Secure Blue is it really secure?

vqrmbkog

I seen beginner often mentioning secureblue everywhere not only in this forum but in many forums.

SecureBlue has many hardening features enabled by default compared to traditional linux distro where we need to tweak everything manually to harden the system.

cons:

If your cpu is vulnerable to SMT then half your cpu cores will be gone because of smt disabled on vulnerable CPUs. It a security feature but you can remove this option if you threat model doesn't need this much.
SecureBlue doesnot comes with custom hardened kernel with hardened patch applied it only provides distro kernel. But they mentioned "In the future, we plan to build our own kernel with patches on top of Fedora’s kernel, including the OpenPAX patches". Hardening kernel is very important because its the core if the kernel is compromised, an attacker gains full system control.
By default your linux user is unconfined meaning if your system get's hacked the malware can do anything on your system needs no restriction at all. Its an deliberate choice because switching to confined user break things and the way you run sudo command also differs, you need to have some level of knowledge about linux to confine your user. lets say you switched from uconfined_r to user_r role (selinux role) for alice user. now alice does not have sudo access by design. Even if malware infect the alice user it won't affect the rest of system the malware can only do things which alice can do in the system like opening browser, watching videos like this doing general stuff nothing more than that. You can see the power of selinux now never disable selinux on your system.
There is no minimal installation iso at all if you really want hardened system you should keep your system minimal and install only the essential packages you need for your system. secureblue has three desktop varients gnome, kde and sway even the lightweight wm sway the iso size is 4.4 GB.

SecureBlue is doing amazing work of enabling many hardening features i genuinely appreciate their work also i am not here to Criticize their work instead i want people to understand these limitations there is no 100% secure distro at all we need to manually secure our system instead of relying on distro like secureblue to protect our system we need to learn how to protect our system you can slowly learn one by one there's come one day where it really pays off.

NoahRaketic

vqrmbkog secureblue, despite its hardening, inherits many of the security issues of desktop Linux. You will still be much less secure on secureblue, even with an aggressively hardened configuration, than on something like Android or Chrome OS (nor do the devs claim otherwise).

Namely, there is currently no verified boot implementation (weak verification of the bootloader if you have Secure Boot), there is no universal sandboxing mechanism, among other issues.

Revliss

Well, you know what to fix: switch kernel and harden users.

mercury

It may be, but its irrelevant to me, its a pain in the ass to use, so I don't...

Keep it simple, and you are more likely to use it on a daily basis.

Lucian

mercury It may be, but its irrelevant to me, its a pain in the ass to use, so I don't...

What exactly do you trying on Secure Blue that doesn't work because its Secure Blue?