Images

Table of Contents

• Security recommendation
• Desktop
  • Stable
  • Experimental
• Server
  • CoreOS
  • IOT

Security recommendation

GNOME, KDE Plasma, Sway, and COSMIC (Silverblue, Kinoite, Sericea, and COSMIC images, respectively) secure privileged Wayland protocols like screencopy. This means that on environments outside of GNOME, KDE Plasma, Sway, and COSMIC, applications can access screen content of the entire desktop. This implicitly includes the content of other applications. It's primarily for this reason that Silverblue, Kinoite, and Sericea images are recommended.

In addition, GNOME also provides weak thumbnailer sandboxing in Gnome Files, and Thunar/Tumblerd on secureblue Sway images provide weak thumbnailer sandboxing via Glycin. These are both efforts to mitigate attacks via thumbnailers. COSMIC is planning to add thumbnailer sandboxing for the release of Epoch 2. It’s not known whether KDE plans to add this to Dolphin.

It should also be noted that our Sericea images disable the wlroots desktop portal, despite it being commonly used alongside Sway. This is because the portal reintroduces the screencopy vulnerability described above, which would undermine the security improvements in Sway for sandboxed applications. The downside of this is that by default on our Sericea images, flatpaks and applications that haven’t implemented protocol support (like chromium-based browsers) are entirely prevented from screenshotting and screensharing. If necessary, Sway users can configure this using their own portals.conf.

This section is a relative recommendation between the desktop environments available on secureblue. This should not be misconstrued as saying that any one solves any of the fundamental issues with desktop Linux security. For more details, consult the table below. Note: this table assumes no extensions are installed. Extensions are a significant source of attack surface in and of themselves and they can reduce the effectivness of, or completely negate, the security advantages described above.

Desktop

nvidia-open images are recommended for systems with NVIDIA GPUs Turing or newer (GTX 16XX+, RTX 20XX+). These include the new open kernel modules from NVIDIA, not Nouveau. nvidia images are recommended for systems with NVIDIA GPUs Pascal or older. These include the closed kernel modules from NVIDIA.

Stable

Silverblue (GNOME)

Kinoite (KDE Plasma)

Sericea (Sway)

Experimental

Note that there are no ISOs available for experimental images. If you want to try out an experimental image, you can use ujust rebase-secureblue on an existing secureblue installation.

COSMIC

Server

CoreOS

IOT