Hi, I’m in a process of making fast, (extrenely) secure, and modern laptop. Currently I have Arch Linux with encrypted root partition (unlocked with Nitrokey or long password), secure boot, linux-hardened, firewalld, etc.

I’m running linux-hardened with custom config. I enabled AMD SME, kernel lockdown, added some xanmod patch for more specific cpus, and disabled some unnedded drivers (only those that I’m 100% sure I don’t need - Intel, NVidia, Microsoft, Google, Amazon, Virtio). Currently it takes ~50 minutes to recompile the kernel. Are there any tutorials what drivers to disable to speed up this process? After doing that I will try to compile it with -O3 and LTO. Do you know any patches for performance?

I’m planning to enable encrypted swap, install ClaimAV and install flatpak versions for every non open-source app I have.

I also want to have SELinux. Does anyone know where can I learn it? I had it on Fedora and it was not fun using it.

What are other ways I can make my laptop more secure?

  • ourob@discuss.tchncs.deEnglish
    191·
    1 year ago

    Look into installing AppArmor instead of SELinux. AppArmor is easier to configure, and SELinux is not officially supported on Arch.

    • GravitySpoiled@lemmy.mlEnglish
      5·
      1 year ago

      Running SELinux under a Linux distribution requires three things: An SELinux enabled kernel, SELinux Userspace tools and libraries, and SELinux Policies (mostly based on the Reference Policy). Some common Linux programs will also need to be patched/compiled with SELinux features.

      Now I know why I didn’t bother with selinux back when I used arch. I never had any issues with it on fedora with zero maintenance.

  • Pantherina@feddit.de
    4·
    1 year ago

    Look at secureblue for more things

    • hardened malloc (preloading is somewhat complex for flatpaks)
    • maybe more kargs

    That custom kernel sounds very cool. Not sure if replacing it works on Fedora Atomic, would be very much needed

    SELinux confined users is also very important, SELinux is kinda contradictory to flatpak though, as they do the same things often and Flatpaks often dont work because they are not built for it.

  • bodaciousFern@lemmy.dbzer0.com
    2·
    1 year ago

    50 minutes seems way too long - I run Gentoo on a 2nd gen i5 and my kernel compile is always under 20 minutes.

    You are using make -j4 or make -j(number of CPU cores) for parallel compile, right?

    • chevy9294@monero.townOPEnglish
      1·
      1 year ago

      On laptop with Ryzen 5 5500U (12 threads) it takes 50 minutes and on desktop with Ryzen 7 3700X (16 threads) it takes 20 minutes. I use all threads to compile the kernel.

      It compiles way waster with Gentoo, because it has minimal config. I used the default config from Arch repos and modified it. It’s full of unneeded drivers, but I’m scared of disabling them. I already disabled wrong drivers a few times and had to use different kernel to boot.