RPM vs Flatpak vs Appimage vs Snap

Ask Fedora
1

Hi new Linux user here,
my question is regarding which one of these packages to use for the best security and privacy ?

Tnx

1 Like
2

Since you are looking for privacy and security, I would say this.

  • rpm is a normal package, this I suppose is the baseline.
  • flatpaks are partially sandboxed so you could certainly argue that there is a potential increase in privacy and security although flatpaks set their own default level of sandboxing so after installing you should consider using a tool like flatseal to view and potentially change those defaults. On the other hand, flatpaks are sometimes packaged with older, out of date libraries so that could be a negative for security.
  • appimages provide no security and privacy benefits but are frequently packaged with older, out of date libraries
  • snaps are also partially sandboxed. However, they also send a lot of telemetry to canonical that cannot be disabled so from a privacy perspective that is definitely a negative.

In addition to that, you need to consider the source of the package. Ultimately, this is a bigger source of concern than the packaging format. For example, if you wanted to install firefox, you could get an rpm from the Fedora repos or you could get an rpm from Mozilla. Both of those should be pretty safe. On the other hand, if you get the firefox rpm from some random 3rd party repo, probably you should consider if the source can be trusted.

4 Likes
3

I would argue that RPM are generally going to be mainly because they’re auditable. The others bundle their libraries making it hard to grok what versions of those libraries are shipped and if they have exploitable vulnerabilities. Yes, they’re sandboxed, but that doesn’t mean they aren’t exploitable. Especially with Fedora, patches get tested and shipped via RPM repos very quickly. I’m not saying the others are going to be insecure (or that RPM are guaranteed to be either), but they are a lot harder to audit to make sure.

4 Likes
4

Understood, thank you both @dalto @vwbusguy for helping me understand. Now, I do have another question,now. I am wondering if using Firejail or something similar would increase or decrease security of a let say Firefox Browser RPM ? Or it would be better to just use a VM instead ?

1 Like
5

You need to start with “What are the security risks you are concerned with mitigating?” before you can develop a mitigation strategy.

Just trying to make to things “more secure” rarely works once you get past the basics like keeping up-to-date with patches, getting packages from trusted sources and ensuring you have a local firewall in-place.

4 Likes
6

Well, for work related reasons I frequently travel to China,on top of that I have to communicate via IM apps and e-mail with my colleges which are all located in different parts of China or neighboring countries.So I would like to lower the number of malware attacks to a minimum.Moreover,my colleges where targeted by malware attacks.

7

Browsers and electron apps might specifically benefit from flatpak and using flatseal to give more granular permissions, but honestly the best thing you can do is make sure you keep SELinux enforcing. That’s your real first line of defense against malware in modern Linux.

3 Likes
8

And the second line of defense is the user.
Being extremely careful of what web sites are browsed, what emails may be opened, what files may be downloaded, what links may be clicked, etc. is always the users best defense when added on top of SELinux.

1 Like
9

Would creating a guest only account and using sudo be good practice ? Also, I am considering running trusted code from source and or using PackageKit.

10

This isn’t answerable in isolation. Your security practices need to be viewed in total to understand how they fit together.

That being said, given your stated concerns, I don’t think this would make a tremendous difference either way but I would need to understand how you are using these controls and how they interact with your other controls to be sure.

I am not sure what you mean here. Are you planning on building all your software from source yourself?

I don’t see how using packagekit would help with security at all. It is an abstraction sitting on top of your package manager. If anything, it adds complexity.

11

This is already handled via RPM through signing. The first time you install an rpm from a third party (ie, RPMFusion), you are asked whether or not to accept the signing key. By default, dnf/yum will reject packages that fail being signed by a trusted signatures.