Field Notes

source

secureblue features and FAQ

StatusStableUpdatedStands on2 sourcesSupportsnotes

Features. FAQ.

Two pages from the secureblue project website describing its hardening features and design rationale.

The features page catalogs secureblue’s layered defenses: hardened_malloc installed globally including for Flatpaks, Trivalent (a Chromium-based browser with SELinux confinement), kernel hardening via sysctl and boot arguments, SELinux-confined unprivileged user namespaces, USBGuard, DNS over TLS with local DNSSEC validation, Network Time Security for chronyd, LUKS TPM2+PIN and FIDO2 unlock tooling, and Bubblejail for additional sandboxing. The project also disables Xwayland by default on GNOME, KDE, and Sway images.

The FAQ explains that secureblue is not a distribution but a set of OCI bootable container images built on Fedora Atomic Desktop via BlueBuild. This lets the project focus on hardening and UX while Fedora handles packaging, repositories, and container infrastructure. The FAQ also addresses the linux-hardened kernel question: secureblue applies runtime configuration changes rather than a patched kernel, and plans to build its own kernel with OpenPAX patches. Its approach to unprivileged user namespaces uses SELinux confinement rather than a global disable, avoiding the suid-root requirement that a blanket disable would impose on Flatpaks and Chromium.

These are primary-source project documentation maintained by the secureblue developers.

Built on 2 sources (2 external).

Working out connections…