Conversation
Up to standards ✅🟢 Issues
|
| {: #exploit-mitigation} | ||
|
|
||
| - Install and enable [hardened_malloc](https://github.com/GrapheneOS/hardened_malloc) globally, including for Flatpaks. | ||
| - Install [Trivalent](https://github.com/secureblue/Trivalent), our security-focused, Chromium-based browser inspired by [Vanadium](https://github.com/GrapheneOS/Vanadium). <sup>[Why Chromium-based?](https://grapheneos.org/usage#web-browsing)</sup> <sup>[Why not a Flatpak?](https://forum.vivaldi.net/post/669805)</sup> |
There was a problem hiding this comment.
Trivalent is already included here, as well as selinux confinement. I'm not sure why a separate section is needed?
There was a problem hiding this comment.
#95 (comment) It’s like GrapheneOS’s Vanadium section, and you said
yeah we should probably have that somewhere
There was a problem hiding this comment.
yeah we need it somewhere and I did say maybe a subsection of features, that page is rather concise though and it'd be nice to keep it that way and instead put together a comprehensive article about Trivalent and link to it
| - Install and enable [hardened_malloc](https://github.com/GrapheneOS/hardened_malloc) globally, including for Flatpaks. | ||
| - Install [Trivalent](https://github.com/secureblue/Trivalent), our security-focused, Chromium-based browser inspired by [Vanadium](https://github.com/GrapheneOS/Vanadium). <sup>[Why Chromium-based?](https://grapheneos.org/usage#web-browsing)</sup> <sup>[Why not a Flatpak?](https://forum.vivaldi.net/post/669805)</sup> | ||
| - SELinux [confinement](https://github.com/secureblue/Trivalent/blob/live/selinux/trivalent.te) for Trivalent. | ||
| - Kernel hardening via sysctl. <sup>[details](https://github.com/secureblue/secureblue/blob/live/files/system/usr/lib/sysctl.d/55-hardening.conf)</sup> |
There was a problem hiding this comment.
If anything, this section needs to be updated, since we build our own kernels now
There was a problem hiding this comment.
I think a separate PR would be more appropriate for that, but I’ll see if I can work on it
…ore technical features, Google Chrome as standard Chromium
Closes #95
I just took most of the information from GrapheneOS’s Vanadium section and @RKNF404 ’s Trivalent section
I definitely got some info wrong, but I just took the features from GrapheneOS’s section and took away
Details
- Hardware memory tagging (MTE) enabled for the main allocator