What Security Features Does Bazzite Include?

Bazzite ships with four security layers enabled or available out of the box: SELinux, Secure Boot support, signed container images with SBOMs and attested build provenance, and LUKS full disk encryption with optional automatic TPM unlocking. Application-level security comes from Flathub, which provides attestation, sandboxing, and verified applications. If you want a gaming-focused Linux system where you don't have to assemble these protections yourself, this is the relevant set — and most of it is on by default rather than opt-in.

System-level protections

SELinux

Bazzite enables SELinux out of the box, which the project describes as "enterprise class security." SELinux is a mandatory access control system: instead of trusting that every process only touches what it should, the kernel enforces rules about which processes can access which files, devices, and network resources. A compromised game launcher or browser process is confined to what its policy allows rather than inheriting your full user permissions.

The practical trade-off is that SELinux can block legitimate software that wasn't written with it in mind. On Bazzite this is mitigated by the fact that most desktop applications arrive as Flatpaks (see below), which are sandboxed separately, so you're less likely to hit policy denials during normal gaming and desktop use.

Secure Boot support

Bazzite supports Secure Boot, the UEFI firmware feature that verifies the bootloader and kernel are signed by a trusted key before handing control to the operating system. This closes the gap where malware or an unauthorized OS could be loaded before your disk encryption prompt even appears.

Support here means Bazzite is built to work with Secure Boot rather than requiring you to disable it — a common friction point on Linux distributions, especially for gaming setups that also need out-of-tree drivers.

Signed images, SBOMs, and build provenance

Bazzite is an image-based operating system, and those images are signed and shipped with:

• SBOMs (software bills of materials) — a machine-readable inventory of every component inside the image, so you can check whether a given library or package is present and at what version.
• Attested build provenance — a verifiable record of how and from what source the image was built.

Together these let you confirm that the image you installed is the one the project actually produced, and audit its contents without reverse-engineering it. This matters more on an image-based distro than a traditional one, because you're consuming a whole prebuilt system rather than assembling packages locally.

LUKS full disk encryption with optional TPM unlock

Bazzite supports LUKS full disk encryption, so the contents of your drive are unreadable without your passphrase. Optionally, you can set up automatic unlocking via a TPM (Trusted Platform Module), which releases the decryption key when the boot measurements match an expected state.

The trade-off is worth stating plainly: TPM auto-unlock removes the need to type a passphrase at every boot, but it also means the disk unlocks automatically on that machine. It protects against someone pulling the drive out and reading it elsewhere; it protects less against someone with physical access to the running, booted machine. If that distinction matters to you, keep the passphrase prompt instead of enabling auto-unlock.

Application-level security: Flathub

Bazzite's desktop applications come through Flathub, which the project notes provides "attestation, sandboxing, and the most officially verified applications of any Linux application repository."

• Sandboxing confines each app to the permissions it declares, so a game launcher or utility can't freely read your entire home directory unless you grant it.
• Attestation lets Flathub confirm that a published build came from the claimed source.
• Verified applications are those where the upstream developer has confirmed ownership of the Flathub listing, so you're installing from the actual vendor rather than a repackager.

For a gaming system this is the layer that matters most day to day, since launchers for Epic, GOG, Xbox Game Pass (via Battle.net), EA App, Ubisoft Connect, and similar stores are exactly the kind of third-party software you'd otherwise install with broad system access.

How this compares to a typical desktop Linux setup

The pattern is that Bazzite makes these choices for you and turns them on, at the cost of some flexibility — you're working within an image-based, Flatpak-first model rather than configuring each layer yourself.

What to check before relying on these

• Confirm Secure Boot is actually active in your firmware after install, not just supported by the OS. A supported-but-disabled setup gives you none of the boot-chain protection.
• Decide on TPM auto-unlock deliberately. It's a convenience/security trade, not a strict upgrade.
• Check whether your specific hardware needs Secure Boot disabled. Some configurations, particularly certain GPU or peripheral setups, may push you toward turning it off — in which case budget for that in your threat model.
• Verify a Flatpak's permissions before granting it broad filesystem or device access, since sandboxing only helps if you don't widen it.

If your priority is a gaming system where SELinux, Secure Boot, signed images, and disk encryption are handled for you rather than assembled by hand, Bazzite's defaults cover that. If you need to tune each security layer individually or run unsigned kernel modules freely, the image-based model will feel restrictive.