Is secureblue really more secure if browsers have to be installed in flatpaks?

Questions
1

Hi all,

I’ve been trying out secureblue on a second laptop but run into some major issues.

  1. firefox based browsers don’t work with hardened malloc

  2. I can’t seem to install either librewolf or mullvad on an atomic distro anyway.

This means that AFAIK I can’t install mullvad browser at all and I would need to install librewolf/tor as flatpaks and then disable hardened malloc for those flatpaks.

As I understand it flatpaks reduce security for browsers (as opposed to increasing it for most apps) as the flatpak sandboxing interferes with the browser sandboxing stopping it from working.

While most of the security tweaks to secureblue look great, if it decreases security on such a vital app as a browser does it really work out more secure?

Thanks

2

ujust with-standard-malloc firefox

run0 dnf config-manager addrepo --from-repofile=https://repository.mullvad.net/rpm/stable/mullvad.repo

rpm-ostree install mullvad-browser

ujust set-unconfined-userns on // https://secureblue.dev/faq#unconfined-userns

ujust with-standard-malloc mullvad-browser
3

It’s also worth mentioning that Trivalent (Secureblue’s default browser) is worth a try if you are going to use or need a chromium based browser.

Particularly Trivalent has better SELinux confinement than most (if not all) other desktop Linux browsers.

4

I tried your mulvad browser install process and got “Packages not found mullvad-browser” I got the same issue when I treid to install librewolf using a similar process.

5

Do you have the .repo files in /etc/yum.repos.d/?

/etc/yum.repos.d/mullvad.repo

/etc/yum.repos.d/librewolf.repo

Edit:

If you are a Mullvad VPN user, you could also try ujust install-vpn and select mullvad, which installs Mullvad VPN and enables the repo allowing you to also install mullvad-browser.

6

mullvad.repo is present (for some reason there is also a mullvad.repo.1 but librewolf.repo is not

7

It may but it will also have a very unique fingerprint and lacks both an in-built add blocker and manifest V2 support so I’d rather use something else.

9

I also tried installing brave browser on the host system. That worked but when I attempted to run it, it didn’t launch. I tried using the with-standard-malloc command you recommended but I first got a “permission denied (13)” error and then when I tried running the command with run0 a “fatal allocated error: invalid uninitialized allocatator usage” error

10

@any1 : You might want to add a step to enable user namespaces for unconfined_t. FAQ | secureblue

See above.