scottk/secureblue
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/secureblue.git synced 2025-11-02 19:38:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: fix dead links, add missing items (#544)

Browse Source 
* docs: fix dead links, update descriptions

* docs: more emphasis on "unstable", less on "additional"

* docs: return an original word

* docs: grammar and brevity

* docs: verbosity
This commit is contained in:
Bruno
2024-11-10 19:23:45 -03:00
committed by GitHub
parent c8eff2ca0b
commit 29927c2db0
3 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/CONTRIBUTING.md
View File

@@ -2,7 +2,7 @@
Thanks for taking the time to look into helping out!
All contributions are appreciated!
Please refer to our [Code of Conduct](/CODE_OF_CONDUCT.md) while you're at it!
Please refer to our [Code of Conduct](CODE_OF_CONDUCT.md) while you're at it!
Feel free to report issues as you find them!
@@ -32,7 +32,7 @@ All types of contributions are encouraged and valued. See the [Table of Contents
## Code of Conduct
This project and everyone participating in it is governed by the
[CONTRIBUTING.md Code of Conduct](/CODE_OF_CONDUCT.md).
[CONTRIBUTING.md Code of Conduct](CODE_OF_CONDUCT.md).
By participating, you are expected to uphold this code. Please report unacceptable behavior
to secureblueadmin@proton.me

10
docs/POSTINSTALL-README.md
View File

@@ -39,19 +39,23 @@ ujust enroll-secure-boot-key
## Set hardened kargs
> [!NOTE]
> Learn about the hardening applied by the kargs set by the command below [here](files/system/usr/share/ublue-os/just/70-secureblue.just.readme.md).
> Learn about the hardening applied by the kargs set by the command below [here](/files/system/usr/share/ublue-os/just/70-secureblue.just.readme.md).
```
ujust set-kargs-hardening
```
When you run the command, it will ask a couple questions for if you want to apply additional boot parameters, after that a set of hardened boot parameters will be applied, as well as the ones applied by your choices. (These kargs are *also* documented in the [link above](files/system/usr/share/ublue-os/just/70-secureblue.just.readme.md#additional-unstable-kargs))
This command applies a fixed set of hardened boot parameters, and asks you whether or not the following kargs should *also* be set along with those (all of which are documented in the link above):
### 32-bit support
If you answer `N`, or press enter without any input, support for 32-bit programs will be disabled on the next boot. If you run exclusively modern software, chances are likely you don't need this, so it's safe to disable for additional attack surface reduction.
However, there are certain exceptions. A couple common usecases are if you need Steam, or run an ocassional application in Wine you'll likely want to keep support for 32-bit programs. If this is the case, answer `Y`.
### Force disable simultaneous multithreading
If you answer `Y` when prompted, simultaneous multithreading (SMT, often called Hyperthreading) will be disabled on all hardware, regardless of known vulnerabilities. This can cause a reduction in the performance of certain tasks in favor of security.
### Unstable hardening kargs
If you answer `Y` when prompted, additional (unstable) hardening kargs will be applied, which can cause issues on some hardware, but stable on other hardware.
If you answer `Y` when prompted, unstable hardening kargs will be additionally applied, which can cause issues on some hardware, but are stable on other hardware.
## Setup USBGuard

6
files/system/usr/share/ublue-os/just/70-secureblue.just.readme.md
View File

@@ -78,6 +78,12 @@
`gather_data_sampling=force`
### Force disable simultaneous multithreading
**Disables this hardware feature on user request, regardless of whether it is affected by known vulnerabilities**
`nosmt=force`
### Additional (unstable) kargs
**Fill IOMMU protection gap by setting the busmaster bit during early boot**