X221e distro
x221e distro
This linux distribution is designed to be security-first while keeping in mind the needs -- my needs specifically -- of a daily operating system.
This distribution uses a void linux-style package building system, automating the entire process from configuration to packaging of the application.
Bootstrap Build system: https://universe.0xinfinity.dev/distro/bootstrap
Build system: https://universe.0xinfinity.dev/distro/ibps-src
Kernel: https://universe.0xinfinity.dev/distro/kernel
Security Features
Kernel Confidentiality Lockdown
This distribution uses the highest possible linux security lockdown to prevent and heavily restrict access to the kernel once they have root privileges. This prevents undue kernel module loading (reducing the chances of a kernel module and kernel security module rootkits). A supermajority of the features that are going to be used in my operating system will be baked into the kernel instead of using modules to load them. This has disadvantages like increased kernel size and increased attack surface by default (to be elaborated).
Root Account Unavailable
While a PID1 has to exist on a linux system, the ability to access such privileges can still be heavily restricted on userspace after the init system launches.
Amnesiac System
This operating system does not allow you to arbitrarily install persistent packages, or for persistent configuration. The system image is amnesiac, meaning you cannot persistently write to any of the following directories: /etc /var /root /usr. If you do write to such directories, the information will exist for the duration of the current PID1 session, and then the changes will disappear. To have persistent files on this operating system, you have to choose to mount the /home partition at boot. Otherwise, a temporary home directory with a default user will be created.
The persistent system image is a squashfs.
Whole-System Integrity
The initramfs and squashfs images are tightly knit. If the signature of one changes, the signature of all of them needs to change. Initramfs verifies the squashfs and kernel, and both the initramfs and squashfs verifies the kernel.
Other Features
1. Uses glibc
I might switch to muslc depending on support-level of applications I use, or, in the future, dom0 might use muslc while domU's use glibc.
2. Uses runit
Runit is a very lightweight init system for linux systems. I chose not to use systemd due to the amount of dependencies that it pulls, and the amount of PID1-privileged operations that it conducts before privileges are reduced. Systemd appears to have an incredibly large attack-surface.
//TBC
TODO
1. When my wlproxy project is completed, and forwarding of xen domU windows to xen dom0 wayland compositor is possible, the operating system will use xen by default, and compartmentalize each application while maintaining the amnesiac system of each compartment.
