Secure Blue is it really secure?

vqrmbkog

I seen beginner often mentioning secureblue everywhere not only in this forum but in many forums.

SecureBlue has many hardening features enabled by default compared to traditional linux distro where we need to tweak everything manually to harden the system.

cons:

If your cpu is vulnerable to SMT then half your cpu cores will be gone because of smt disabled on vulnerable CPUs. It a security feature but you can remove this option if you threat model doesn't need this much.
SecureBlue doesnot comes with custom hardened kernel with hardened patch applied it only provides distro kernel. But they mentioned "In the future, we plan to build our own kernel with patches on top of Fedora’s kernel, including the OpenPAX patches". Hardening kernel is very important because its the core if the kernel is compromised, an attacker gains full system control.
By default your linux user is unconfined meaning if your system get's hacked the malware can do anything on your system needs no restriction at all. Its an deliberate choice because switching to confined user break things and the way you run sudo command also differs, you need to have some level of knowledge about linux to confine your user. lets say you switched from uconfined_r to user_r role (selinux role) for alice user. now alice does not have sudo access by design. Even if malware infect the alice user it won't affect the rest of system the malware can only do things which alice can do in the system like opening browser, watching videos like this doing general stuff nothing more than that. You can see the power of selinux now never disable selinux on your system.
There is no minimal installation iso at all if you really want hardened system you should keep your system minimal and install only the essential packages you need for your system. secureblue has three desktop varients gnome, kde and sway even the lightweight wm sway the iso size is 4.4 GB.

SecureBlue is doing amazing work of enabling many hardening features i genuinely appreciate their work also i am not here to Criticize their work instead i want people to understand these limitations there is no 100% secure distro at all we need to manually secure our system instead of relying on distro like secureblue to protect our system we need to learn how to protect our system you can slowly learn one by one there's come one day where it really pays off.

NoahRaketic

vqrmbkog secureblue, despite its hardening, inherits many of the security issues of desktop Linux. You will still be much less secure on secureblue, even with an aggressively hardened configuration, than on something like Android or Chrome OS (nor do the devs claim otherwise).

Namely, there is currently no verified boot implementation (weak verification of the bootloader if you have Secure Boot), there is no universal sandboxing mechanism, among other issues.

Revliss

Well, you know what to fix: switch kernel and harden users.

DeletedUser639

It may be, but its irrelevant to me, its a pain in the ass to use, so I don't...

Keep it simple, and you are more likely to use it on a daily basis.

Lucian

DeletedUser639 It may be, but its irrelevant to me, its a pain in the ass to use, so I don't...

What exactly do you trying on Secure Blue that doesn't work because its Secure Blue?

Odd

DeletedUser639

Odd

I gone off-topic. As the dev said is not the most secure OS it clarifys this point on his website. Anyway if you want use linux and you care about security it looks a very cool project. In my humble opinion the ublue base is a solid choice cause it relatively more easy to manage for non technical people and so more easy to suggest to people.

Odd

I switch to secureblue some months ago. I used arch previously and i tried to harden it more than i can but it was stressful to mantain. I'm lazy.

At the moment I'm trying to build a config for sway inspired by omarchy but without bloat. I'm also trying to be the less opinionated as possible. (Is this minimal approach opinionated too?)

Anyway the only stuff I had to tinkering on was to set up properly Ardour anything else was fixed by reading the FAQ on their website that are very well documented.

Chipper

Odd I did this using a minimal alpine Linux install as the base, did you have a base in mind for yours, sway is great.

CGG

Yes it is. I doubt anyone to give me a script to run in my hardened box that could break it. Simply post it here. I will run and give the result to the community. Something must be said... It takes months to really harden secure blue... Not an easy task and it doesn't come secure out of box. Challenge is opened.

NoahRaketic

CGG It sounds like you're just here to be proud of your un-audited setup.

CGG I doubt anyone to give me a script to run in my hardened box that could break it.

This is not how security works. Being patched against currently known vulnerabilities does not make a system secure. A system also needs strong proactive security and defense-in-depth measures. If you had the technical skills to properly harden a GNU/Linux system, you would know why the above quote is not meaningful.

The Linux desktop's current architectural security flaws cannot be solved by secureblue. I'm curious what hardening steps you could have taken to make it "really harden[ed]" after months of work.

The-Man

CGG
"It takes months to really harden secure blue... Not an easy task and it doesn't come secure out of box."

I use Tails, if its compromised I turn it off, then back on again, job done, takes seconds not months...

xbxbz

CGG It takes months to really harden secure blue

You mean to harden any distro like secureblue it takes months :) It's not true it will just take 1 - 2 hrs after you installed any minimal distro.

I can implement nearly almost all features listed by secure blue -> https://secureblue.dev/features

except for some unncessary stuff like gnome, kde.

I can even harden the distro much further than secureblue without breaking manythings.

xbxbz

CGG Yes it is. I doubt anyone to give me a script to run in my hardened box that could break it.

You mean you are telling its hard to exploit your system coz you are running secure blue lol :)

The OP listed cons no. 2 and 3 these are enough to exploit secureblue. especially the number 3 which creates huge attack surface. SecureBlue was made to usable by everyone so they can't harden specific to each person needs that's why its has so much attack surface on the other hand if you harden your system by yourself the no. 2 and 3 cons cannot do any harm to your system coz you already fixed that loop hole.

CGG

Oh yes you need the hardware part also... I have other secureboot solutions and a processor that has mte like protections... So hardware matters in this case...

littlerack

NoahRaketic GNU/Linux

An additional thanks for mentioning it like that)

xbxbz

The-Man I use Tails, if its compromised I turn it off, then back on again, job done, takes seconds not months...

Tails OS has too much attack surface.

https://www.privacyguides.org/en/desktop/

Tails is great for counter forensics due to amnesia (meaning nothing is written to the disk); however, it is not a hardened distribution like Whonix. It lacks many anonymity and security features that Whonix has. A Tails system that is compromised by malware may potentially bypass the transparent proxy, allowing for the user to be deanonymized.

Tails 7.4.2 (Posted 2026-02-11)
if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use DSA 6126-1 to take full control of your Tails and deanonymize you.

There is so many ways to deanonymize you when using Tails. Tails uses apparmor recently there is big critical apparmor vulnerability found These flaws, which have existed since Linux kernel version 4.11 (2017), allow unprivileged local users to escalate privileges to root, bypass container isolation, and cause system crashes through a "confused deputy" attack Over 12.6 million enterprise Linux systems running Ubuntu, Debian, and SUSE are vulnerable, including cloud environments, Kubernetes clusters, IoT devices, and edge infrastructure.

The-Man

xbxbz Tails OS has too much attack surface.

Any and every OS has too much attack surface.
If you believe in your OS 100% you will get caught out. Use your OS like its already compromised
I use Tails, its simple to use every day, after a certain amount of time I just reboot it.
I never do two things with a Tails stick, one for banking, one for email, one for web surfing etc.
I can use Tails from a SD card latched as read only if I desire
Nothing is stored on the Tails sticks, they can be formatted and disposed of at will,
I can if needed use the Tails sticks on any computer I choose,
I purposely have not entangled by life into one computer that does everything, a computer I cannot afford to be compromised, that way I dont need to spend months hardening a system only to become held to ransom by it.

Is secureblue secure?, I dont know or care for that matter. I did not like it when I tried it, it was not a good fit for me..
I see all too often people believing in their absolute invulnrability because the have invested far too much time into a device, they can't or will not see its weaknesses.
try this test, Factory re set your GrapheneOS pixel, right now, no saving of anything. Can you actually do it and recover or is it too complicated with profiles etc, have you a back up, have you tried it, do you know where its stored etc.
Now do the same with your Secureblue format the hard drive now, no extra saving of files etc, can you recover etc or are you not willing as it has become the center of your world with too many imortant items within it.
I can do both right now and be back up and running within 20 minutes, my security is simple not over complicated used daily, does not get in my way, current and up to date and can be wiped at a moments notice.
Not for everyone but it works for me...

Vincent96

Doomed to fail unfortunately.

GraphPaper

The-Man

I see all too often people believing in their absolute invulnrability because the have invested far too much time into a device, they can't or will not see its weaknesses

Sad but true

xbxbz

The-Man

The-Man If you believe in your OS 100% you will get caught out.

I know that no system is 100% secure.

The-Man Use your OS like its already compromised

For me, if I think like that if the system is already compromised, I can never use it again. Instead, I can follow principles like those in Qubes OS:
Zero Trust Architecture Never Trust, Always Isolate. No software is trustworthy.

Novalissoide

The-Man try this test, Factory re set your GrapheneOS pixel, right now, no saving of anything. Can you actually do it and recover or is it too complicated with profiles etc, have you a back up, have you tried it, do you know where its stored etc.

This is a really good excercise. 🫡👍