Features

Most of the security story is still secureblue’s (also mirrored here, updates daily). This page is everything this overlay adds or changes. Easy words + a living score vs stock: Compared — including prove it on the disk. Look is on Brand. What changed, day by day: Changelog. After login, Unwoke setup (app grid) explains the locks; ujust why maps “broken” to the matching toggle. ujust unwoke-test prints PASS/LOOSE/FAIL with a proof path for every overlay lock and shipped-first ticket (stock audit-secureblue does not). Strict apps: ujust install-proton, install-ivpn, install-mullvad (WireGuard first). Nothing unlocks unless you pick it.

Inherited from secureblue

We layer on their already-built, already-signed images. We do not reimplement these:

• hardened_malloc globally, including Flatpaks.
• Kernel hardening via sysctl and kernel arguments, with their ujust set-kargs-hardening.
• SELinux enforcing. Unprivileged user namespaces off for the unconfined domain, on for Flatpak.
• Xwayland off by default. GNOME user extensions off. KDE GHNS off.
• sudo / su / pkexec replaced with run0 on their images. SUID stripped from many binaries. fuse2 gone.
• USBGuard with their ujust helpers. firewalld closed by default. NTS for time. HTTPS rpm mirrors. DoT via ujust dns-selector.
• Module blacklist, ptrace off, MAC randomization, coredumps off, brew-proxy, Bubblejail as a tool, LUKS TPM/FIDO helpers, ujust audit-secureblue.
• Automatic updates. Their full ujust surface still works.

Read their list if you want the complete inventory. We did not gut SELinux, kernel args, disk encryption, or Secure Boot enrollment.

What this overlay changes

Four columns, left to right: stock secureblue, Unwoke Origin, Unwoke Trivalent (*-trivalent, the recommended default), Unwoke browserless. Trivalent is the same house browser as stock, then extra reversible policies stock does not force. Scroll sideways on a phone. Reverts: toggles.

Everything we add on top

• Strip Bazaar, GNOME Software, Plasma Discover. Hide leftover store launchers. Origin and browserless also strip Trivalent.
• Origin flavor (unsuffixed names): standalone brave-origin RPM (not brave-browser). Binary /opt/brave.com/brave-origin/brave. House browser for that flavor only — not the recommended default. Leo/Rewards/Wallet/VPN/Tor compiled out by Brave.
• Trivalent flavor: keep stock Trivalent + trivalent-selinux. No brave_t. Extra managed policies in /etc/trivalent/policies/managed/ plus launcher flags in /etc/trivalent/trivalent.conf.d/.
• SELinux (Origin only): fat brave_t (unconfined_domain) plus CIL allow-list so Chromium’s userns sandbox can start while harden_userns stays on. SUID stripped under /opt/brave.com/brave-origin.
• Browserless flavor: nothing put back. systemd units remask Flatpak browsers and rpm-ostree-exclude them until the allow toggle.
• Chromium managed policies (Origin: /etc/brave-origin/policies/managed/; Trivalent: /etc/trivalent/policies/managed/), split into reversible packs (hardening, devices, JIT-less, extensions, isolation, extra sandbox).
• Flathub off by default (stricter than stock). ujust set-flathub verified to match them.
• Flatpak permission lockdown (same cuts as their ujust flatpak-permissions-lockdown) default on.
• Bubblejail wrapper on the Origin desktop launcher (default on; ujust set-brave-bubblejail off).
• Homebrew off (stock ships it). Camera/mic locked at module+udev. Wheel GUI lock after a daily user exists.
• Isolation pack (Origin + Trivalent): no WebGL/WebGPU, SitePerProcess, origin-keyed processes.
• First-boot: re-enable harden_userns, apply defaults unless you stamped them off, promote ostree-unverified-registry → ostree-image-signed.
• RAM-disk noexec plus /var/tmp bind noexec (fail-closed after first boot), CET tunables, /boot 700 plus compose-time 700 on /usr/src and module dirs, Fedora-not-Mozilla CA blocklist (fail-closed), stock deprecation/Flathub-setup nags masked. All reversible.
• Chrony NTS on the installed OS (ujust set-nts off). USBGuard asked in Unwoke setup after login, default skip.
• DevTools locked by default on Origin and Trivalent. ujust set-brave-devtools allow.
• Privacy apply-boot: countme masked, no connectivity GET, DHCP anonymity (no hostname, iaid=mac, send-release, no LLMNR/mDNS), thumbnails off.
• Vendor installers (Proton, IVPN, Mullvad, …): JSON list, WireGuard/web first, hashed official RPM only if you insist. ujust install-vendor NAME.
• Steam: stock Flatpak or Distrobox, but ujust install-steam asks overlay locks first. Nothing silent.
• Whonix: official KVM, OpenPGP-required, clipboard/USB/mic off. ujust install-whonix / ujust start-whonix. Not VirtualBox, not Qubes.
• First day: setup on the dash, USBGuard in the GUI (default No), live Install icon named Unwoke, Steam/Gaming/Whonix on Start. Compared.
• Play window: ujust play steam — Fedora GameMode while the game runs, restore on exit/crash/reboot. Optional asked sched-ext. No CachyOS kernel. Setup → Gaming.
• Every stock app installer is intercepted: install-vpn, install-docker, enable-dangerzone, distrobox-assemble, set-flathub-unfiltered. Catalog: Stock installers. Tailscale yum-repo is watched.
• ujust unwoke-test plus see each lock yourself. Stock audit-secureblue does not list overlay extras.
• Unwoke wallpaper, lock image, GTK #3b6cff, GNOME named blue, KDE accent, GDM wallpaper. See Brand.
• This site. Daily mirror of their markdown under /secureblue/ (Apache-2.0). Our FAQ/Features/Install/Brand are never overwritten.
• Conduct, donate, contributing, post-install pages that are Unwoke’s, not theirs.

Brave Origin

Not full brave-browser. Policies live in /etc/brave-origin/policies/managed/. Restart the browser after a toggle. brave_t is unconfined-like on purpose. You do not get Trivalent’s Chromium patches or tight SELinux. For that, rebase to a *-trivalent image.

Origin compiled out Leo, Rewards, Wallet, VPN, Tor, Talk, News, P3A. What we add on top is enterprise policy, not a new browser.

Trivalent flavor

Same house browser as stock: Vanadium-derived patches, trivalent_t SELinux, their userns allow-list. We do not rebuild Trivalent. We add Chromium enterprise JSON stock does not ship, plus flags their README lists as optional extra hardening. All of it reverts with ujust.

Policies: /etc/trivalent/policies/managed/ (and a copy under /etc/chromium/policies/managed/). Extra flags: /etc/trivalent/trivalent.conf.d/. set-brave-* and set-trivalent-* are the same packs. We do not wrap Trivalent in Bubblejail — their FAQ says that pairing is broken.

What this does not add: new compiler/seccomp patches. If a policy already matches something Trivalent compiled in, the JSON is a no-op. The extras that stock does not force are JIT-less, WebGL/WebGPU off, extension blocklist, device/API guards, HTTPS-only, extra sandbox (audio sandbox, no screen capture, JS optimizer off), Network Service Sandbox, and punycode + clear-cross-origin-referrers.

Overlay ujust extras

Stock secureblue commands still work. Every overlay switch reverts. Defaults apply on each boot unless you stamped them off.

ujust unwoke-status
ujust audit-unwoke
ujust play steam
ujust install-whonix
ujust start-whonix
ujust install-steam
ujust install-vpn
ujust enable-dangerzone
ujust set-flathub verified|full|off
ujust set-flatpak-lockdown on|off
ujust set-flatpak-record on|off
ujust set-network-fs on|off
ujust set-ramdisk-exec on|off
ujust set-cet on|off
ujust set-boot-perm on|off
ujust set-extra-cas on|off
ujust set-nts on|off
ujust set-brave-hardening on|off
ujust set-brave-devices on|off
ujust set-brave-jitless on|off
ujust set-brave-extensions block|allow
ujust set-brave-isolation on|off
ujust set-brave-sandbox on|off
ujust set-brave-devtools lock|allow
ujust set-brave-bubblejail on|off          # Origin only
ujust set-trivalent-network-sandbox on|off # Trivalent only
ujust set-trivalent-referrers on|off       # Trivalent only
ujust set-brew on|off
ujust set-camera-mic on|off
ujust set-admin-split on|off|add NAME
ujust set-bluetooth on|off
ujust set-toolbox on|off
ujust set-extra-daemons on|off
ujust set-countme on|off
ujust set-connectivity-check on|off
ujust set-dhcp-hostname on|off
ujust set-thumbnails on|off
ujust set-disk-traces on|off
ujust set-anon-net on|off
ujust set-anon-hostname on|off
ujust set-stock-nags on|off
ujust set-unwoke-theme apply
ujust set-allow-browsers on ALLOW   # browserless only

Honest limits

• Origin: no Vanadium-style Chromium compiler/seccomp patches. JIT-less and enterprise policy are not a substitute. Rebase to *-trivalent for the patches.
• -trivalent extra packs are managed JSON / trivalent.conf.d flags. They do not add compiler patches on top of what Trivalent already ships.
• brave_t (Origin) is still unconfined-like. A tight jail is not shipped — Origin updates would break it, and it would still not be Trivalent.
• Signing key is a GitHub secret, not a hardware key.
• We inherit their signed image; we do not rebuild their kernel or SLSA pipeline.
• Toolbox, brew, AppImage, and rpm-ostree --disableexcludes bypass the browserless seatbelt.
• GNOME Shell cannot take a custom accent hex. GTK and KDE can. See Brand.