wiki/phyllomeos/security.md

46 lines
1.7 KiB
Markdown
Raw Normal View History

2022-01-31 12:35:56 +00:00
---
title: Security in Phyllome OS
description:
published: true
2022-01-31 13:01:01 +00:00
date: 2022-01-31T13:00:59.353Z
2022-01-31 12:35:56 +00:00
tags:
editor: markdown
dateCreated: 2022-01-31T12:35:54.544Z
---
# Security in Phyllome OS
2022-01-31 12:50:39 +00:00
> *Phyllome OS is currently in alpha stage. It should not be used to store any sensitive data*
{.is-warning}
Phyllome OS is a Fedora Remix and as such directly inherits every single security measures in place for Fedora-related distributions, such as SELinux. It also brings some unique security-related features.
2022-01-31 13:01:01 +00:00
* **Unique security-related features**
2022-01-31 12:50:39 +00:00
* Unprivileged virtual machines with `qemu:///session`, by default
* Filesystem-level encryption with `fscrypt`
2022-01-31 13:01:01 +00:00
* Minimal sets of applications by default
2022-01-31 12:50:39 +00:00
* **Planned features**
* Unattended installation of security updates
* `systemd` hardening
* `gnome-shell` hardening
2022-01-31 12:59:43 +00:00
* The Cloud Hypervisor for `vfio-pci`
2022-01-31 12:50:39 +00:00
## Features
### Data at-rest encryption
Currently, Phyllome OS does **not** provide any kind of encryption by default at the host level.
It provides early support for Filesystem-level encryption, which is just one line of defense.
For any virtual disks that will contain personal data, users are strongly advised to use full-disk encryption as provided by their guest operating system.
2022-01-31 12:59:01 +00:00
## Anti-features
2022-01-31 12:50:39 +00:00
2022-01-31 12:59:01 +00:00
### Graphic virtualization
2022-01-31 12:50:39 +00:00
2022-01-31 12:59:01 +00:00
Phyllome OS heavily relies on GPU or graphic virtualization, most notably through `virtio-gpu`, but also with `vfio-pci` or `vfio-mdev`. Granting a virtual machine 3D capabilities is not considered safe. Measures will be taken to reduce the risk, or at least to inform the user of potential security risks associated with certain techniques.
2022-01-31 12:35:56 +00:00
---
*[**Go to parent page**](https://wiki.phyllo.me/)*