secureblueOffering hardened operating system images and the hardened-chromium package. Developed collaboratively as an open source project.
+A security-focused desktop and server linux operating system.
Get securebluerun0.' %}
+
+## Setup system DNS
+{: #dns}
+
+Interactively setup system DNS resolution for systemd-resolved (optionally also set the resolver for hardened-chromium via management policy):
+
+```
+ujust dns-selector
+```
+
+NOTE: If you intend to use a VPN, use the system default state (network provided resolver). This will ensure your system uses the VPN provided DNS resolver to prevent DNS leaks. ESPECIALLY avoid setting the browser DNS policy in this case.
+
+## Bash environment lockdown
+{: #bash}
+
+To mitigate [LD_PRELOAD attacks](https://github.com/Aishou/wayland-keylogger), run:
+
+```
+ujust toggle-bash-environment-lockdown
+```
+
+## LUKS TPM2 Unlock
+{: #luks-tpm2}
+
+{% include alert.html type='warning' content='Do not use this if you have an AMD CPU.' %}
+
+To enable TPM2 LUKS unlocking, run:
+
+```
+ujust setup-luks-tpm-unlock
+```
+
+Type `Y` when asked if you want to set a PIN.
+
+## Validation
+{: #validation}
+
+To validate your secureblue setup, run:
+
+```
+ujust audit-secureblue
+```
+
+## Optional: `hardened-chromium` Flags
+{: #hardened-chromium-flags}
+
+The included [hardened-chromium](https://github.com/secureblue/hardened-chromium) browser has some additional settings in `chrome://flags` you *may* want to set for additional hardening and convenience (can cause functionality issues in some cases).
+
+You can read about these settings [here](https://github.com/secureblue/hardened-chromium?tab=readme-ov-file#post-install).
+
+## Read the FAQ
+{: #faq}
+
+Lots of important stuff is covered in the [FAQ](/faq). AppImage toggles, GNOME extension toggles, Xwayland toggles, etc.
diff --git a/content/SECURITY.md b/content/REPORTING.md
similarity index 100%
rename from content/SECURITY.md
rename to content/REPORTING.md
diff --git a/content/articles/ARTICLES.md b/content/articles/ARTICLES.md
index 389cfda4..1a927f41 100644
--- a/content/articles/ARTICLES.md
+++ b/content/articles/ARTICLES.md
@@ -8,5 +8,6 @@ The main documentation for secureblue is at the top-level of the site, accessibl
Other articles on assorted topics related to secureblue:
-- [userns](/articles/userns) - Brief overview of what are user namespaces in Linux, why is the feature considered a security risk and how is it handled in secureblue.
-- [kargs](/articles/kargs) - List and brief explanation of the hardening kargs that the `ujust set-kargs-hardening` command can set.
+- [User Namespaces](/articles/userns) - Brief overview of unprivileged User Namespaces, the security risk they enabled and how secureblue handles that risk.
+- [Kernel Arguments](/articles/kargs) - List and brief explanation of the hardening kargs that the `ujust set-kargs-hardening` command can set.
+- [Flatpak](/articles/flatpak) - Flatpak: the good, the bad, the ugly.
diff --git a/content/articles/FLATPAK.md b/content/articles/FLATPAK.md
new file mode 100644
index 00000000..3cd765e2
--- /dev/null
+++ b/content/articles/FLATPAK.md
@@ -0,0 +1,25 @@
+---
+title: "Flatpak | secureblue"
+description: "Flatpak: the good, the bad, the ugly"
+permalink: /articles/kargs
+---
+
+# Flatpak
+
+Flatpak is an application packaging and distribution system for desktop linux. It uses bubblewrap under the hood to sandbox those applications and provide desktop linux with a de-facto standard sandboxing and permissions system. However, it has flaws and its sandboxing strength can vary significantly depending on how it is configured. secureblue addresses these flaws in a couple different ways.
+
+As with any application sandboxing system, flatpaks should be scoped down by default to as few permissions as they need to function. Even better, permissions should be granted directly by the user at app runtime like in android. Sadly, neither of these are the case today. Flatpak manifest maintainers define the set of permissions they believe to be necessary and sufficient for operation of their applications. When a flatpak is installed by a user, the flatpak's permissions default to those defined by the manifest.
+
+This is of course not ideal, but it's also not a reason to abandon flatpak entirely. There are many ways we can mitigate this issue:
+
+- users should configure permissions to their liking
+- users should submit default permissions changes to upstream flatpaks at their repos.
+- developers should overhaul flatpak and xdg portals to introduce a better permissions model
+
+What secureblue does in this case is provide a mitigation along the lines of the first option. We provide a `ujust` command to strip flatpaks of permissions by default, such that the user will need to specifically and deliberately grant permissions required by each application:
+
+```
+ujust flatpak-permissions-lockdown
+```
+
+This is not enabled out of the box on secureblue because it has a somewhat significant usability impact (many flatpaks will break due to missing permissions). Until the flatpak and xdg portal permissions model is improved, this is the most secure option we can offer. That said, users are still encouraged to report unnecessary permissions to upstream projects when found, while incremenetal development progresses on flatpak and portals.
diff --git a/content/articles/USERNS.md b/content/articles/USERNS.md
index ce8d0d82..8fd3801b 100644
--- a/content/articles/USERNS.md
+++ b/content/articles/USERNS.md
@@ -1,5 +1,5 @@
---
-title: "userns | secureblue"
+title: "User Namespaces | secureblue"
description: "Brief explanation of unprivileged user namespaces and how the feature is handled in secureblue"
permalink: /articles/userns
---
From 1d832430ac2bcdd10a3ee9158f9510bdb13bde90 Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Wed, 1 Jan 2025 20:04:17 -0800
Subject: [PATCH 02/35] changes
---
_includes/header.html | 1 -
content/POSTINSTALL-README.md | 197 ----------------------------------
2 files changed, 198 deletions(-)
delete mode 100644 content/POSTINSTALL-README.md
diff --git a/_includes/header.html b/_includes/header.html
index b6786dd3..ccd836b6 100644
--- a/_includes/header.html
+++ b/_includes/header.html
@@ -4,7 +4,6 @@
securebluerun0.' %}
-
-## Setup system DNS
-{: #dns}
-
-Interactively setup system DNS resolution for systemd-resolved (optionally also set the resolver for hardened-chromium via management policy):
-
-```
-ujust dns-selector
-```
-
-NOTE: If you intend to use a VPN, use the system default state (network provided resolver). This will ensure your system uses the VPN provided DNS resolver to prevent DNS leaks. ESPECIALLY avoid setting the browser DNS policy in this case.
-
-## Bash environment lockdown
-{: #bash}
-
-To mitigate [LD_PRELOAD attacks](https://github.com/Aishou/wayland-keylogger), run:
-
-```
-ujust toggle-bash-environment-lockdown
-```
-
-## LUKS TPM2 Unlock
-{: #luks-tpm2}
-
-{% include alert.html type='warning' content='Do not use this if you have an AMD CPU.' %}
-
-To enable TPM2 LUKS unlocking, run:
-
-```
-ujust setup-luks-tpm-unlock
-```
-
-Type `Y` when asked if you want to set a PIN.
-
-## Validation
-{: #validation}
-
-To validate your secureblue setup, run:
-
-```
-ujust audit-secureblue
-```
-
-## Optional: `hardened-chromium` Flags
-{: #hardened-chromium-flags}
-
-The included [hardened-chromium](https://github.com/secureblue/hardened-chromium) browser has some additional settings in `chrome://flags` you *may* want to set for additional hardening and convenience (can cause functionality issues in some cases).
-
-You can read about these settings [here](https://github.com/secureblue/hardened-chromium?tab=readme-ov-file#post-install).
-
-## Read the FAQ
-{: #faq}
-
-Lots of important stuff is covered in the [FAQ](/faq). AppImage toggles, GNOME extension toggles, Xwayland toggles, etc.
From 91f2916d9607c990ab167ebd456e0405cfad14cc Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Wed, 1 Jan 2025 20:05:58 -0800
Subject: [PATCH 03/35] fix url
---
content/articles/FLATPAK.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/content/articles/FLATPAK.md b/content/articles/FLATPAK.md
index 3cd765e2..ad3209a9 100644
--- a/content/articles/FLATPAK.md
+++ b/content/articles/FLATPAK.md
@@ -1,7 +1,7 @@
---
title: "Flatpak | secureblue"
description: "Flatpak: the good, the bad, the ugly"
-permalink: /articles/kargs
+permalink: /articles/flatpak
---
# Flatpak
From 32d05691f802ef2c0cd8a607a2a71c234b3cac44 Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Wed, 1 Jan 2025 20:23:26 -0800
Subject: [PATCH 04/35] fixes
---
assets/bitcoin.png | Bin 0 -> 38284 bytes
assets/ethereum.png | Bin 0 -> 38170 bytes
assets/litecoin.png | Bin 0 -> 38189 bytes
assets/monero.png | Bin 0 -> 37794 bytes
content/DONATE.md | 8 ++++----
content/REPORTING.md | 2 +-
6 files changed, 5 insertions(+), 5 deletions(-)
create mode 100644 assets/bitcoin.png
create mode 100644 assets/ethereum.png
create mode 100644 assets/litecoin.png
create mode 100644 assets/monero.png
diff --git a/assets/bitcoin.png b/assets/bitcoin.png
new file mode 100644
index 0000000000000000000000000000000000000000..4c1ab8d4398e873e37c8afe137e7b9f7b0134a31
GIT binary patch
literal 38284
zcmeFZcUV*D+C6MJV;KvhqFBK)h=}xFLUaHT0TBUF6e3-uN+$xD84C(3qlhRdXcVLf
zs5GTT2N6*bDWOP-sI){n5eOvt*2bCh&iTIIb$!=+&iwv6@j^nfv$OZJpXa{Uz1F(-
zxxIS~7k$6_`x!H4EHc`qzi-Bj*=O-{Zr&`s^6p}S&Wsr|XE`4*axpU6I%6JQ!