Trust

See each lock yourself

Keep locked You do not have to believe ujust unwoke-test. These are the same proofs, one at a time, with commands you type. They only read. They do not unlock anything. Stock ujust audit-secureblue does not cover this list.

One-shot script first: Check health. Tickets: Shipped first. Pitch vs stock: Prove it on the disk.

How to read a result. You should see the “healthy” output. If a stamp file under /etc/unwoke/ exists, you turned that default off — that is LOOSE, not a broken image. Live-ISO-only checks (#1185, #2432) skip on an installed ostree. That is expected.

Jump to a check

Flavor and no store

  1. Which overlay is this?

    cat /usr/share/unwoke/flavor
ls /usr/share/unwoke/SHIPPED-FIRST.txt /usr/share/unwoke/NOTICE /usr/share/unwoke/LICENSE

    Healthy: trivalent, brave-origin, or browserless. The three files exist. Stock has none of these paths.

  2. Stores really gone

    rpm -q gnome-software plasma-discover bazaar

    Healthy: each line says “is not installed.” Stock ships Bazaar.

#391 — /boot is 700

Kernel image dir not world-readable. Stock still asks for this. Revert: ujust set-boot-perm off.

stat -c '%a %n' /boot /usr/src /usr/lib/modules
ls /etc/unwoke/allow-boot-open 2>/dev/null || echo 'lock wanted (no stamp)'

Healthy: 700 on those directories. /boot is runtime; /usr/src and modules are 700 in the image. Stamp only re-opens /boot.

#697 — RAM disks cannot exec

Payloads in /dev/shm, /tmp, and /var/tmp should not run. Stock asked only for the RAM disks; we also bind-mount /var/tmp noexec so a payload cannot dodge into persistent temp. Revert: ujust set-ramdisk-exec on.

findmnt -no OPTIONS /dev/shm
findmnt -no OPTIONS /tmp
findmnt -no OPTIONS /var/tmp
ls /etc/unwoke/allow-ramdisk-exec 2>/dev/null || echo 'lock wanted'

Healthy: all three option lists include noexec. If they do not after first boot and you did not stamp allow-ramdisk-exec, that is a fail (fail-closed).

#887 — Flatpak session bus

Stock audit does not warn. Overlay lockdown should not grant session-bus, system-bus, or org.freedesktop.Flatpak.

flatpak override --show
flatpak override --user --show

Healthy: you see !session-bus / !system-bus (or those names absent as grants). A bare session-bus without ! is a fail. Stamp /etc/unwoke/flatpak-lockdown.off means you turned lockdown off.

#1185 — chrony NTS

Live USB and installed OS. Independent of ujust dns-selector. Revert: ujust set-nts off.

cat /etc/chrony.d/50-unwoke-nts.conf
ls /etc/unwoke/allow-clear-ntp 2>/dev/null || echo 'NTS wanted'

Healthy: server time.cloudflare.com iburst nts and server nts.ntp.se iburst nts. Missing after first boot is a fail unless you stamped allow-clear-ntp.

#1295 — SHSTK + IBT

Intel CET glibc tunables. Revert: ujust set-cet off.

cat /etc/systemd/system.conf.d/90-unwoke-cet.conf
cat /usr/share/unwoke/cet-system.conf
ls /etc/unwoke/cet.off 2>/dev/null || echo 'CET wanted on'

Healthy: GLIBC_TUNABLES contains x86_shstk=on and x86_ibt=on.

#1569 — DHCP anonymity

No hostname, IAID=mac, send-release. Revert: ujust set-dhcp-hostname on.

cat /etc/NetworkManager/conf.d/90-unwoke-dhcp.conf
cat /usr/share/unwoke/nm-privacy-dhcp.conf

Healthy: dhcp-send-hostname=false, dhcp-iaid=mac, dhcp-send-release=true. If only the file under /usr/share exists, apply-boot has not copied it to /etc yet — reboot.

#1606 — fewer trusted CAs

Fedora roots that are not Mozilla website-trusted. Revert: ujust set-extra-cas on.

ls /etc/pki/ca-trust/source/blocklist/unwoke-*.pem
ls /usr/share/unwoke/ca-blocklist 2>/dev/null | head
ls /etc/unwoke/allow-extra-cas 2>/dev/null || echo 'trim wanted'

Healthy: one or more unwoke-*.pem in the blocklist after first boot. Empty with no allow-extra-cas stamp is a fail.

#1885 — extra Flatpak folders

xdg + host-root cuts stock’s lockdown command does not force. Revert: ujust set-flatpak-lockdown off.

flatpak override --show | grep -E 'host-root|xdg-download|xdg-documents'

Healthy: those names appear as denied filesystems (often with !). Empty output right after first boot: run ujust set-flatpak-lockdown on only if you already turned it off; otherwise reboot and look again.

#2156 — Flatpak cannot record

Pulse + PipeWire capture blocked for Flatpaks. Native speakers stay. Revert: ujust set-flatpak-record off.

flatpak override --show | grep -Ei 'pulseaudio|pipewire'
ls /etc/unwoke/flatpak-record.off 2>/dev/null || echo 'record-block wanted'

Healthy: Pulse socket / PipeWire path denied, no stamp file.

#2354 — NFS/CIFS clients

Stock only masks the NFS server. We also blacklist client modules. Revert: ujust set-network-fs on.

cat /etc/modprobe.d/unwoke-network-fs.conf
cat /usr/share/unwoke/modprobe-network-fs.conf
lsmod | grep -E 'nfs|cifs' || echo 'modules not loaded (good)'

Healthy: blacklist nfs and blacklist cifs in the conf. lsmod should not show them unless you loosened.

#2432 — Encrypt on in Anaconda

Live USB only. After install this file is gone — skip.

grep -R 'autopart --encrypted' /etc/anaconda /usr/share/anaconda 2>/dev/null | head

Healthy on the stick: a line with autopart --encrypted. You can still untick Encrypt in the GUI. Stock starts with Encrypt off.

#2508 — Flatpak web browsers

Stock audit does not list them. Browserless should have none.

flatpak list --app --columns=application

Healthy: no Firefox/Chrome/Brave/Edge/Chromium/Tor/LibreWolf IDs. If one is there on a -browserless image, that is a fail.

#2526 — LUKS Argon2id 2 GiB

Default for later LUKS format on the OS (and the live ISO). Weaker only if you format LUKS yourself without this conf.

cat /etc/cryptsetup.conf
cat /usr/etc/cryptsetup.conf

Healthy: pbkdf = argon2id and pbkdf-memory = 2097152 (KiB = 2 GiB).

DevTools locked

Default locked. Revert: ujust set-brave-devtools allow.

ls /etc/brave-origin/policies/managed/60-unwoke-devtools.json /etc/trivalent/policies/managed/60-unwoke-devtools.json 2>/dev/null
ls /etc/unwoke/brave-devtools.off 2>/dev/null || echo 'DevTools lock wanted'

Healthy: the JSON exists on Origin or Trivalent. Stamp means you allowed DevTools. Browserless: skip.

USBGuard first-boot prompt

Asked in Unwoke setup after login, default No. Never silent-enable. Does not block GDM on tty1.

ls /etc/unwoke/usbguard-prompt.done 2>/dev/null || echo 'prompt not run yet'
wc -l /etc/usbguard/rules.conf 2>/dev/null || echo 'no rules yet'

Healthy: after first boot the done stamp exists. Non-empty rules only if you said Yes. Later: ujust setup-usbguard.

House defaults (not stock tickets)

Same idea: look at the stamp. No stamp = lock wanted.

# Bluetooth (Wi-Fi stays)
systemctl is-enabled bluetooth 2>/dev/null || echo 'masked/disabled (good)'
ls /etc/unwoke/allow-bluetooth 2>/dev/null || echo 'BT lock wanted'

# Flathub
flatpak remotes
cat /etc/unwoke/flathub 2>/dev/null || echo 'no stamp = Flathub off'

# Homebrew / toolbox / camera
ls /etc/unwoke/allow-brew /etc/unwoke/allow-toolbox /etc/unwoke/allow-camera-mic 2>/dev/null || echo 'those three locks wanted'

# Countme census
systemctl is-enabled rpm-ostree-countme.timer 2>/dev/null || echo 'countme not enabled (good)'
ls /etc/unwoke/allow-countme 2>/dev/null || echo 'countme lock wanted'

Healthy: remotes do not include Flathub until you chose it; Bluetooth not enabled; those allow-* files absent; countme timer not enabled.

If a check fails and you did not loosen it: do not “fix” it by turning the lock off. File a GitHub issue. Canary hits and a new keys/secureblue.pub stay manual on our side.