Hi, I’m in a process of making fast, (extrenely) secure, and modern laptop. Currently I have Arch Linux with encrypted root partition (unlocked with Nitrokey or long password), secure boot, linux-hardened, firewalld, etc.
I’m running linux-hardened with custom config. I enabled AMD SME, kernel lockdown, added some xanmod patch for more specific cpus, and disabled some unnedded drivers (only those that I’m 100% sure I don’t need - Intel, NVidia, Microsoft, Google, Amazon, Virtio). Currently it takes ~50 minutes to recompile the kernel. Are there any tutorials what drivers to disable to speed up this process? After doing that I will try to compile it with -O3 and LTO. Do you know any patches for performance?
I’m planning to enable encrypted swap, install ClaimAV and install flatpak versions for every non open-source app I have.
I also want to have SELinux. Does anyone know where can I learn it? I had it on Fedora and it was not fun using it.
What are other ways I can make my laptop more secure?
50 minutes seems way too long - I run Gentoo on a 2nd gen i5 and my kernel compile is always under 20 minutes.
You are using make -j4 or make -j(number of CPU cores) for parallel compile, right?
On laptop with Ryzen 5 5500U (12 threads) it takes 50 minutes and on desktop with Ryzen 7 3700X (16 threads) it takes 20 minutes. I use all threads to compile the kernel.
It compiles way waster with Gentoo, because it has minimal config. I used the default config from Arch repos and modified it. It’s full of unneeded drivers, but I’m scared of disabling them. I already disabled wrong drivers a few times and had to use different kernel to boot.
