Zainium OS: a sealed system you can still install software on

This update changes how the running system is built. The short version: the system cannot be changed while it runs, not even by root — and you can still install software at any time.

A sealed system view

/overlayer/syshub — the system as you see it — is now mounted read-only with sealed, a new OverlayFS option we wrote for the Zainium kernel. Root cannot write to it and cannot remount it writable. zex installs software into the user layer underneath, and the new files appear in the system view immediately, without a reboot.

The boot files in /overlayer/zaisys have their own read-only mount that root cannot remount writable either. Configuration in /overlayer/syshub/etc and service state in /overlayer/syshub/var stay writable, and your changes are kept in the user layer.

Every system file sealed

quantra-ramfs seals every file of the base and the boot files with fs-verity, so the kernel refuses any change to their content. Installed software can be sealed too, when you want it: elevate zex verity --union on. After the first boot it only re-checks when files were added, removed or renamed, so a normal boot does not wait for it.

Safer updates

Base upgrades are applied by quantra-ramfs at boot with a journal: a failed or interrupted upgrade is undone, or the boot stops — it never continues half applied. elevate zex syshub --u now also offers a newer kernel, and the kernel and its modules are only ever upgraded together.

Also in this update

• IMA measures programs at boot; IPE runs a built-in kernel policy.
• Kernel hardening settings and an nftables firewall in the base.
• USB drives and hard disks mount under /run/media/<user>, as on other desktops.
• No more /var link at the root.
• COSMIC applets in the Store (the COSMIC Flatpak repository is set up next to Flathub).

Everything above was tested on an installed system on real hardware; see the security report for the exact results, including what is still open.

Update with:

elevate zex syshub --u