Stock feature list. Kernel, SELinux, Trivalent, USBGuard — inherited. What this overlay adds or changes: our Features.

Features

Exploit mitigation

Install and enable hardened_malloc globally, including for Flatpaks.
Install Trivalent, our security-focused, Chromium-based browser inspired by Vanadium. ^{Why Chromium-based?} ^{Why not a Flatpak?}
SELinux confinement for Trivalent.
Kernel hardening via sysctl. ^details
Kernel hardening via kernel arguments. ^details
Configure chronyd to use Network Time Security (NTS).
Configurable DNS over TLS and local DNSSEC validation with Unbound via ujust dns-selector. systemd‑resolved is optionally available for compatibility.
Install USBGuard and provide ujust commands to automatically configure it.

Filling known security holes

Remove suid-root from numerous binaries, replacing functionality using capabilities, and remove sudo, su, and pkexec entirely in favor of run0. ^why?
Disable Xwayland by default (for GNOME, Plasma, and Sway images).
Disable thumbnailing by default (for GNOME, Plasma, and Sway images).
Disable install & usage of GNOME user extensions by default.
Disable KDE GHNS by default. ^why?
Remove the unmaintained and suid-root fuse2 by default.
Disable unprivileged user namespaces by default for the unconfined SELinux domain and the container SELinux domain, while retaining support for Flatpaks, Trivalent, and other applications that need unprivileged user namespaces. ^why?
Prohibit ptrace attachment by default. ^why?
Locking down Flatpak permissions to close sandbox escapes. ^why?

Security by default

Disable all ports and services for firewalld.
Use HTTPS for all rpm mirrors.
Set all default container policies to reject, signedBy, or sigstoreSigned.
Enable only the Flathub-verified remote by default.

Reducing information leakage

Add per-network or per-connection MAC randomization.
Disable coredumps.

Attack surface reduction

Blacklist numerous unused kernel modules to reduce attack surface. ^details
Use SELinux to restrict userspace access to various socket classes, including the kernel crypto API and IPSec sockets.
Protect against brute force by locking user accounts for 24 hours after 50 failed login attempts, providing password quality suggestions and making use of hardened password hashing.
Disable and mask a variety of services by default (including cups, geoclue, passim, and others).

Security ease-of-use

Provide system auditing tooling to verify the status of system hardening and provide users with suggestions.
Setup commands via ujust for installing desktop apps from common VPN providers.
Install Bubblejail for additional sandboxing tooling.
Provide tooling for automatically setting up and enabling LUKS TPM2+PIN integration for unlocking LUKS drives (on devices where the TPM is free of known vulnerabilities).
Provide tooling for automatically setting up and enabling LUKS FIDO2 integration for unlocking LUKS drives.
Provide toggles for a variety of the hardening set by default, for user convenience (ujust --choose).

General ease-of-use

Provide out-of-the-box support for patent-encumbered codecs and drivers, which Fedora doesn't provide for legal reasons.
Provide server images with the ZFS kmod and tooling preinstalled (-zfs).
Provide images for any desired Nvidia driver and kmod configuration: main images with Nouveau + NVK, nvidia images with the Nvidia-closed kmod and drivers, and nvidia-open images with the Nvidia-open kmod and drivers.
Provide tooling to easily change desktop environments by rebasing between our images (ujust rebase-secureblue).

On Unwoke SecureBlue — the stock snippet above is theirs. Use this as well or instead:

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/sergi270710267/unwoke-silverblue-trivalent:latest

That stock command rebases you off Unwoke onto their GHCR. Stay on ghcr.io/sergi270710267/… after the signed reboot. Pick the flavor on Install. Our images.

Install Homebrew, which provides an easy way to install and update many CLI tools, and set up Homebrew to use brew-proxy for additional security. ^details

Source: secureblue/secureblue.dev 507fba67112d. Fetched 2026-09-09 14:06 UTC. Apache-2.0. Not affiliated with secureblue.