Have you seen this project?
I know of the existence of systemd-homed in general, but not this project discussion. Whatās your point?
1 Like
I see that the projectās discussion topic has the tag confined-users. I was wondering if the phrase āSelinux Confined Usersā you refer to includes this project or not.
They probably just tagged them, because it concerns the āSelinux Confined Usersā proposal.
1 Like
This wonāt happen anytime soon. I used Selinux Users on desktop and it was a major pain
Yep, itās probably years away.
Can recommend using and contributing to it, for people who can report and deal with Apparmor issues.
Iāll check it out
Would recommend to try it in a VM. Barely anything runs unconfined.
you mean kicksecure or arch?
What do you mean by now? CIL has been used for quite some time.
now as in in the last few years, to my knowledge. I didnāt realize they were lower level, I found them more intuitive. But then again I find most things about selinux more intuitive than apparmor. Maybe Iām just weird 
2 Likes
Off topic and wrong (read the following post by @ph00lt0 for clarification)
Then someone from the Privacy Guides @team should tag you as Secureblueās maintainer.
1 Like
Off topic, but just to be clear, maintainers should themselves apply for that badge and get verified. They are not just assigned by us.
1 Like
I thought that you and the rest of the team assigned badges to maintainers whenever you saw one on the forum, possibly to warn about possible conflicts of interest.
Thank you for the correction, will change my post accordingly.
apparmor.d in general, for example on Arch.
As a casual PC user, I took a look at apparmor.d project. First, the project owner is really maintaining the project with great dedication. But almost all of the profiles in the project are installed on complain mode by default, so I thought it would be a matter of trial and error for users to determine which of the hundreds of profiles would be stable on enforce mode. Users will have to take care of reporting their findings back to the project owner, if they are not too lazy. Moreover, the onus seems to be on users to guess which system applications, DEs applications and services that will be started in the future correspond to which of the hundreds of profiles, and whether it would be wiser to set those profiles to enforce mode or leave them in complain mode. I think that casual users have neither the knowledge nor the experience to guess these things. It is also expected that apparmor.d will be builded and packaged from source by the users themselves. The profiles in the source repository are always updated, AUR package may be updated by itself, but other packages may need to be updated by users. To install profiles under enforce mode, the package needs to be build according to this criterion. It would be easier for casual users if there were three prebuilt packages for default, enforce and full system modes. Finally, even with the package installed on enforce mode, hundreds of profiles are loaded on complain mode because they are unstable, and the AppArmor version on Arch Linux has been outdated for months.
In short, as long as the process of installing apparmor.d and updating profiles is not made easier for casual users, I think the concept of secureblue will continue to be more user-friendly. IMHO, it could be clarified how other internet browsers (Brave, Firefox, Tor Browser, etc.) should be installed and whether bubblejail should be used for those browsers.
1 Like
How does Secureblue compare to the Brace package when used on Fedora Silverblue??
2 Likes
So I took a proper look at secureblue and daily drove it for 2 days and I gotta say that this project is awesome! Iām definently voting for secureblue to be included in recommendations.
1 Like
Anyone know why this has been rejected?
the only problem is, the user has to use a cli to rebase the image and rpm-ostree has a learning curve, if you are only familiar with dnf etc.
you have to make your own iso atm.
5 posts were split to a new topic: Should Linux beginners use atomic or classic distros?
There is no good reason, and everything has been clarified by the creator.
Copying 4 commands into the terminal is a learning curve? Okay.
No, not only rebasing is a proper way to do it, but itās also easier.
FYI, weāre likely to drop custom ISO support entirely in favor of an interactive script that assembles the rebase command based on the userās selections. This way new users can all use the official Fedora ISO to install Fedora Atomic and then simply use our interactive selector to rebase. 
5 Likes
It would be great if you offer both, documented it in the readme. ISOs are more user friendly and new comers are familiar with it.