divested/brace
Watch
3
9
Fork
You've already forked brace
 2
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity
Offers a wide range of opinionated settings that prioritize privacy, security, and usability for a curated set of Linux programs.
626 commits 1 branch 0 tags 1.3 MiB
  • Shell 52.9%
  • JavaScript 47.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Tavi e5deea2667
 Refresh 
- chromium: update to 159.0.8130.0-dev, 1 addition
- mr: update to 7.2.15, no change
- bi: unwanted: 1 removal (floppy disk management tools)
- sysctl: disable mptcp for asr

Signed-off-by: Tavi <tavi@divested.dev>
2026-11-03 13:08:10 -05:00
brace Refresh 2026-11-03 13:08:10 -05:00
module_restricter Updates 2026-09-28 04:56:25 -04:00
unused firefox: policy updates 2026-09-30 05:08:56 -04:00
.gitignore Update .gitignore 2021-07-05 16:22:31 -04:00
.gitlab-ci.yml Fixup CI 2026-09-30 05:15:40 -04:00
brace.install postinst: recommend flagging /home as noexec 2026-09-13 13:20:11 -04:00
brace.spec Refresh 2026-11-03 13:08:10 -05:00
LICENSE Going the distance... [pt3] 2024-07-27 17:45:40 -04:00
permissions.facl fixup 2026-09-26 02:54:14 -04:00
PKGBUILD Refresh 2026-11-03 13:08:10 -05:00
README.md bi: handle more packages 2026-09-22 21:40:37 -04:00
TODO Fix issues from a clanker review 2026-09-15 14:32:11 -04:00

README.md

brace

Overview

Brace offers a wide range of opinionated settings that prioritize privacy, security, and usability for a curated set of Linux programs. It notably achieves this without any binaries or recompilation.

Compatibility (ranked)

  • Fedora
    • Server & Cloud
    • Workstation (recommended DE)
      • tested: 44 on 2026-09-19
      • tested: 45 on 2026-09-10
    • MATE spin
      • tested: 44 on 2026-09-19
    • Cinnamon spin
      • tested: 44 on 2026-09-19
    • Qubes TemplateVM
      • optionally layer Flatpaks into a dependent app qube using brace-installer usermode
      • limitation: no kernel command line change support possible
        • you can manually set them via the Qube Manager in dom0
    • Silverblue
      • not recommended
      • install via rpm-ostree
      • limitation: no support for removing anything bundled
      • limitation: only Flatpaks for additional software
      • limitation: no kernel command line change support yet
      • tested: 44.20260920.0

Fallback Compatibility

  • Below distros are untested and maintained only as a fallback if Fedora goes away
  • Arch Linux
  • openSUSE
  • RHEL-like (CentOS, Rocky, Alma)
    • tested: Rocky 10.2 Workstation on 2026-09-19
      • first: dnf install epel-release rpmfusion-free-release && crb enable
  • Debian

License

AGPL-3.0-or-later where applicable

Prebuilts

Building

  • git clone [THIS REPO]
  • RPM: rpmbuild -ba brace.spec
  • Arch Linux: makepkg
  • Debian: dpkg-deb --root-owner-group --build brace

Supported Configuration Targets

  • Chromium, Chrome, Brave
  • chrony
  • Firefox, Firefox ESR, Thunderbird
  • GNOME, MATE, Cinnamon
  • GRUB
  • Kernel
  • NetworkManager
  • polkit
  • systemd
  • udev

Additional Inclusions

  • brace-audit helper to verify settings are applied
  • brace-enable-auto-updates helper to enable dnf automatic updates
  • brace-enable-rpmfusion helper to enable rpmfusion-free repo for eg. codecs
  • brace-installer helper install & remove packages based on config file
  • brace-mr-update helper to exclude all current kernel modules
  • brace-supplemental-changes helper to change additional global and per-user settings
  • brace-update-system helper to update to next major version
  • restic-backup@.* systemd units for daily backups

Known Issues

  • A reboot is required on openSUSE after install for dconf changes to take effect.
  • Compatibility is best with Fedora, and that is the primary test-bed.
  • Restrictions on /sys/bus/scsi in 99-brace-sys.conf can break disc drive access by some programs.

Credits

Donate