El Development of the next version of Fedora 45 continues and promises to be a decisive update in terms of security and usability.
And is that the Recent technical proposals submitted to the Fedora Engineering Steering Committee They reveal a clear focus on modernizing the installation process and strengthening protection against critical hardware-level vulnerabilities.
Considered one of the versions that will have the greatest focus on the structural integrity of the system, the next version of Fedora 45 not only seeks to facilitate the deployment of its operating systems, but also to secure them from their kernel..
Modernized remote installation with Anaconda WebUI
Uno of the most striking changes For atomic desktop editions, such as Silverblue and Kinoite, it is the Implementation of the Anaconda WebUI web interface for managing installations completely remotely.
When the target system starts with a specific parameter, the Users will be able to complete the entire process from a web browser on another computerThis solution completely eliminates the need to use traditional remote desktop clients, operating under a secure environment that requires PIN authentication and encrypts all network traffic by default.
Anaconda's web interface already supports remote development access via inst.webui.remote, but without authentication, TLS, or configuration isolation. This change adds the necessary production controls to implement it as an optional feature.
PIN-based authentication following the inst.rdppattern, with an opt-out option (inst.webui.remote.noauth) for development and trusted networks.
HTTPS with self-signed certificates: Cockpit generates them automatically.
Port 443 is the default for users to connect only via https://
Isolated cabinet configuration to prevent installer settings from leaking into the installed system.
Remote access is not enabled by default; the user must explicitly enable it using the `inst.webui.remote` startup option. Without this activation, the behavior remains unchanged. This change applies to Atomic Desktop images.
Additionally, This initiative seeks to replace the classic installer based on the GTK graphical interface with this new web tool. integrated directly within the installation images. This transition is especially beneficial for devices with very limited hardware resources, as the browser's heavy processing is run on the administrator's control machine, leaving the target device to process only a very lightweight web service.
Kernel hardening and cryptographic cleansing
On the other hand, distribution takes first step to retire crypto userspace API, a component that It has been declared obsolete due to the potential security risks it poses. The plan states that the use of this interface It will be restricted to only a very small group of known packages, paving the way for its planned final removal in future kernel versions.
In parallel, The obsolescence of certain hardware cryptographic acceleration mechanisms is addressed. that unnecessarily expanded the attack surface and that had been previously exploited to maliciously modify data. By removing these specific components, the Developers ensure a much more secure environment without sacrificing performance, relying fully on cryptographic implementations executed directly and securely in user space.
Advanced protection with Shadow Stack technology
In addition to that, also It has been proposed la Default enabling of Shadow Stack technology in compatible 64-bit systems. This mechanism, supported by the hardware of modern processors such as Intel from the eleventh generation onwards and AMD's Zen3 microarchitecture, creates an independent and unalterable list of return addresses for functions executed by the system.
If an attacker attempts to overwrite the return address in main memory through a buffer overflow, the The system will immediately detect the discrepancy by comparing it with Shadow Stack and will generate an exception.This measure effectively blocks the execution of unauthorized code. It will transparently protect all applications and libraries compiled with the distribution's standard tools, substantially enhancing the operating system's overall security posture without requiring user intervention.