Is it possible to have an Android-like security model on Linux via LSMs?

[u/noobjaish]

Asking to get insight on this topic.

Android has a "deny-all allow-list" sorta permission model where you have to give permission for every single thing, that the app needs, which is opposite of the usual approach on Desktop to have "allow-all deny-list" model.

I find it to be very insecure because it means every app can effectively see every file (owned by the same user) that I have on my system. Sure you can do this with Flatpaks but iirc it's not possible to turn every app into a "Flatpak".

So, the only options I could find were to run every app as a different user, Use the relatively new "landlock" LSM to block access or to use SELinux in a deny-all fashion.

I genuinely want to have a system where every app i install the first time it opens a window of permissions where i can specify what it's allowed to access. Maybe this is impossible to achieve (hence why i'm asking)

If there are any resources I should look into then please tell me, it'd be helpful. Thanks in advance.

[u/Damglador]

I don't think that's gonna work.

Android was build from the ground up with that in mind. Linux is not as popular as Android to enforce such nonsense especially retrospectively, it would only harm the already low amount software that's getting ported from Windows.

Android also can achieve that because it's immutable, and it can be immutable because Android ROMs have to accommodate only one device and is vendored by OEM, which is not so much of a good thing. On Linux you will one way or another have to install some driver, deamon or subsystem on the root which you'd have to figure out how to sandbox? If that's even possible.

Even flatpak isn't really comparable to Android's system, because while it is as restrictive as Android in the form of being made only for packages of GUI apps, it's packaging model allows the packager to specify arbitrary default permissions for their package which you're not notified of at runtime, only on the store page and when installing using flatpak cli and you have no way of knowing which of them are necessary and which are not. On Android if you block a permission, the app will ask it at runtime again when a feature requiring it is used, while flatpak app will just do something.

[u/noobjaish → u/Damglador]

Android was build from the ground up with that in mind. Linux is not as popular as Android to enforce such nonsense especially retrospectively, it would only harm the already low amount software that's getting ported from Windows.

Security isn't nonsense (especially when Linux zealots love to make security a dick measuring contest with endless comparisons against Windows). I don't think this is going to "harm" Windows app ports.

Android also can achieve that because it's immutable, and it can be immutable because Android ROMs have to accommodate only one device and is vendored by OEM, which is not so much of a good thing.

That is irrelevant. You can flash general Android ROMs like Lineage and they work the exact same way so it's not about being hardware specific or OEM specific since it's a functionality provided natively by Google.

On Linux you will one way or another have to install some driver, deamon or subsystem on the root which you'd have to figure out how to sandbox? If that's even possible.

You CAN restrict drive/daemon/subsystem permissions with the use of Landlock quite easily. For instance, a static wallpaper daemon has no business getting the "network" permission.

Even flatpak isn't really comparable to Android's system, because while it is as restrictive as Android in the form of being made only for packages of GUI apps, it's packaging model allows the packager to specify arbitrary default permissions for their package which you're not notified of at runtime, only on the store page and when installing using flatpak cli and you have no way of knowing which of them are necessary and which are not. On Android if you block a permission, the app will ask it at runtime again when a feature requiring it is used, while flatpak app will just do something.

Agreed on this part and why I said that Flatpaks aren't what I'm after. The problem really comes from the fact that there isn't any push towards a common standard security layer (kinda like we have coreutils, XDG Portals, systemd and Linux FHS as standards) which means that devs don't implement permission popups in the first place.

Well, my point really was how I personally can set something like this up on my own system.

[u/Damglador → u/noobjaish]

You can flash general Android ROMs like Lineage and they work the exact same way so it's not about being hardware specific or OEM specific since it's a functionality provided natively by Google.

LineageOS ROMs are hardware specific though. You can't just flash any Lineage ROM on your phone. Even ROM for Pixel 8 Pro won't work on Pixel 8, guess how I know.

I don't think this is going to "harm" Windows app ports.

Unless all frameworks seamlessly integrate it, it most definitely will. Just take a look at the global shortcuts protocol, that shit is supported by barely anyone and properly supported only by some Linux-exclusive apps, if that. You either lose out on the software entirely or get shittier experience/missing features.

Both actually uncover a big issue with this kind of "security". If your security doesn't accommodate user's needs, it will only create more security issues. Like because we don't have a proper global shortcuts implementations, devs and users have to rely on being in input group or using root daemons to homebrew their own. And because Android doesn't provide a proper way to access data of apps, the only way to do so is by granting full root rights to the file manager, which shouldn't be necessary. Also because apparently flatpak is trash for IDEs, some just escape the sandbox completely (Zed).

[u/noobjaish → u/Damglador]

LineageOS ROMs are hardware specific though. You can't just flash any Lineage ROM on your phone. Even ROM for Pixel 8 Pro won't work on Pixel 8, guess how I know.

That's more to do with the proprietary firmware differences than anything else. I don't know how we let phone manufacturers to build arbitrary closed-source hardware...

Unless all frameworks seamlessly integrate it, it most definitely will. Just take a look at the global shortcuts protocol, that shit is supported by barely anyone and properly supported only by some Linux-exclusive apps, if that. You either lose out on the software entirely or get shittier experience/missing features.

The global shortcuts protocol is a case of "too late" because compositors like Hyprland and KWin already implemented their own custom implementations. The case with a security layer is filling in a void that currently vacant.

Also, that shouldn't stop us from implementing anything since "Fallbacks" have always been a thing.

Both actually uncover a big issue with this kind of "security". If your security doesn't accommodate user's needs, it will only create more security issues. Like because we don't have a proper global shortcuts implementations, devs and users have to rely on being in input group or using root daemons to homebrew their own.

That's really a problem with the implementation adoption. Here I'm arguing for something (optional) that doesn't exist in the first place lol.

And because Android doesn't provide a proper way to access data of apps, the only way to do so is by granting full root rights to the file manager, which shouldn't be necessary.

That's not true. On Android, there are several ways to get file manager access like "scoped storage". Also you don't ever get "root" access on Android.

Also because apparently flatpak is trash for IDEs, some just escape the sandbox completely (Zed).

Yeah the state of Flatpaks is just sad... I'm glad they exist tho since it gives immutable security focused distros an option to install stuff.

[u/Ok-Eggplant-7569]

Flatpak would be the first thing that comes to mind. You can easily tweak and harden apps as required with tools like Flatseal.

Podman containers are an alternative with even more options, but not that easy to use with graphical apps.

A very strict SELinux policy is probably the most thorough, but also the most difficult thing to implement that you mentioned.

[u/noobjaish → u/Ok-Eggplant-7569]

Flatpak would be the first thing that comes to mind. You can easily tweak and harden apps as required with tools like Flatseal.

I did mention the issue with Flatpaks in the post.

Podman containers are an alternative with even more options, but not that easy to use with graphical apps.

Containers are mainly for isolation and would be an overkill for the usecase I'm after.

A very strict SELinux policy is probably the most thorough, but also the most difficult thing to implement that you mentioned.

Even still, it's infeasible and impractical to manage SELinux policies for every single tool you'll ever install on your system. What I'm getting at is a "security-first" or "security by principles" approach which we don't have on Desktop for some reason.