No threat model given.
> Adds per-network MAC randomization
Where the heck is this thing being used?
> Setting more restrictive file permissions (Based on recommendations from lynis)
Often results in more code being run privileged...
> Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions
Introduces a serious DoS vulnerability.
> Disabling unprivileged user namespaces
> Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces
Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation.
> Installing Chromium into the base image (Why chromium?) (Why not flatpak chromium?)
Just more attack surface if you didn't remove Firefox.
> Including a hardened chromium config (disabling JIT javascript)
... and pushing everybody into a less tested code path.
Again, what is this trying to solve?
> Adds per-network MAC randomization
Where the heck is this thing being used?
> Setting more restrictive file permissions (Based on recommendations from lynis)
Often results in more code being run privileged...
> Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions
Introduces a serious DoS vulnerability.
> Disabling unprivileged user namespaces
> Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces
Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation.
> Installing Chromium into the base image (Why chromium?) (Why not flatpak chromium?)
Just more attack surface if you didn't remove Firefox.
> Including a hardened chromium config (disabling JIT javascript)
... and pushing everybody into a less tested code path.
Again, what is this trying to solve?