Zainium OS release tests -- 2026-11-02 18:42:28 +0500 kernel: linux-zainium-7.3 #1 SMP PREEMPT_DYNAMIC Mon Nov 2 06:40:23 UTC 2026 ====================================================================== 1. Kernel, lockdown and LSMs ====================================================================== lsm: lockdown,capability,yama,apparmor,bpf,landlock,ipe,ima,evm [PASS] IPE, IMA, AppArmor, Landlock, Yama, lockdown active -- lockdown,capability,yama,apparmor,bpf,landlock,ipe,ima,evm [PASS] kernel lockdown = integrity -- none [integrity] confidentiality [FAIL] module signatures enforced -- sig_enforce=N [PASS] new kernel modules load -- 134 modules loaded ====================================================================== 2. IMA ====================================================================== dont_measure fsmagic=0x9fa0 dont_measure fsmagic=0x62656572 dont_measure fsmagic=0x64626720 dont_measure fsmagic=0x1021994 dont_measure fsmagic=0x858458f6 dont_measure fsmagic=0x1cd1 dont_measure fsmagic=0x42494e4d dont_measure fsmagic=0x73636673 dont_measure fsmagic=0x6e736673 dont_measure fsmagic=0x27e0eb dont_measure fsmagic=0x63677270 measure func=BPRM_CHECK mask=MAY_EXEC measure func=MODULE_CHECK measure func=FIRMWARE_CHECK measure func=KEXEC_KERNEL_CHECK measure func=KEXEC_INITRAMFS_CHECK measure func=POLICY_CHECK measure func=KEY_CHECK measure func=CRITICAL_DATA [PASS] IMA policy from /overlayer/syshub/etc/ima/ima-policy is loaded measurements: 290 10 5ef395d9debcb36c0eccb1c92160ea83dbfb07d8 ima-ng sha1:1a4d302ce25fcdc8ea6550c25e8b5f0089b8af42 boot_aggregate 10 248bd705704c6e68e9d10701f6b14a8bd5514fc1 ima-buf sha256:ebcb6ca5be0f8812e940b6735ce8c52fc2dba613888ae03fb15b796cf80b962a .builtin_trusted_keys 30820528308203 10 7c57f5862f47899ccf493ca30635a5c4ac1f74cd ima-buf sha256:ebcb6ca5be0f8812e940b6735ce8c52fc2dba613888ae03fb15b796cf80b962a .ima 3082052830820310a00302010202146 10 b90753f020d4c74d89d865eb513e8c96ef4122b3 ima-ng sha256:8a03f9166e781af574d9698f40be3b88005b363df5734d7fb7cc5c65e24430ad /overlayer/syshub/lib/systemd/systemd 10 f68540f4699be7414afff3740e64d188eab1c49a ima-ng sha256:52ff3bebcd6eba6bc465969de0dc27f3d58715cab81f0411bb928f4b32f885cf /overlayer/syshub/drivers/hardware/fi 10 a4372896aa6d7627e93dec8d9535b12ca95e5df4 ima-ng sha256:e4f5d57ed098199e8300e51e8019a82e54d1195f84c257be4ea55467d503b2d6 /overlayer/syshub/lib/security/unix_c [PASS] IMA measures programs and modules (more than boot_aggregate) -- 290 entries [PASS] IMA measured the zex binary journal: [PASS] no 'Failed to load IMA policy' in this boot ====================================================================== 3. IPE ====================================================================== [PASS] IPE built-in policy 'zainium' is active -- active=1 policy_name=zainium policy_version=0.1.0 # Built into the kernel, so it is enforced from the first instruction and moves with the # kernel on an upgrade or a rollback. Anything not named here keeps working. DEFAULT action=ALLOW # No kernel is ever replaced at run time: the next one is booted through Limine op=KEXEC_IMAGE action=DENY op=KEXEC_INITRAMFS action=DENY enforce=1 success_audit=0 [PASS] IPE is enforcing [PASS] IPE refuses a kexec image (EACCES) -- rc=-1 errno=EACCES ====================================================================== 4. Sealed system view (OverlayFS) ====================================================================== /overlayer/syshub ro,relatime overlay overlay ro,lowerdir=/zairoot/overlayer/syshub,upperdir=/zairoot/overlayer/zexlib/union,workdir=/zairoot/overlayer/zexlib/work,sealed /overlayer/syshub/etc rw,relatime overlay overlay rw,lowerdir=/zairoot/overlayer/syshub/etc,upperdir=/zairoot/overlayer/zexlib/union/etc,workdir=/zairoot/overlayer/zexlib/work-etc,inde /overlayer/syshub/var rw,relatime overlay overlay rw,lowerdir=/zairoot/overlayer/syshub/var,upperdir=/zairoot/overlayer/zexlib/union/var,workdir=/zairoot/overlayer/zexlib/work-var,inde /overlayer/zaisys ro,nosuid,nodev,relatime overlay overlay ro,lowerdir=/zairoot/overlayer/zaisys:/.overlay-empty,index=off /overlayer/zexlib rw,relatime ext4 /dev/disk/by-uuid/64363749-9243-4007-acd8-7ca6fc1c8596 rw [PASS] /overlayer/syshub is ro and sealed -- ro,relatime,ro,lowerdir=/zairoot/overlayer/syshub,upperdir=/zairoot/overlayer/zexlib/union,workdir=/zairoot/overlayer/zexlib/work,sealed [PASS] /overlayer/zaisys is ro, separate, no upper layer -- ro,nosuid,nodev,relatime,ro,lowerdir=/zairoot/overlayer/zaisys:/.overlay-empty,index=off [PASS] /overlayer/syshub/etc and /var are rw [PASS] root cannot remount /overlayer/syshub writable -- refused: EROFS [PASS] root cannot remount /overlayer/zaisys writable -- refused: EROFS [PASS] root cannot write /overlayer/syshub/bin -- Read-only file system [PASS] root cannot write /overlayer/zaisys -- Read-only file system [PASS] writes to /overlayer/syshub/etc land in zexlib/union/etc [PASS] writes to /overlayer/syshub/var land in zexlib/union/var [PASS] software installed into the union shows at once (after a cached 'not found') [PASS] /zairoot (the disk) is not reachable ====================================================================== 5. fs-verity ====================================================================== /overlayer/syshub (without etc, var): 36876/36876 sealed (100.00%), 0 unreadable [PASS] every file in /overlayer/syshub is sealed -- 36876/36876 /overlayer/zaisys (without -): 8/8 sealed (100.00%), 0 unreadable [PASS] every file in /overlayer/zaisys is sealed -- 8/8 [PASS] a sealed file cannot be opened for writing, even by root -- /overlayer/zexlib/union/lib/libpanelw.so.6.6: Operation not permitted /overlayer/syshub/bin/elevate /overlayer/syshub/bin/zex /overlayer/syshub/bin/sudo /overlayer/syshub/lib/libsys_resolver.so /overlayer/syshub/lib/systemd/systemd ====================================================================== 6. Services and packages ====================================================================== [PASS] no failed systemd units Static hostname: zainium Icon name: computer-laptop Chassis: laptop 💻 [PASS] hostnamed answers over D-Bus -- needs systemd pkgrel 4 (PR #207) if it fails zex 6.0.2 udisksd: /overlayer/syshub/libexec/udisks2/udisksd gvfsd: /overlayer/syshub/libexec/gvfsd ====================================================================== Summary ====================================================================== 26/27 checks passed FAILED: module signatures enforced