General Debian Question is Fedora more secure than Debian because of SELinux out of the box?
in terms of security how does Debians compared to other distros?
31
u/michaelpaoli 1d ago
No, slapping SELinux on something doesn't at all guarantee it's secure(d) or more secure.
Extended filesystem attributes, AppArmor, SELinux, they all just make some additional (security) capabilities available, no more, no less.
6
u/Dolapevich 1d ago
And to express a frustration, I haven't seen a single case of those Mandatory Access Controls saving the day. And maybe that is the idea.
I've seen tons of cases of things not working or failing because of incorrect or missing policies or contexts.
13
u/roflfalafel 1d ago
I was working at one of the major hyper scalers when log4j happened. The year prior I had implemented SELinux policies for the public facing service I supported. SELinux stopped the log4j jndi string from actual script execution because I had locked down our service’s context to only what it needed, which literally saved us from a potential breach while the new deployments were rolling out with the fixes. The developers probably hated me for a year prior as I built SELinux smoke tests into our deployment pipelines, but they never said a thing about SELinux being annoying after log4j.
2
3
u/michaelpaoli 1d ago
And you're not likely to see reported cases of mandatory access controls saving the day. Most don't log such cases of access denied, and even if they do, they generally don't know that were it not denied, it would've lead to an exploit. And if it were wrong/missing and lead to an exploit, commonly there's not enough data logged to determine that was one of the aligned holes in the slices of Swiss cheese that lead to exploit and the start of a very bad day.
Rather like not hearing all those daily reports of the structural features of dams that kept them from failing that day, yet again. And when they fail, that one particular absence that could've saved the day might not even get mentioned, because there were other significant contributing factors, oh, like volumes of water.
8
u/gnufan 1d ago
Not used Fedora for ages, but in the server space Redhat with SELinux enforced is going to be more resilient to whole classes of attacks than Debian with AppArmour or SELinux. Redhat have done an amazing job with their SELinux policies.
That said over a long career in Unix and Linux system admin and webhosting, very few security problems would have been stopped, and a great deal of aggravation created by using these sorts of policies.
Whilst the day to day SELinux is pretty painless once you are use to it, it does mean anything unusual in webhosting and you need to create new policies to allow it. There is tooling so you can create it in your dev environment, and ask it to propose rules and most of the time it is close enough you can accept it or generalise it out just a bit. Also you can find unusual things failing because they aren't covered.
But SELinux is classic retrofit security you end up creating an alert whenever it logs something not to find badness, but because most commands that go wrong due to it fail silently or with cryptic errors because they aren't SELinux aware.
3
u/mcds99 1d ago
OH yes a September 2026 account.
The latest "Fedora" article of October 2, 2026 https://www.redhat.com/en/topics/linux/what-is-selinux
Come on don't let a single article make decisions for you or anyone else.
Read the Linux Security's article on AppArmor https://linuxsecurity.com/features/what-is-apparmor
As well.
It's like using power tools "read and understand".
6
u/penaut_butterfly 1d ago
that's not how security works on linux, is not about a certain program or policy running behind the curtains
5
u/victorian-ice-cream 1d ago
SELinux is more of an annoyance than actual security feature. Been a minute since I used anything Debian-based, but I heard AppArmor is less of a headache
3
u/The_Hamster_Shagger 1d ago
Selinux hasn't been a headache since late teen versions of fedora
2
u/victorian-ice-cream 1d ago
Every so often I get a headache because of it. It really likes to break random things.
Part of the blame is on Fedora for having a ridiculous SELinux policy, but it is what it is
1
u/bgravato 1d ago
Amen!
I inherited and had to admin an almalinux server for a while until recently and SELinux was more of a big PITA than anything else...
Thankfully we have not moved that server to a Debian server and life has been simple and easy again!
2
u/highspeedslippers100 1d ago
It depends a lots of things what apps and nftables settings and security comes in layers not just this Distro is more secure also a smaller digital footprint and I use Nextdns unbound and hardened sysctl kernel lockdown full disk encryption intel micro code. My Nftable runs in workstation mode. I also use dwl very small foot print then use Librewolf my file manager is nnn and the list goes on. Can Debian be secure yes absolutely but you need to do a bit work. it’s a bit like death by thousands cuts. I don’t know much about Fedora I don’t either care. But Debian has a dedicated security team. So on Fedora I can’t say.
1
u/highspeedslippers100 1d ago
Yeah forget mentioning the Appamor too and all the other jazz. But you get the point security comes in layers not oh my browser has a adblocker I am pretty unhinged on that part I block shit in domain level because I had enough of the big tech so I search for all the data brokers in all countries I know I am going to work and blocked them in domain all social media too and I honestly locked the shit so tight I almost blocked the hotdog stand beside Meta headquarters you know guilty because he sell them hotdogs. And then I use Hagezi multi ultimate Debian is my work machine OpenBSD is my daily driver.
1
u/Immediate_Fun2793 1d ago
Yes. I mean, you install a webserver and it can read your home folder. On reddit and fedora it can't without enabling it via selinux. That's just an example but most (all?) programs have policies and are pretty strict. That's why most people disable it when they run into trouble when they want to do things differently. Apparmor doesn't even come close. And if you wonder, it's not that I don't like debian or something. I've been running it since the 2.x days
1
u/orange_oki 1d ago
They still use it for Qubes OS in dom0, but I don't know! 🤷
"As of Qubes OS 4.1.2, the operating system running in dom0 is Fedora Linux running a paravirtualized Linux kernel. It is the Linux kernel in dom0 that controls and brokers access to all the physical system hardware, via standard Linux kernel device drivers." - wiki
To be honest, for decades a „Look, but don't touch.“ gentleman agreement was enough if you get access to resources without permission. 😌
So don't worry too much about security, keep the systems usable, and let the security experts do their update job.
Btw. just think about cookies, limited E-Mail support for Government communication and all that stuff which is a pain in the ass and actually not worth it. 😡
1
1
u/symcbean 1d ago
In 2016 I posted this: https://symcbean.blogspot.com/2016/11/selinux-sucks.html where I argue that SELinux is an anti-pattern for security. While it has actually got slightly less bad since then, I still think SELinux + targeted policy is bad.
1
u/gordonmessmer 1d ago
is Fedora more secure than Debian because of SELinux out of the box?
The question needs clarification... What role or use case are you considering?
Desktop use? For a typical desktop, not many processes will be confined by SELinux. There's some benefit, but it's relatively narrow. Fedora's primary security advantage over Debian is that it has much better patch coverage, and fewer known security vulnerabilities.
1
u/billFoldDog 1d ago
Unpopular opinion here:
Yes, but not in a way that matters to the typical end user.
Either SE Linux is protecting something you don't care about or its a massive pain in the ass in your way. If you don't know it really well its just plain annoying.
1
u/IonianBlueWorld 1d ago
It's more about how good is the setup rather than which one is "better". A good setup of one is more secure than a poor setup of the other. For a server, SELinux allows for the creation of more extensive and robust policies at the cost of higher complexity. Which means that you may not bother to set it up for your specific needs if the project isn't big enough. RHEL aims for big deployments, hence SELinux makes more sense. For an individual desktop computer, I think, apparmor is easier to set up, and that means that it gets used.
1
u/profeshamat Debian Stable 15h ago
AppArmor feels lighter weight and tucked out of the way where SELinux feels clunky and cumbersome by comparison.
1
-6
u/retr00two 1d ago edited 1d ago
Fedora is not built for security. It's RedHeat's Sid.
EDIT: Downvoted for pure fact?
0
u/G0ldiC0cks 1d ago
If you're not actively using se Linux, the fedora install as it lies isn't doing much. I imagine there's somewhere to get profiles for more software than the defaults it comes with, but otherwise lots of configuration that's probably worth it in the end.
-4
u/ThePowerOfPinkChicks 1d ago
how about https://wiki.debian.org/Hardening?pow_referer=
Linux "out of the box" is just the start. You will tweak it, as soon as you understand it. Nothing "out of the box" really fits all needs.
That said: debian can be as secure, as any other distro, as long as you update your backports and security fixes frequently. Like
## If you want access to contrib and non-free components,
## add " contrib non-free" after every "non-free-firmware" in this file:
deb https://deb.debian.org/debian bookworm main non-free-firmware
deb-src https://deb.debian.org/debian bookworm main non-free-firmware
deb https://security.debian.org/debian-security bookworm-security main non-free-firmware
deb-src https://security.debian.org/debian-security bookworm-security main non-free-firmware
deb https://deb.debian.org/debian bookworm-updates main non-free-firmware
deb-src https://deb.debian.org/debian bookworm-updates main non-free-firmware## If you want access to contrib and non-free components,
## add " contrib non-free" after every "non-free-firmware" in this file:
deb https://deb.debian.org/debian bookworm main non-free-firmware
deb-src https://deb.debian.org/debian bookworm main non-free-firmware
deb https://security.debian.org/debian-security bookworm-security main non-free-firmware
deb-src https://security.debian.org/debian-security bookworm-security main non-free-firmware
deb https://deb.debian.org/debian bookworm-updates main non-free-firmware
deb-src https://deb.debian.org/debian bookworm-updates main non-free-firmware
7
u/dkopgerpgdolfg 1d ago
Btw. your repo config is duplicated, and refers to an outdated Debian version.
2
1
66
u/pelazas1 1d ago
Debian's had AppArmor on by default since buster, so it's not running bare either.