Hardened_malloc - Atomic Fedora Silverblue Template

General Discussion
21

Yes.

It’s not an issue.
The WiFi mac randomization is enabled by default in debian template and it’s enabled in kicksecure template as well.
The Ethernet mac randomization is disabled by default in debian template and it’s disabled in kicksecure template as well.
The user wanted to enable the Ethernet mac randomization, but modified wrong configuration file in kicksecure template. In the end the user found the correct place where user should place the configuration file to enable the Ethernet mac randomization in kicksecure template.
For debian template user would need to do the same to enable the Ethernet mac randomization.
So it’s not an issue with kicksecure template.

22

It would be great if there were premade templates for Fedora and Debian which

both use hardened malloc. This would be Fedora secureblue (hardened Silverblue)

and Kicksecure, for Fedora and Debian, respectively.

Debian → Kicksecure

Fedora → BlueBuild / Universal Blue

Fedora images can be ‘rebased’ to the silverblue repo:

23

It would make sense to include Fedora Atomic distros into the FTP Server repo. That

way, you can rebase to secureblue. It would make sense to make a Qubes template

based on Atomic Fedora version like silverblue.

24

hardened malloc is deprecated in kicksecure - it is unstable and the
benefits are unclear.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

25

Kicksecure determined that it’s unstable? Is there some alternative?

If you don’t use an OS with musl C and hardened malloc, what do you recommend?

26

It’s better to ask this in the relevant Whonix forum topic: