secureblue: Hardened Fedora Atomic and Fedora CoreOS images
Not many people have heard about secureblue, and I want to spread the word about it. secureblue provides hardened images for Fedora Atomic and CoreOS. It's an operating system "for those whose first priority is using linux, and second priority is security."
secureblue provides exploit mitigations and fixes for multiple security holes. This includes the addition of GrapheneOS's hardened_malloc, their own hardened Chromium-based browser called Trivalent, USBGuard to protect against USB peripheral attacks, and plenty more.
secureblue has definitely matured a lot since I first started using it. Since then, it has become something that could reasonably be used as a daily driver. secureblue recognizes the need for usability alongside security.
If you already have Fedora Atomic (e.g. Secureblue, Kinoite, Sericea, etc.) or CoreOS installed on your system, you can easily rebase to secureblue. The install instructions are really easy to follow, and I had no issues installing it on any of my devices.
I'd love more people to know about secureblue, because it is fantastic if you want a secure desktop OS!
(In honor of Holiday. You know who you are.)
https://secureblue.dev/Open linkView original on lemmy.ml
7 replies
Oh, I wasn't aware of this, but it seems very interesting. Might be great for my work machine! Would be an Intel-only laptop. Nothing worrisome stood out to me in the FAQ; anything I should be wary of?
Not OP. But, FWIW, I've been daily driving secureblue for over a year now. And it has been wonderful experience.
Note that, by virtue of its superior security model, preconceived knowledge may not translate well. However, if you read its documentation and FAQ, then I'm pretty confident that you should be fine. Thankfully, if something's not clear or if you're facing issues, then you're in good hands through their Discord.
Any particular friction with GPUs? I see that they have a Nvidia image and they actually recommend if possible to stay away from Nvidia but does it work well with Nvidia or AMD GPUs?
Can we maybe tinker it to get some of the things that we have in Bazzite?
Not that I'm aware off. IIRC, both secureblue and Bazzite rely majorly on this for their hardware enablement. Hence, I don't think this should be significantly different between them.
It should support both well, yes.
You definitely can. Anything in particular that wish you to get over from Bazzite?
::: spoiler Random
Initially, I had read the question as "Can I tinker with it?". The answer written below tries to address that question.
I can't think of anything that you couldn't do inherently compared to what's possible on Bazzite. Heck, the way you engage in the act of tinkering should be almost identical. Note, however, that they do differ in how they accommodate building your own images. Bazzite prefers the template found on this page. On the other hand, secureblue relies on BlueBuild's, instead. Note that BlueBuild's template can also be used for Bazzite*.
:::
Very minor things which may or may not be already available in Secureblue:
LatencyFleX, vkBasalt, MangoHud, and OBS VkCapture installed and available by default.
Patched Switcheroo-Control fixing default-broken iGPU/dGPU switching.
HDR available in game mode and full hardware accelerated codec support for H264 decoding.
Just to be clear, the Nvidia images support Nvidia GPUs well and the non-Nvidia images support AMD (and Intel) GPUs well*.
I will take a look, it looks interesting. Thank you very much