secureblue v4.10 - Fedora 45

Key points

secureblue has published v4.10, which moves its images to a Fedora 45 base. The release was tagged on 8 November as v4.10.0; the project notes that releases are symbolic, since builds are published as soon as new commits are merged.

What users need to do

• Nothing for the Fedora 45 switch: a system on the latest tag that is up to date is already running this release.
• Users of ZFS images should rebase to the equivalent non-ZFS image; the ZFS images are deprecated and will be removed within the coming months.
• Anyone who relied on ujust install-vpn or ujust install-steam has to install those apps like any other software; the FAQ page has notes on Steam.

Bubblewrap and user namespaces

• The shipped /usr/bin/bwrap is now a patched build that stops non-root users from adding privileged capabilities to user namespaces.
• bubblewrap is now SELinux-confined and works without enabling unconfined user namespaces; the same applies to bubblejail.
• Domains that are not userns-privileged can no longer join a user namespace with setns, and creating executable userns-privileged files is blocked.
• User namespace access was dropped from flatpakfull, and the Nautilus bwrap workaround and the KDE systemsettings userns and malloc workarounds for qtwebengine were removed.
• thumb_t is allowed to create user namespaces.

File locations changed

• RPM repository files shipped with the OS now live in /usr/share/dnf5/repos.d instead of /etc/yum.repos.d, following Fedora 45.
• The default container policy is now /usr/share/containers/policy.json instead of /etc/containers/policy.json.

Removed

• The scripts ujust install-vpn and ujust install-steam.
• PDF thumbnailing support, intel-mediasdk, uncommon or obsolete NetworkManager plugins, and udev rules judged too broad.
• Curated apps that need a suid-root umount.
• tpm2-pkcs11 on IoT images, and the fedora-flatpak-remote script.
• flatpak repair no longer runs as part of the update process.

Other hardening

• The NFC stack is disabled at runtime and MPTCP is disabled.
• Kernel arguments now disable nested virtualization and the amdgpu IOMMU bypass.
• SELinux blocks the phonet, qipcrtr and xdp socket classes, constrains role changes to isolate unconfined_r and container domains, and denies unconfined container file entrypoints allowed by container-selinux.
• Trivalent can only be started from its own script's domain.
• Python code runs with the -Es options, and the bash environment lockdown was simplified.
• pwquality is enforced at the default length, and cracklib-dicts is present on all images.
• Rootless repo-refresh is no longer allowed, and countme is masked as well as preset-disabled.
• The webcam toggle covers additional webcam modules, and the modprobe list was made more thorough.
• The audit now flags --socket=gpg-agent as a sandbox escape.

Features and fixes

• Quad9 was added to dns-selector, but it cannot be chosen for DoH.
• The brew-proxy service is enabled to fix file ownership.
• xdg-desktop-portal-wlr is enabled for Sway.
• Server images gain QEMU USB drivers.
• NetworkManager sandboxing was loosened so imported OpenVPN configs work again, and CAP_KILL was restored to NetworkManager.
• secure_boot supports quirky systems and has read-write access to /boot; systemd-boot is only updated if it exists.
• UKI images: the 90-second timeout for the LUKS password is disabled, tuned is no longer uninstalled alongside rpm-ostree, a PCR key was generated and other UKI keys were rotated.
• Upgrade-on-boot goes straight to the spinner when a deployment is already staged.
• The MOTD runs only in interactive shells, and the bash prompt no longer produces unwanted xtrace output.
• The audit passes the CUPS check when the CUPS service is not installed, and received further bug fixes; unnecessary CUPS ports were removed.
• ibus-gtk uses the standard malloc, and with-standard-malloc was reworked.
• nvidia-driver-libs is ensured on Nvidia images; amd-gpu-firmware was temporarily pinned and then unpinned.
• A missing secureblue ghcr container registry override was added, and Copr endpoints were updated.

Images, ISO and builds

• CoreOS-based images now use the "testing" base tag instead of "next".
• The ISO builder was updated for Fedora 45, with several fixes; the live environment uses Fedora's kernel.
• ARM CI builds run on ARM runners, and sealed image builds were hardened.
• BlueBuild CLI was bumped to v0.9.41, and a developer setup script was added.

Summary by DistroNews, based on the original post.