enabled}}<ref>On x86_64 there is a tomoyo-tools package and at least the linux-generic has 'CONFIG_SECURITY_TOMOYO=y'.</ref>
 +
| {{yes}}<ref>On x86_64 at least the linux-generic has 'CONFIG_SECURITY_YAMA=y' and Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.</ref>
 
|-
 
|-
 
! Ututo S
 
! Ututo S
 +
| ?
 +
| ?
 
| ?
 
| ?
 
| ?
 
| ?

Latest revision as of 21:06, 11 May 2026

Introduction

This page tracks the progress of FSDG distributions with regard to reproducible builds, bootstrapable builds and other similar security features.

Distributing software

Releases and signatures

Distribution Signed installers Comments
Dragora 3.0-beta2 Yes, signed images[1].
Dynebolic 4.0.0-beta Yes, signed images[2]
Guix 1.5.0 Yes, signed images[3]
Guix "latest" No[4] Workaround: Use Guix 1.5.0 and update it.
Hyperbola v0.4.2 Yes, signed images[5]
LibreCMC Yes, signed checksums[6]
Parabola Yes[7]
ProteanOS Yes: signed ProteanOS Development Kit commits[8]
PureOS 10 (byzantium) Checksums only.[9]
  • Workaround: Install PureOS from Guix or Parabola with debootstrap and pureos-archive-keyring
  • As a workaround it might also be possible to download the checksums through various ways (using multiple Tor routes, local connection), and compare them. Also make sure to download the checksums from the official website or a trusted mirror.
PureOS 11 (crimson) Checksums only.[10]
  • Workaround: Install PureOS from Guix or Parabola with debootstrap and pureos-archive-keyring
  • As a workaround it might also be possible to download the checksums through various ways (using multiple Tor routes, local connection), and compare them. Also make sure to download the checksums from the official website or a trusted mirror.
Replicant 6.0 0004 Yes, signed images[11]
Trisquel 11 (aramo) Yes, signed images[12]
Trisquel 12 (ecne) Yes, signed images[13]
Ututo S No: broken checksums (md5) only[14] You could still download the images multiple time and compare them with cmp. Though it's far from ideal.

Development source code and signatures

Distribution Signed development source code
Dragora No policies requiring to sign commits [15].
Dynebolic ?
Guix Yes, signed commits, authentication tool and instructions[16]
Hyperbola ?
LibreCMC ?
Parabola No policies requiring to sign commits
ProteanOS Yes: signed commit and verification instructions.[17]
PureOS ?
Replicant No policies requiring to sign commits[15][18].
Trisquel ?
Ututo S ?

Security updates and packages

Distribution Security updates available Automatic security updates Tools to check for CVEs Signed packages Protection against mirrors with outdated packages Known security issues Security related bug reports Comments
Dragora 3.0-beta1
Dynebolic 4.0.0-beta No[19] No[20]
  • No security updates
Guix 1.5.0 No[21] No[22] yes: guix lint Yes Yes:
  • The package definition come directly from Guix through HTTPS and are signed.[23]
  • Mirrors build packages and the signatures are enforced. Guix challenge can be used to check if the packages are reproducible.
  • No security updates
 Guix 1.5.0 can easily be updated to Guix "latest".
Guix "latest" Yes can be enabled[24] yes: guix lint Yes Yes:
  • The package definition come directly from Guix through HTTPS and are signed.[25]
  • Mirrors build packages and the signatures are enforced. Guix challenge can be used to check if the packages are reproducible.
 link
Hyperbola v0.4.2 Yes[26] No:
  • All mirrors use https or onion[27]
  • Trusts secondary mirrors for packages database:
    • uses secondary mirrors first[28]
    • It Doesn't enforce package database signatures[29]
LibreCMC
Parabola Yes No[30] ? Yes[31] partial:
  • Mirror redirection for packages that also uses https.[32]
  • Doesn't enforce package database signatures[33]
ProteanOS
PureOS 10 (byzantium) Yes can be enabled[34] Yes
Replicant 6.0 0004 Very few security updates[35] No[36] No N/A (no packages) N/A (no packages)
  • Based on Android 6.0 which is not maintained anymore
  • Use an old version of Webview which is full of security vulnerabilities. Many applications use the builtin Webview, including non-browser applications.
Trisquel 10 (nabia) Yes can be enabled[37] Yes
Trisquel 11 (aramo) Yes can be enabled[38] Yes
Ututo S

Repdoducible builds and bootstrapable builds

Distribution Reproducible builds officially supported[39] Comments
Dragora No
  • Not mentioned in the list of project supporting reproducible builds[40].
Dynebolic No
  • Not mentioned in the list of project supporting reproducible builds[40].
Guix Yes
  • Encourage any users to use the Guix challenge command to check the reproducibility of builds, and builds are supposed to be reproducible for all users (independently of the specific CPU, username, etc)
  • Part of Guix is now bootstrapable.[41].
  • Mentioned in the list of project supporting reproducible builds[40].
Hyperbola No
  • Not mentioned in the list of project supporting reproducible builds[40] but Arch Linux is mentioned there so maybe it's easier to add reproducible builds to Hyperbola.
LibreCMC No
  • Not mentioned in the list of project supporting reproducible builds[40] but OpenWRT is mentioned, so it might be easier to add reproducible builds to LibreCMC.
Parabola partial (Arch packages only)
  • Not mentioned in the list of project supporting reproducible builds[40] but Arch Linux is mentioned there, and for x86_64 some of the stock Arch Linux are reused. So at least part of Parabola is reproducible.
  • It has a wiki page that has a plan to add reproducible builds[42] but it needs people to work on actually doing some research on how to add reproducible builds and to implement it.
  • Arch Linux status: https://tests.reproducible-builds.org/archlinux/archlinux.html
ProteanOS No
  • Not mentioned in the list of project supporting reproducible builds[40].
PureOS No
  • Not mentioned in the list of project supporting reproducible builds[40] but Debian is mentioned there so maybe it's easier to add reproducible builds to PureOS.
Replicant No
  • Not using the Android prebuilt toolchain is the first priority, then we probably need to find how to activate reproducible builds when building releases.
  • Not mentioned in the list of project supporting reproducible builds[40].
Trisquel Yes
Ututo S No
  • Not mentioned in the list of project supporting reproducible builds[40].

Note that a "Yes" for reproducible means that the distribution cares about reproducibility.

So volunteers are welcome to report bugs on specific packages and/or to help fixing these bugs (maintainers also don't have an infinite time).

If we look in more details at the status of reproducibility, what "reproducible" means can vary a lot across time and distributions or operating systems.

Most distribution take 2 different setup and have some variations (like a different hostname, time of build, etc) and see if they manage to reproduce the same binary.

But some distributions have way more variations than that. For instance Guix have packages that can be reproduced with Guix being built differently (like the Guix being built by Trisquel, and the one being built by Guix).

So in these cases the binaries that are reproducible are safer as they are less likely to have malicious modifications when the whole compilation chain has been done from multiple distributions because according to the Trusting Trust paper, if the binary is the same, it either has the same malicious modification(s) or no malicious modifications. And carrying around the same malicious modification across widely different distributions and architectures is probably harder to achieve than to do it on a single distribution.

Security features

Access control

Distribution Apparmor Lockdown SELinux Smack Tomoyo Yama
Dragora No[43] ? No[44] No[45] No[46] No[47]
Dynebolic ? ? ? ? ? ?
Guix No[48] No[49] No[50] No[51] No[52] Yes[53]
Hyperbola No[54] No[55] No[56] No[57] No[58] Yes[59]
LibreCMC ? ? ? ? ? ?
Parabola Can be enabled[60] Can be enabled on x86[61] No[62] No[63] Can be enabled for x86_64 and i686[64] Yes[65]
ProteanOS ? ? ? ? ? ?
PureOS 10 (byzantium) Enabled by default, easy to disable[66] Can be enabled on x86_64[67] Can be enabled No[68] Can be enabled[69] Yes[70]
Replicant 6.0 No No[71] Yes, difficult to disable[72] No[73] No[74] No[75]
Replicant 11 No No[76] No No[77] No[78] No[79]
Trisquel 12 (ecne) Enabled by default, easy to disable[80] Can be enabled at least on x86[81] Can be enabled No[82] Can be enabled[83] Yes[84]
Ututo S ? ? ? ? ? ?
  1. ↑ Signing key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x35bdb9d46b56b5facb647c9b3aaf1cec203a99d5
  2. ↑ See Group:Software/FSDG_distributions/Dynebolic_signing_key for the public key that signed the images.
  3. ↑ https://guix.gnu.org/en/download/
  4. ↑ https://guix.gnu.org/en/download/latest/
  5. ↑ https://wiki.hyperbola.info/doku.php?id=en:manual:verify_live_images
  6. ↑ signed checksums: https://librecmc.org/librecmc/downloads/snapshots/v1.5.12/targets/ath79/generic/
  7. ↑ https://wiki.parabola.nu/Get_Parabola
  8. ↑ http://proteanos.com/doc/install/prokit/
  9. ↑ https://downloads.puri.sm/byzantium/gnome/2023-06-14/ . There is also a bugreport about it.
  10. ↑ https://downloads.puri.sm/crimson/gnome/2024-05-10/ . There is also a bugreport about it.
  11. ↑ https://ftp.osuosl.org/pub/replicant/images/replicant-6.0/0004/images/
  12. ↑ https://cdimage.trisquel.info/trisquel-images/
  13. ↑ https://cdimage.trisquel.info/trisquel-images/
  14. ↑ http://www.ututo.org/downloads/
  15. ↑ 15.015.1 Most commits are signed by the maintainer but other commits are not signed and there are no documented policies requiring to sign commits.
  16. ↑ https://guix.gnu.org/en/manual/devel/en/guix.html#Building-from-Git
  17. ↑ http://proteanos.com/doc/install/prokit/
  18. ↑ Replicant also consist of many repositories, and even if all commits were or are signed, it would be complicated to verify each repository without any tools for that. While in theory Replicant has a manifest file with repositories and commits/branches to use, it doesn't always use fixe revisions as this makes rebasing the changes easier. In addition there are Apache rewrite rules in place to redirect repositories when they were renamed between Android versions, so that also complicates things.
  19. ↑ From free-distros.html" "This is a “static” distro, normally run from a live CD. Since it will not receive security updates, it should be used offline."
  20. ↑ From free-distros.html" "This is a “static” distro, normally run from a live CD. Since it will not receive security updates, it should be used offline."
  21. ↑ There is no backport of the security fixes to stable releases. Instead users are encouraged to run guix pull to get the latest Guix version along with security fixes.
  22. ↑ There is no backport of the security fixes to stable releases. Instead users are encouraged to run guix pull to get the latest Guix version along with security fixes.
  23. ↑ The Guix channel is https://git.savannah.gnu.org/git/guix.git and channels signatures are enforced. If builders don't have a given package, the computer running guix will try to compile that package instead.
  24. ↑ The Guix manual explains how to enable unattended upgrades
  25. ↑ The Guix channel is https://git.savannah.gnu.org/git/guix.git and channels signatures are enforced. If builders don't have a given package, the computer running guix will try to compile that package instead.
  26. ↑ /etc/pacman.conf has the following:
    SigLevel = Required DatabaseOptional
    LocalFileSigLevel = Optional
  27. ↑ reference: https://repo.hyperbola.info:50000/other/mirrorlist/mirrorlist.txt
  28. ↑ Reference: the default /etc/pacman.d/mirrorlist
  29. ↑ Reference: /etc/pacman.conf has "SigLevel = [...] DatabaseOptional"
  30. ↑ Any kind of automatic updates are very very strongly discouraged. Even completely unofficial software to do that warn users very strongly and put a lot of mechanisms in place to make sure that users will be aware that this will break their system at some point.
  31. ↑ /etc/pacman.conf has the following by default:
    SigLevel = Required DatabaseOptional
    LocalFileSigLevel = Optional
  32. ↑ According to the default /etc/pacman.d/mirrorlist, it only uses "https://redirector.parabola.nu/$repo/os/$arch".
  33. ↑ However even if the redirector uses https, the package database signatures are not enforced since Parabola has "SigLevel = [...] DatabaseOptional" in /etc/pacman.conf by default.
  34. ↑ This can be done by installing and configuring the unattended-upgrades package
  35. ↑ In the latest Replicant 6.0 releases, only serious privacy issues were fixed. Since it's based on unmaintained Android versions its contributors cannot fix security updates without porting Replicant to newer Android versions.
  36. ↑ Users are expected to manually install new releases.
  37. ↑ This can be done by installing and configuring the unattended-upgrades package
  38. ↑ This can be done by installing and configuring the unattended-upgrades package
  39. ↑ If reproducible builds officially supported, the distribution should be listed on https://reproducible-builds.org, users should be able to open bugs about non reproducible packages and/or send patches to fix them. If it is not supported we could try to send patches to enable reproducible builds and/or help the distribution supporting it instead.
  40. ↑ 40.0040.0140.0240.0340.0440.0540.0640.0740.0840.0940.10 The official lists of projects supporting reproducible is at https://reproducible-builds.org/who/projects/ . Note that not all theses projects are FSDG compliant and that some might even contain nonfree software and other really problematic issues.
  41. ↑ Guix can now bootstrap its C toolchain (see The Full-Source Bootstrap: Building from source all the way down for more details), but some languages are not bootstraped yet (vala, Haskell, etc). See Group:Software/research/ProgrammingLanguages#Guix_status for more details.
  42. ↑ https://wiki.parabola.nu/Reproducible_Builds
  43. ↑ Dragora currently has 'CONFIG_SECURITY_APPARMOR is not set' inside config-amd64_generic
  44. ↑ Dragora currently has 'CONFIG_SECURITY_SELINUX is not set' inside config-amd64_generic
  45. ↑ Dragora currently has 'CONFIG_SECURITY_SMACK is not set' inside config-amd64_generic
  46. ↑ Dragora currently has 'CONFIG_SECURITY_TOMOYO is not set' inside config-amd64_generic
  47. ↑ Dragora currently has 'CONFIG_SECURITY_YAMA is not set' inside config-amd64_generic
  48. ↑ Guix has the AppArmor related packages with some basic AppArmor profiles inside, and its kernel also has AppArmor available. However at the time of writing the Guix manual has no information at all about AppArmor, and there is no service definition for it. In addition, AppArmor would probably need a way to find its profiles installed by other packages than AppArmor. And finally, some packages like hplip don't install yet AppArmor profiles.
  49. ↑ git grep -i lockdown in guix source code shows 'CONFIG_SECURITY_LOCKDOWN_LSM is not set'
  50. ↑ While there are SELinux policies for Guix, they are meant to use with a host distribution that supports SELinux. In addition there are many limitations that prevent this policy to make it practical or secure to use Guix. See the SELinux Support part in the Guix manual for more details.
  51. ↑ On x86_64 the kernel has 'CONFIG_SECURITY_SMACK=y' but there is no package for the smack userspace utilities.
  52. ↑ No tomoyo package
  53. ↑ On x86_64 the kernel has 'CONFIG_SECURITY_YAMA=y' and Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.
  54. ↑ Hyperbola has no apparmor package: https://www.hyperbola.info/packages/?q=apparmor
  55. ↑ It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both i686 configuration and x86_64 configuration have '# CONFIG_SECURITY_LOCKDOWN_LSM is not set'.
  56. ↑ It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both i686 configuration and x86_64 configuration have 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"' and no CONFIG_SECURITY_SELINUX.
  57. ↑ It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both i686 configuration and x86_64 configuration have '# CONFIG_SECURITY_SMACK is not set'. In addition there is no package for the smack userspace utilities.
  58. ↑ It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both i686 configuration and x86_64 configuration have '# CONFIG_SECURITY_TOMOYO is not set'.
  59. ↑ It seems that Hyperbola only has 1 kernel package: linux-libre-lts. linux-libre-lts's both i686 configuration and x86_64 configuration have 'CONFIG_SECURITY_YAMA=y' and Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.
  60. ↑ The Parabola kernel has AppArmor, and the AppArmor package (and various other packages) ship profiles in /etc/apparmor.d. There is also some documentation in the AppArmor Arch Linux wiki page.
  61. ↑ linux-libre, linux-libre-lts and linux-libre-vanilla have the following configuration for i686 and x86_64: 'CONFIG_SECURITY_LOCKDOWN_LSM=y', '# CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is not set' and 'CONFIG_LSM="landlock,lockdown,yama,integrity,bpf'. So on x86, lockdown is enabled by default if UEFI secure boot is on. However Parabola doesn't support UEFI Secure boot so we can assume it's disabled by default. Lockdown is not available on armv7h as all armv7h/aarch64 kernel have 'CONFIG_SECURITY_LOCKDOWN_LSM is not set'. There is documentation on how to enable lockdown manually in the Security#Kernel_lockdown_mode ArchLinux wiki page.
  62. ↑ Parabola has some SELinux related packages in the pcr repository, but they were only added to enable the development of SELinux policies for other distributions (Replicant). At the time of writing Parabola still doesn't have proper SELinux integration.
  63. ↑ At least one kernel package has 'CONFIG_SECURITY_SMACK=y' but only for armv7h (armv7h configuration for linux-libre-vanilla). Both i696 and x86_64 linux-libre-vanilla kernels have '# CONFIG_DEFAULT_SECURITY_SMACK is not set' (x86_64 configuration for linux-libre-vanilla and i686 configuration for linux-libre-vanilla). There is also no packages for smack userspace utilities.
  64. ↑ There is a tomoyo-tools package and at least one kernel package has 'CONFIG_SECURITY_TOMOYO=y' (x86_64 configuration for linux-libre-vanilla and i686 configuration for linux-libre-vanilla), Some armv7h kernel configuration have '# CONFIG_SECURITY_TOMOYO is not set' though like armv7h configuration for linux-libre-vanilla).
  65. ↑ At least one kernel package has 'CONFIG_SECURITY_YAMA=y' for both x86_64 and i686 (x86_64 configuration for linux-libre-vanilla and i686 configuration for linux-libre-vanilla), Some armv7h kernel configuration have '# CONFIG_SECURITY_YAMA is not set' though like armv7h configuration for linux-libre-vanilla). Note that Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.
  66. ↑ Installed from the iso installer, checked with sudo aa-status.
  67. ↑ linux-image-amd64 has the following configuration for i686 and x86_64: 'CONFIG_SECURITY_LOCKDOWN_LSM=y', 'CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y', 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"'. So on x86, lockdown is enabled by default if UEFI secure boot is on. Since PureOS supports UEFI Secure boot, it can be enabled if UEFI secure boot is enabled, but it can't be deactivated easily if UEFI secure boot can't be deactivated (it may be possible by passing kernel argument through grub).
  68. ↑ On x86_64 there no package for the userspace utilities and at least the linux-libre-amd64 has '# CONFIG_SECURITY_SMACK is not set'.
  69. ↑ On x86_64 there is a tomoyo-tools package and at least the linux-libre-amd64 has 'CONFIG_SECURITY_TOMOYO=y'.
  70. ↑ On x86_64 there at least the linux-libre-amd64 has 'CONFIG_SECURITY_YAMA=y' and Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.
  71. ↑ checked by running 'grep LOCKDOWN */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.
  72. ↑ There is no information on how to disable it so it's unknown if we just needs to edit some init files, or if we need to patch some files and recompile Replicant, etc. If you recompile Replicant 6.0, you will also have to generate scripts to migrate the data to your new signing key.
  73. ↑ checked by running 'grep SMACK */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.
  74. ↑ checked by running 'grep TOMOYO */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.
  75. ↑ checked by running 'grep YAMA */arch/arm/configs/lineageos_*' in kernel/samsung in the Replicant 6.0 source code.
  76. ↑ After running 'make ARCH=arm replicant_defconfig' in the kernel source, it creates a .config with 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"' and '# CONFIG_SECURITY_LOCKDOWN_LSM is not set', so lockdown is disabled.
  77. ↑ After running 'make ARCH=arm replicant_defconfig' in the kernel source, it creates a .config with 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"' and '# CONFIG_SECURITY_SMACK is not set', so yama is disabled.
  78. ↑ After running 'make ARCH=arm replicant_defconfig' in the kernel source, it creates a .config with 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"' and '# CONFIG_SECURITY_TOMOYO is not set', so tomoyo is disabled.
  79. ↑ After running 'make ARCH=arm replicant_defconfig' in the kernel source, it creates a .config with 'CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"' and '# CONFIG_SECURITY_YAMA is not set', so yama is disabled.
  80. ↑ On Ubuntu AppArmor is enabled by default, and Trisquel is based on Ubuntu.
  81. ↑ linux-image-6.17.0-23-generic has the following on x86_64: 'CONFIG_SECURITY_LOCKDOWN_LSM=y', 'CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y' and 'CONFIG_LSM="lockdown,yama,integrity,apparmor'. So at least on x86_64 lockdown is enabled by default if UEFI secure boot is on. However Trisquel 10 doesn't support UEFI Secure boot so we can assume it's disabled by default. Trisquel 10 also doesn't support i686 but it supports aarch64 and someone needs to check the status on aarch64. There is documentation on how to enable lockdown manually in the Security#Kernel_lockdown_mode ArchLinux wiki page.
  82. ↑ On x86_64 at least the linux-generic has 'CONFIG_SECURITY_SMACK=y' but there is no package for smack userspace utilities.
  83. ↑ On x86_64 there is a tomoyo-tools package and at least the linux-generic has 'CONFIG_SECURITY_TOMOYO=y'.
  84. ↑ On x86_64 at least the linux-generic has 'CONFIG_SECURITY_YAMA=y' and Yama doesn't seem specific userspace tools. Instead it adds system calls to enable processes to better protect themselves.
Retrieved from "https://libreplanet.org/wiki?title=Group:Software/FSDG_distributions/Security&oldid=72625"