PrivSec-dev/privsec.dev
1
0
Fork 0
mirror of https://github.com/PrivSec-dev/privsec.dev synced 2025-02-08 04:11:34 -05:00
Code

Update Fedora Atomic/SecureBlue caveats

Browse Source
This commit is contained in:
Tommy 2025-02-03 10:46:32 -07:00 committed by GitHub
parent b3d3b36a5c
commit c5abc498f6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
content/posts/linux/Choosing Your Desktop Linux Distribution/index.md
View File

@ -67,11 +67,11 @@ Fedora's package manager, `dnf`, has a great rollback and undo feature that is g
{{< youtube id="-hpV5l-gJnQ">}}
One caveat with Fedora Atomic Desktops is that `rpm-ostree` currently have a hard dependency on `grub` and does not support Unified Kernel Images at the moment.
One caveat with Fedora Atomic Desktops is that `rpm-ostree` currently has a hard dependency on `grub` and does not support Unified Kernel Images. The consequence of this is that unlike Fedora Workstation, it is not possible to set up a Fedora Atomic with meaningful Secure Boot to resist physical tampering.
### SecureBlue
[SecureBlue](https://github.com/secureblue/secureblue) provides hardened operating system images based on Fedora Atomic Desktops. While they do add another party of trust, their images are substantially hardened and not easily replicated by hand. There are several very interesting packages maintained by SecureBlue as well:
[SecureBlue](https://github.com/secureblue/secureblue) provides hardened operating system images based on Fedora Atomic Desktops. While they do additional parties of trust (SecureBlue, GitHub infrastructure, BlueBuild, Negativo, etc), their images are substantially hardened and not easily replicated by hand. There are several very interesting packages maintained by SecureBlue as well:
- [Trivalent](https://github.com/secureblue/Trivalent), a hardened chromium desktop build with patches from GrapheneOS's [Vanadium](https://github.com/GrapheneOS/Vanadium).
- [Hardened Malloc](https://github.com/secureblue/fedora-extras/tree/live/hardened_malloc). SecureBlue packages GrapheneOS's memory allocator and enforce it system wide, including for Flatpak applications.