Linux kernel lockdown, integrity, and confidentiality
Linux security has been criticised[1] for not having security enabled by default, and for allowing users to disable the security measures. This leads to users avoiding setting minimal-rights policies, and leaving the doors open. When security is optional, policy issues in distributions also aren&#x27;t fixed quickly.<p>To limit applications rights to a minimum, SELinux, firewalls, and (systemd) sandboxes are all tools that could be used, but aren&#x27;t in  most installs. However, I think we are still lacking user-friendly interfaces (opensnitch is ported from MacOS).<p>One idea could be to let the desktop environment restrict one more capability a application on every run, inform the user before running it and ask the user after if the software worked correctly. That would gradually lead to a minimum set of software rights.<p>[1] <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=OXS8ljif9b8" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=OXS8ljif9b8</a>