I'm about to switch from Linux Mint to Debian. But before doing that I'm still looking into a few things to secure Debian.
1) The first thing I want is a kind of 'sandboxing' technology. This to separate/protect Firefox from the rest of my system, and another sandbox-thing to protect 'special documents'. I thought of a separated file manager (like a Dolphin alternative) which is sandboxed and encrypted; but that doesn't exist I guess. It doesn't necessary really need to be sandboxing, but something secure which should make it hard for malware to jump from my browser to my system, and from my system to my files.
But to protect Firefox I've already looked into Firejail, SELinux, and AppArmor. The first one wasn't secure enough IMHO, and I read that SELinux was too complex to configure; so I guess I'd go just with AppArmor. Just that when my browser would get exploited the payload/malware can't enter my system.
Is a kind of thing which would protect those specific files? I thought of encryption but that's unsecured when I decrypt it while working on the documents. And is AppArmor secure enough to protect Firefox?
2) Securing kernel with GrSecurity. GrSecurity patches some vulnerabilities in the kernel by controlling memory etc. However, I couldn't really find a tutorial on how to install it on Debian. They're were talking about installing Vanilla kernels, which are default unaltered kernels. But wouldn't this cause problems with Debian? Do those Vanilla kernels get updates as well, and do I need to compile those updated versions myself than each time? And ain't the Debian-altered-Linux-kernel not better than the Vanilla one for running Debian. And is there any tutorial about setting up GrSecurity on Debian? I looked at a few but they all use this kernel version linux-18.104.22.168 which is really old IMHO because we're now already having 3.x and 4.x.
Are Vanilla kernels good, secure, and well and easily updated? Up-to-date tutorial on how to setup GrSecurity for Debian?
For the rest, I already read the Debian HowTo Security manual and will apply most of those things. But I just still need to know those things about AppArmor, Sandboxing, and GrSecurity.
TL;DR at all
- Is AppArmor secure enough to protect Firefox
- Is there a kind of encrypted sandboxed filemanager, if no; how to protect specific documents against malware/separate them from the system
- Ain't replacing the default kernel of Debian with a Vanilla one a risk (harder to keep updated, not Debian-optimized, not getting same amount of patches,...)?
- Up to date tutorial on setting up GrSecurity for Debian?