The kernel
Which kernel Zainium OS runs, what Zainium changes in it, and why OverlayFS is patched.
Zainium OS runs Linux 7.3.1, built by Zainium as linux-zainium from the unchanged kernel.org source plus three small patches. It is a rolling kernel: elevate zex kernel --u brings the newest one. The recipe is public: kernel-recipes.
The three patches
| Patch | What it changes | Why |
|---|---|---|
0001-zainium-system-paths | Paths compiled into the kernel, such as the firmware directories | There is no /lib at the root: firmware lives in /overlayer/syshub/drivers/hardware/firmwares |
0002-zainium-module-dir | Where modules are installed | Modules live in /overlayer/syshub/drivers/modules |
0003-ovl-sealed-mount | Adds the sealed mount option to OverlayFS | See below |
Why OverlayFS is patched
The system view at /overlayer/syshub joins two layers: the base below, and your installed software in /overlayer/zexlib/union above. Stock OverlayFS cannot give this design what it needs, in two ways:
- A read-only overlay is not really read-only. Root can remount it writable at any moment, so a read-only mount protects the base from mistakes but not from a compromised root.
- The upper layer must not change while the overlay is mounted. The kernel documents this as undefined behaviour: it caches what it has looked up, so a newly installed program can stay invisible, and a directory in use can fail with
Stale file handle. A system that installs software while it runs needs exactly this to work.
The usual answers are a reboot after every install or a separate writable mount. sealed removes the need for either. A sealed overlay:
- is mounted read-only and can never be remounted writable, for root too;
- never writes to its own layers:
zexinstalls straight into the upper layer; - shows every change in the upper layer at once: a new file appears, and a replaced or removed one disappears, without a reboot and without disturbing running programs, which keep the file they already have open;
- never lets the upper layer hide the base where programs live: in
bin,sbin,libexec,lib,driversand the musl directory, a file, a whiteout or an opaque directory in the upper layer can not replace or hide what the base has. New files can still be added there, andshareis left alone, becausezexkeeps generated caches in it.
Together with fs-verity on the base files this means that root can neither write to the system view nor change a base file behind it, while installing software stays as simple as elevate zex install.
Hardening that is on from the first boot
| Feature | Setting |
|---|---|
| Kernel lockdown | integrity: no /dev/mem, no unsigned modules |
| Modules | Signed at build time, so a kernel and its modules are always upgraded together |
| Security modules | Yama, AppArmor, BPF LSM, Landlock, IPE, IMA and EVM |
| fs-verity | Base and boot files sealed at every boot |
See how the system protects itself and the base for what this protects against, and what it does not.