Hardened operating system images based on Fedora Atomic Desktop and Fedora CoreOS

cross-posted from: https://lemmy.ml/post/26453685

Not many people have heard about secureblue, and I want to spread the word about it. secureblue provides hardened images for Fedora Atomic and CoreOS. It’s an operating system “for those whose first priority is using linux, and second priority is security.”

secureblue provides exploit mitigations and fixes for multiple security holes. This includes the addition of GrapheneOS’s hardened_malloc, their own hardened Chromium-based browser called Trivalent, USBGuard to protect against USB peripheral attacks, and plenty more.

secureblue has definitely matured a lot since I first started using it. Since then, it has become something that could reasonably be used as a daily driver. secureblue recognizes the need for usability alongside security.

If you already have Fedora Atomic (e.g. Secureblue, Kinoite, Sericea, etc.) or CoreOS installed on your system, you can easily rebase to secureblue. The install instructions are really easy to follow, and I had no issues installing it on any of my devices.

I’d love more people to know about secureblue, because it is fantastic if you want a secure desktop OS!

  • JustEnoughDucks
    4•16 hours ago

    Do you know if you can still do everything with it? Like atomic already has its own limitations and quirks. I can imagine there are bigger limitations with this.

    Like can you install driver-level stuff like tablet drivers, GPU/CPU control, udev rules, etc… I guess I don’t really know the implications of the extra hardening.

    • @[email protected]
      2•12 hours ago

      Not the one you asked, but please allow me give my take on the matter.

      Do you know if you can still do everything with it? Like atomic already has its own limitations and quirks. I can imagine there are bigger limitations with this.

      Being derived from Fedora Atomic, already comes with its own set of limitations; like being limited in which kernel mods you can make use of (without reinventing the wheel), or how UKI is unsupported or how you should probably create your own image if you want to populate /usr. You can’t even install software from any repository; e.g. installing the ProtonVPN RPM has been hit or miss for me.

      And, on top of this, secureblue’s hardening does (strictly) limit this even further. Most impactful, so far, would be the inability to use sudo or anything like it. Instead, run0 is suggested. I’m 100% sure that run0 is better. However, I’ve had at least 1 occasion on which the software doesn’t know how to properly interact in this setting. Ultimately, I’d have to give the blame on the software that doesn’t properly support run0. And, perhaps, you could help address the issue by opening a bug report related to it. But it’s definitely something to keep in mind.

      Finally, note on first setup you’re walked through the many different additional hardening that can be reverted based on your needs. Just be aware of that fact.

      Like can you install driver-level stuff like tablet drivers

      Maybe. Depends on what exactly it is.

      GPU/CPU control

      I have.

      udev rules

      Shouldn’t be a problem either.

      etc… I guess I don’t really know the implications of the extra hardening.

      If you’re interested, I suppose the best course of action would be to find a secondary device of yours and setup it to your heart’s content with secureblue. Whenever you face a roadblock, consider paying a visit to their discord server for support; they’ve been a great help so far. If, at some point, you find something you absolutely can’t do, then you’d have to make up your mind on what you deem more important. Wish ya the best of luck!