A secure operating system

I do not use Qubes OS anymore. Consider this article outdated in various regards.

This is going to be a rather long post, and I cannot add sources for everything right away. I may add sources at any time without a notice (my edit policy still applies for other kinds of edits nevertheless). Note that for some things I might never be able to provide sources as these are simply things I heard about in public chatrooms.

As you may know, I am in the OS Security room on Matrix, in which various operating systems are discussed frequently regarding their security. The thing is, it is not that simple, as many that have reached widespread use today are much less secure than you would expect (while others which are also widely used are more secure than you might think, if not as secure as expected), and those that are secure basically always have some other kinds of drawbacks that are not directly related to security, but may be a dealbreaker nevertheless. I will mainly focus on desktop and mobile operating systems here, as servers have a very different quantity and quality of attack surface, and security should rather be provided by the often well-written, less complex server software, and isolation is done through hypervisors anyway, most of the time, as things like clipboard and file sharing are not that important.

Some basic terms

It might occur to you that you are not familiar with some of the terms used here. However, I do not know how I could be better at explaining them than Wikipedia is (doing so nevertheless seems redundant), so I decided to just link their respective pages for you here. (Note: I would normally not explain many of these if they were used in a shorter blogpost without all the others, however, the sheer amount of terminology made me deem it appropriate to explain all of them.)

Capability-based security

Microkernel

Namespace: Wider sense, narrower sense, for the latter also see Sandboxing

Formal verification

Control-flow Integrity (CFI)

Address Space Layout Randomization (ASLR)

Principle of least privilege

Memory safety

Verified boot: I will actually explain this one myself, because Wikipedia did not appear to have a good definition. Verified boot allows the boot firmware to prevent bootloaders and kernels that do not have a valid cryptographic signature that corresponds to some specified public key to be loaded. These are then supposed to verify the userland, effectively preventing persistent exploits. Now, there has been some criticism, because many devices only allow particular keys, however, good implementations allow you to unlock them, specify your own keys, and then relock them, meaning user freedom is not impacted by this.

Mandatory Access Control (MAC)

Virtual Machine (VM)

Linux (or GNU/Linux)

I do not even know where to start here. Linux distros offer easy to use, fast and versatile OSes, however, the security is very lacking.

Sandboxing

Linux systems by default have no sandboxing of applications at all, meaning a compromise of one app easily leads to full system compromise. Now, there are two "solutions" to this: The app distribution systems Snap and Flatpak. Flatpak, however, has some quite severe issues with its sandbox, and while I cannot state similar things about Snap, I have been told it was not much better, and it has its own set of issues, such as only allowing a single, proprietary app store.

General hardening and memory safety

The Linux kernel does not incorporate modern hardening techniques such as CFI, it is a monolithic kernel (which makes applying the principle of least privilege basically impossible), it is written in non-memory safe languages (mainly C), and the situation for desktop programs does not look that much better.

GUI stack

Update: I meant the most commonly used GUI stack. Of course, there is no "default", since GNOME, as well as Wayland compositors and Lomiri, default to Wayland or Mir, respectively.

The default GUI stack is X11, which has been said to be rather insecure, even by the developers themselves, as it allows any program to view and manipulate input and output from any other program. While Wayland is said to be more secure, keylogging through /proc is still possible.

Update: The mentioned exploit does not use /proc.

But I always thought Linux was super safe and had almost no bugs?

The kernel alone contains million lines of code. Syzbot, a bot used for testing Linux and other kernels finds plenty bugs every month, and many of them are not fixed.

Hardened Linux distros

Update: As mentioned above, the Wayland keylogger relies on the LD_PRELOAD environment variable, meaning properly sandboxed applications may not be able to exploit it. However, the issues with the kernel (which does the majority of the sandboxing itself through the namespaces feature), as well as the applications themselves remain.

Actually hardened Linux distros like Whonix or CLIP OS do provide better security, however they come or will come with restrictions like restricted root or not being able to make files executable that were not installed by the package manager, or running any app outside of a restrictive sandbox, due to their use of restrictive MAC policies. I also consider it likely that none of them can fix the architectural issues with the kernel and GUI stacks, as well as the fact most Linux programs are not designed to be run in a sandbox.

Android

Android is a Linux-based OS by Google that greatly improves on the security of the latter. All apps run in sandboxes confinedfrom each other, it has strong SELinux policies, and several devices feature a full verified boot implementation, in the case of theGoogle Pixel line, it is especially good, as it is possible to use custom keys, as well as both unlocking and relocking thebootloader. Memory safe languages like Java and Kotlin are commonplace. It also partially fixes the issue with Linux being amonolithic kernel, as it often uses stub drivers in the kernel that actually rely on userspace drivers. Nevertheless, oneshould not overlook issues such as the way it has become a closed ecosystem, with many devices being non-repairable, the useof a a very specific, apparently hard to port API (as the fact the Anbox compatibility layer for Linux does not work thatgreat shows), and the reliance of many apps on proprietary Google services (though, to be fair, this is less common in appsthat are free and open source software). Another issue is that neither the apps nor the GUI are really desktop friendly; theyremain focused on the use on small touchscreens. For security, GrapheneOS, which is based on Android, should be considered.

ChromiumOS

ChromiumOS is another OS by Google, based on Linux. Like Android, it uses SELinux policies, and offers isolation ofdesktop apps from the main operating system. However, there is one glaring issue with this: The central elemenet of the system,prominently featured in the name, and perhaps the one program with the largest attack surface; the web browser, is onlyisolated by its own sandbox as well as said SELinux policies, and not by the stronger isolation that their own KVM-basedemulator crosvm offers, which is written in Rust and can thus be considered memory safe. It is also one of the worstoperating systems for privacy due to the way how login is handled.

BSD

FreeBSD, OpenBSD, NetBSD, HardenedBSD and so on all promise secure operating systems. While they are probably not as bad asLinux, especially on servers, their security is still lacking, and they have no proper desktop security model at all, mainlybecause they use X11 for a GUI stack, and browsers that have sandboxes elsewhere are not sandboxed here. They still usememory unsafe languages and monolithic kernels. Here is some more information on OpenBSDspecifically, which, while having improved security for various programs, and utilizing quite a bit more hardening than Linux,is not actually as secure as it claims, due to aforementioned issues. Update: NetBSD runs some drivers in user space by using a special "rump kernel", which should make them more portable.Source

MacOS and iOS

Update: In the case of MacOS, it is actually very interesting, as it is one of the best sandboxes on desktop you can get…Furthermore, the GUI is said to be strong against keylogging. At the same time, iOS has a very strong sandbox and is good atsuspending background apps. A Hackintosh using OpenCore allows you to installMacOS on non-Apple hardware.

These are partially open source operating systems by Apple. They both have (locked-down) verified boot implementations, andboth employ a certain degree of sandboxing for apps. There is not much to say, they are rather good, but the only devices wherethey properly run is Apple ones, which are known for rather bad value and low repairability. The security model, while okay,is not too interesting to be honest. Privacy-wise, they are fine if telemetry is disabled, especially considering the factthat both the Safari web browser and the sandbox try to minimize tracking that can be conducted by websites and apps,respectively.

Windows

The main reasons I see this operating system being liked by the security community include the Hyper-V hypervisor, whichapparently is supposed to be formally verified, as well asWindows Defender Application Guard (WDAG), which is supposed to run the Microsoft Edge browser and other applications in aspecialized VM. Microsoft store apps are also sandboxed, however they are… well, mostly stereotypical apps, and less actual,common desktop software. Issues with this one include it is slow, cannot be properly used with a GUI (not that you would wantto anyway, given how much the Windows command line sucks compared to the one on POSIX/UNIX systems), highly targeted, proprietary,costs a lot of money if obtained legally, especially if you want the better versions with more security features and such, andis a privacy nightmare out of the box, some of which cannot be disabled in the non-Enterprise/Education versions.

Qubes OS

Qubes OS is actually one of my favorites, and it is what I used to write this post. It has agreat desktop security model based on isolating different programs into different VMs, good hardware compatibility due to theuse of a Linux kernel for drivers, and allows you to run instances of the same program isolated from each other (somethingthat other systems mentioned here mostly cannot, at least not as easily). It also has mechanisms for secure file andclipboard sharing, and generally provides better desktop integration than one might expect from virtual machines.The way it is based on running VMs also means that you can use different operating systems inside a unified interface. Issuesinclude that the Xen hypervisor is claimed to be less secure by some people at least (though this is partially mitigated bythe Qubes team, and the possibility of switching to different ones in the future is there), and that it really is not easy touse, to the point where one could almost consider adding it to the next category. I will probably write a blog post soonexplaining on how to set up Qubes OS, as there are quite some pitfalls that may lead to it not booting, especially whenusing disk encryption, despite the nice graphical installer… It is also quite resource intensive and 8GB of RAM might not beenough for heavy multitasking, speaking of experience. Nevertheless, if you can use it, it provides an exceptional desktopsecurity model utilizing things like disposable VMs with or without network connection, as well as Whonix and the like.

Experimental operating systems

These are operating systems that are noteworthy because of their security features, however are certainly not ready for dailyuse yet, and likely do not run on your hardware, unless, in some cases, you have an old (well, ancient) Lenovo ThinkPad.

Plan 9 from Bell Labs

Plan 9 was an operating system created by Bell Labs, with the idea of making truly everything a file (unlike UNIX systemswhich have ioctls and all that stuff), and running each process in a confined namespace, making things like keyboard input onlyvisible when the window was active, for example. The reason it was dismissed by many in favor of Linux and Windows might havebeen a generation gap, which is really unfortunate, considering howinteresting it was. It continues to live on as the 9front fork, which, while performing actualdevelopment, seems more focused on embedding memes into their documentation rather than actually improving it much or evenjust providing an HTTPS website… Update: 9front has an HTTPS website, but the certificate is invalid and issued for the wrong domain. Seriously, is Let'sEncrypt that hard?

Fuchsia

Fuchsia is a new operating system by Google utilizing capability-based security, which is focused onsecurity as well as privacy (though, given Google's history, a sane amount of skepticism should be applied to at least thelatter claim, even if they made some improvements to Android in that direction). It uses the Zircon kernel, which issomething in between a microkernel and a monolithic one, and has some kind of GUI… Memory safe languages are partially, thoughnot fully, used. Due to the large company behind it, this one may have better chances at getting hold in the market andrunning on real hardware than others mentioned here.

RedoxOS

RedoxOS aims to implement an entire microkernel-based operating system based on the memory safe Rustprogramming language. However, a kernel cannot solely be written using memory safe code, meaning some portions of it remainunsafe, and apart from the traditional POSIX user and file permissions, it does not really seem to offer any meaningfulsecurity model on top of that.

Genode

Genode is not actually an operating system by itself, but rather a framework to implementcapability-based security as a kind of low-level middleware, while using any kernel. It was originally developed at TUDresden, but now has its own company, Genode Labs. They offer the prebuilt SculptOS based on the NOVA microkernel runningLinux VMs for compatibility (note: not for security, as that is provided by the Genode stack), which may or may not run onyour hardware (some drivers were ported from Linux). The general idea is to expose only the minimal amount of software andhardware needed for a program to run.

seL4

seL4 is a formally verified, capability-based security microkernel that is used on embedded systemslike SIM cards and such. The Robigalia project wants to implement a userspace in Rust, however itappears to target IoT as well. Perhaps it can be used as a kernel for Genode at some point, who knows. Some people have alsoconsidered it for Qubes because it can be used as a hypervisor.Update: There has been a successful implementation of Genode on seL4,and what can be seen as the default userland of seL4 is CAmkES, bringing thetotal number of FOSS userlands for seL4 that are known to me to 3.

Barrelfish

This one is probably similar to seL4 in some ways. It is developed at ETH Zurich, and not formally verified (yet). I cannotreally tell what it is about, at time of writing they do not even have an HTTPS website, so whoknows whether it will actually be good for security, or really anything.

SpectrumOS

SpectrumOS essentially wants to be a NixOS-based Linux distro with crosvm from ChromiumOS portedto it, being in spirit similar to Qubes, while claiming to have "a lower barrier to entry and is easier to use and maintainthan other such systems". There is not really anything that can be installed and tried out at this early stage of development.

So, what should I use?

I guess you should have kind of decided on that by now. I have elaborated my opinion on most operating systems that aremore or less relevant nowadays, and as I said, Qubes kind of is my favourite. It is not only used by me, but also bypeople like Edward Snowden and Micah Lee, as their website shows, as well as thousands of others… But it should have becomeclear that each has their own disadvantages, and you should consider how much you value each factor, definitely.

Does it matter? Can't I just continue using Linux or whatever?

Of course you can. Due to the low market share, it is not even likely to get compromised, and you are likely not targeted… Ifyou can mitigate the usual malspam, dodgy files and such, the only attack surface remaining really is your browser, which canbe reduced by disabling JavaScript, or at least JIT compilation for JavaScript. Chromium is considered to be more secure thanFirefox due to the stronger sandbox and site isolation (and Ungoogled Chromium can provide great privacy as well). But, if youwant to stay on the safer side, consider using a different OS, or at least isolating different things into different VMs.