1

I'm about to switch from Linux Mint to Debian. But before doing that I'm still looking into a few things to secure Debian.

1) The first thing I want is a kind of 'sandboxing' technology. This to separate/protect Firefox from the rest of my system, and another sandbox-thing to protect 'special documents'. I thought of a separated file manager (like a Dolphin alternative) which is sandboxed and encrypted; but that doesn't exist I guess. It doesn't necessary really need to be sandboxing, but something secure which should make it hard for malware to jump from my browser to my system, and from my system to my files.

But to protect Firefox I've already looked into Firejail, SELinux, and AppArmor. The first one wasn't secure enough IMHO, and I read that SELinux was too complex to configure; so I guess I'd go just with AppArmor. Just that when my browser would get exploited the payload/malware can't enter my system.

TL;DR
Is a kind of thing which would protect those specific files? I thought of encryption but that's unsecured when I decrypt it while working on the documents. And is AppArmor secure enough to protect Firefox?

2) Securing kernel with GrSecurity. GrSecurity patches some vulnerabilities in the kernel by controlling memory etc. However, I couldn't really find a tutorial on how to install it on Debian. They're were talking about installing Vanilla kernels, which are default unaltered kernels. But wouldn't this cause problems with Debian? Do those Vanilla kernels get updates as well, and do I need to compile those updated versions myself than each time? And ain't the Debian-altered-Linux-kernel not better than the Vanilla one for running Debian. And is there any tutorial about setting up GrSecurity on Debian? I looked at a few but they all use this kernel version linux-2.6.38.5 which is really old IMHO because we're now already having 3.x and 4.x.

TL;DR
Are Vanilla kernels good, secure, and well and easily updated? Up-to-date tutorial on how to setup GrSecurity for Debian?

For the rest, I already read the Debian HowTo Security manual and will apply most of those things. But I just still need to know those things about AppArmor, Sandboxing, and GrSecurity.

TL;DR at all

  • Is AppArmor secure enough to protect Firefox
  • Is there a kind of encrypted sandboxed filemanager, if no; how to protect specific documents against malware/separate them from the system
  • Ain't replacing the default kernel of Debian with a Vanilla one a risk (harder to keep updated, not Debian-optimized, not getting same amount of patches,...)?
  • Up to date tutorial on setting up GrSecurity for Debian?

Thanks!

closed as too broad by a CVn, schroeder Jan 15 '17 at 18:56

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Sorry, but this is too much for one question. Voting to close as too broad, but if you ask these as separate questions, they should be answerable (though e.g. the question on replacing the kernel or how to set up grsecurity on Debian might be a better fit for Unix & Linux than Information Security). – a CVn Jan 15 '17 at 13:31
  • @MichaelKjörling Besides the GRsecurity question; I'm asking if AppArmor is secure enough (yes/no) and if someone has experience with it. And as second if there are reliable methods to secure specific files (yes & method-name/no). That ain't really broad IMHO. – O'Niel Jan 15 '17 at 17:36
  • You've got product recommendations, asking for the location of tutorials, and a collection of unrelated questions all jammed into one post. Yep, too broad. – schroeder Jan 15 '17 at 18:56
  • 1
    I'm counting at least five separate questions under your "TL;DR at all". I also see no threat model against which we could judge the security of various solutions. – a CVn Jan 15 '17 at 20:19