Fedora’s choice to have ptrace_scope 0 sure is strange, it seems they had a discussion about it to revert it back to the upstream default of 1.
SEL being important was actually the main reason why in the light of recent kernel vulnerabilities I switched back to openSUSE, after being on Void for a while as inspired by this guide.
That the AUR is insecure lays basically in its name, I really don’t get why people would use for anything but the most niche packages.
What Android is doing well compared to Linux is that it has proper per application compartmentalization, whereas *nix systems would require each program to be run by a different user to separate them, though Linux is also improving in that regard, for example through SEL or the flatpak sandbox.
Fedora’s choice to have ptrace_scope 0 sure is strange, it seems they had a discussion about it to revert it back to the upstream default of 1.
SEL being important was actually the main reason why in the light of recent kernel vulnerabilities I switched back to openSUSE, after being on Void for a while as inspired by this guide.
That the AUR is insecure lays basically in its name, I really don’t get why people would use for anything but the most niche packages.
What Android is doing well compared to Linux is that it has proper per application compartmentalization, whereas *nix systems would require each program to be run by a different user to separate them, though Linux is also improving in that regard, for example through SEL or the flatpak sandbox.
Yeah I pretty much chose to take matters into my own hands by importing some of the SecureBlue defaults (with a few modifications) into my config.