secureblue

secureblue pulls the best ideas from GrapheneOS’s hardening work and transplants them to the desktop Linux context: hardened_malloc, proactive kernel parameter lockdown, and an immutable base that cannot be silently modified. It sits on Fedora Atomic, so SELinux and atomic updates come for free. The project is candid that desktop Linux’s security architecture has real structural limits it cannot fully overcome - this is as close as you get on Linux without those caveats. Aimed squarely at users who already want Linux and want the most secure variant of it; not a beginner distro, and some applications work less smoothly under the tighter restrictions.