Do Linux desktop environments add security risks?

Question

I'm thinking about migrating to Fedora, but I'm not a big fan of Gnome3 so I'm thinking about using their Cinnamon spin. I've read in the past arguments whether or not Linux Mint is as secure as other distros, so I had a question:

Is it possible for the Cinnamon DE to bring any "security problems" to the Fedora operating system, and actually degrade Fedora's security? And, is this the case in general? Are you better off just using the default environment from a security standpoint, or does using an environment you install yourself not really alter the security of Linux?

FWIW, I'm pretty new to Linux so I'm exploring the different options I have. I've also started to take my security more seriously (partially what prompted me to move towards Linux), and I had a hard time finding a good answer to this question. Hopefully someone can help!

Answer 1

The key question is what untrusted inputs they process and how different the processing is.

Window managers do process icons and titles. Most of the time, they are trusted (they come from apps running with the same privileges), but – for example – some webpage might try to set a very long title, causing a bufferr overflow in the window manager. I believe that such threats are usually minor.

But desktop environment is not just window manager. It might use even a file indexer. I've recently seen an attack technique where a webpage causes a file download (Chrome saves such files by default) and exploits indexing engine. Because it can parse various types of files, attacker might have a large number of potentially vulnerable libraries to attack.

Desktop environment can also contains some widgets and utilities that download some data (e.g. weather forecast) over the Internet. Those are also somehow exposed to attackers.

If you are concerned about local security, you might want to compare screenlocks. However, screen locks work against less sophisticated attacks only.

To sum it up: When you are using traditional distros, there probably will not be significant differences, especially if you turn file indexing (if there is some present) off. Unless you use some totally bad desktop environment. However, if you are interested in securing your desktop OS, you might want to look at QubesOS. but this goes far beyond your original question.

Answer 2

You have mentioned that you are new to Linux. In which case, you can try out the main distributions such as Ubuntu to see how you go in terms of preference.

Now in terms of security, it's not a good approach to look at the question of "which distribution is the best for security" because you also need to consider what your use case is. Some people will find Qubes OS to be the best one for their use case, others will want to use Tails, other Whonix, others are fine with Ubuntu. Security-oriented distributions (like Whonix) will have certain features already available, like being able to send email over Tor.

If you are new to Linux (espcially if you are coming from environments like Windows, or some areas are not familiar to you like using the shell), I would suggest first going with a mainstream operating system like Ubuntu 16.04 LTS and then trying out the less mainstream options out there. But ultimately, a lot of the time what you define is security is fairly broad.

Answer 3

Using a different Desktop Environment shouldn't affect the security of the Fedora core. What can happen is that the DE you install has some vulnerabilities on top of that

Telling if a DE is more secure than other is hard to say and IMO has no sense to ask. What is more interesting is to know which ones have a better process to handle vulnerabilities once they're discovered

I would pick a regularly maintained DE. A good disclosure policy from the maintainers is nice to have, specially if you're subscribed to the security newletters that some organizations offer (f.e. I'm a Debian user and I receive almost daily mails about new security patches and which vulnerabilities they patch). This is IMO the best approach as you can look now for the "securest" software for your use case but nothing ensures it will remain secure forever

Answer 4

When it comes to security, then the major concern you should have is Network based applications. like apache, varnish, nrpe, Java based web server, or any network aware application, that accepts connections from outside world , sitting on your server/desktop. the more ports (network based apps) you open, at more risk your server/desktop is at.

As far as i know, desktop applications are nothing but non-network Local applications, which generally do not pose much threat to security as they dont listen on ports acting as servers for certain requests. so In this POV, Desktop applications dont pose much of security risk