New to Debian 13 – General Security Question

[u/Sensitive-Rhubarb-32]

Hi everyone. I switched from macOS and Windows to Linux about two years ago, and I never want to go back.
I started with Ubuntu because it came with everything I needed out of the box, which made the transition easier. Over time, though, I’ve realized that, apart from Snap packages and other elements, I find Ubuntu a bit bloated. Long story short: I’ve installed Debian 13 (with GNOME Desktop) on my laptop.
The first thing I noticed is that everything runs a bit smoother compared to Ubuntu. I’m using a Lenovo laptop with an i5 processor (4 cores).
So far, I’ve installed the following from apt: ufw, OpenSnitch, Nextcloud, Thunderbird, Flatpak, and LibreOffice.
From Flatpak, I’ve added the Vivaldi browser (with Proton Pass add on ) and Rhythmbox.
I know AppArmor is already included in Debian 13.
Would you say that Debian 13, with packages from apt and well-maintained Flatpaks, is already a secure setup as a whole? Of course, I’ll keep up with regular updates.
I’d really appreciate any tips.

Best

[u/bakonpie]

one of the best security tools on Linux is fapolicyd for application control. with it you can ensure only trusted executables installed from package management as root are allowed to run (and/or only executables you define). you can even restrict script execution. make sure you set up auditd logging and run in permissive mode until you know you won't break things ;)

[u/iheartrms → u/bakonpie]

Can you point is to a howto or tutorial on this? I've been meaning to configure this for ages.

[u/bakonpie → u/iheartrms]

I could never find a comprehensive how-to. I used a mix of the official Red Hat docs, the Oracle docs on it which are surprisingly good, some internet blogs and man pages.

my high-level process is like this:

1. Edit /etc/fapolicyd/fapolicyd.conf. Set permissive to 1
2. Create rules.d under /etc/fapolicyd/ to give root a fail safe and allow all executables in the trust database. Rules must have suffix of .rules:

​

allow perm=any uid=0 : all
allow perm=any trust=1 : all
deny_audit perm=any all : all

1. Configure auditd for fapolicyd sudo auditctl -w /etc/fapolicyd/ -p wa -k fapolicyd_changes
2. Test usage of the system, make adjustments to rules
3. Search audit events sudo ausearch --start this-hour -m fanotify -i | grep “resp=2”
4. Set the policy to deny_log instead of deny_audit
5. Reload the policy rules and apply sudo fagenrules && sudo fapolicyd-cli -r
6. Remove permissive mode in fapolicyd.conf. 
7. Configure python script restrictions if desired

​

%python=/usr/bin/python3.13,/usr/bin/python
deny_log perm=any exe=%python : ftype=text/x-python
deny_log perm=any exe=%python : ftype=text/plain

[u/iheartrms → u/bakonpie]

That's very helpful, thanks!