======================================================================== ZAINIUM OS - SECURITY AUDIT ======================================================================== Organization : Zainium Dynamics System : Zainium OS (rolling) Audit date : 2026-11-02 21:57:15 +0500 Hostname : zainium Kernel : linux-zainium-7.3 #1 SMP PREEMPT_DYNAMIC Mon Nov 2 06:40:23 UTC 2026 Architecture : x86_64 ======================================================================== 1. Boot chain: Secure Boot, TPM2, lockdown ======================================================================== [WARN] UEFI Secure Boot is on -- SecureBoot=0 [WARN] TPM2 device present -- /dev/tpmrm0 [PASS] kernel lockdown is integrity or stricter -- none [integrity] confidentiality LSMs: lockdown,capability,yama,apparmor,bpf,landlock,ipe,ima,evm [PASS] LSM lockdown is active [PASS] LSM yama is active [PASS] LSM apparmor is active [PASS] LSM landlock is active [PASS] LSM ipe is active [PASS] LSM ima is active [PASS] LSM evm is active ======================================================================== 2. Kernel module signatures ======================================================================== [PASS] shipped modules carry a signature [PASS] an unsigned module is refused -- EPERM [PASS] a module changed after signing is refused -- EKEYREJECTED [PASS] a correctly signed module loads -- loaded ======================================================================== 3. Integrity: IMA and IPE ======================================================================== [PASS] IMA policy is loaded [PASS] IMA measures executed programs -- 273 measurements [PASS] IPE policy 'zainium' is active [PASS] IPE is enforcing [PASS] IPE refuses loading a new kernel at run time (kexec) -- EACCES ======================================================================== 4. Read-only system (sealed OverlayFS) ======================================================================== /overlayer/syshub ro,relatime ro,lowerdir=/zairoot/overlayer/syshub,upperdir=/zairoot/overlayer/zexlib/union,workdir=/zairoot/overlayer/zexl /overlayer/syshub/etc rw,relatime rw,lowerdir=/zairoot/overlayer/syshub/etc,upperdir=/zairoot/overlayer/zexlib/union/etc,workdir=/zairoot/overla /overlayer/syshub/var rw,relatime rw,lowerdir=/zairoot/overlayer/syshub/var,upperdir=/zairoot/overlayer/zexlib/union/var,workdir=/zairoot/overla /overlayer/zaisys ro,nosuid,nodev,relatime ro,lowerdir=/zairoot/overlayer/zaisys:/.overlay-empty,index=off /overlayer/zexlib rw,relatime rw [PASS] /overlayer/syshub is read-only and sealed [PASS] /overlayer/zaisys is read-only and separate [PASS] root cannot remount /overlayer/syshub writable -- EROFS [PASS] root cannot remount /overlayer/zaisys writable -- EROFS [PASS] root cannot write in /overlayer/syshub/bin -- Read-only file system [PASS] root cannot write in /overlayer/zaisys -- Read-only file system [PASS] changes to /overlayer/syshub/etc go to the user layer [PASS] changes to /overlayer/syshub/var go to the user layer [PASS] installed software is visible at once, without a reboot [PASS] the raw system disk is not reachable (/zairoot) ======================================================================== 5. fs-verity on every system file ======================================================================== [PASS] all files in /overlayer/syshub are sealed (except etc, var) -- 36899/36899 (100.00%) [PASS] all files in /overlayer/zaisys are sealed -- 8/8 (100.00%) [PASS] a sealed file cannot be changed, even by root -- Operation not permitted sha256:ab2d8d5f01b12c131f38b9cb7f893f42303c7eb8bb4de091cc7f0c45dfc52225 /overlayer/syshub/bin/elevate sha256:c90e5dc7a391bb006c42bb440c571efa7b3ca46714cfc7b61c474d01288c0d85 /overlayer/syshub/bin/zex sha256:0980a1f3dff64a9c878ad3d07f29ff71416dbe9b60259eede6fc9fbe6a09d871 /overlayer/syshub/bin/sudo sha256:6aa813125a43200f3555450523e6254dfa33d9f6dfcaad9b1ea0979a1eaa2a78 /overlayer/syshub/lib/systemd/systemd ======================================================================== 6. AppArmor ======================================================================== 176 profiles: 2 complain, 98 enforce, 76 unconfined [PASS] AppArmor profiles are loaded and enforced -- 98 enforce ======================================================================== 7. Kernel hardening (sysctl) ======================================================================== [PASS] kernel.kptr_restrict -- = 1 [PASS] kernel.dmesg_restrict -- = 1 [PASS] kernel.yama.ptrace_scope -- = 1 [PASS] kernel.unprivileged_bpf_disabled -- = 2 [PASS] kernel.randomize_va_space -- = 2 [PASS] kernel.perf_event_paranoid -- = 2 [PASS] fs.protected_symlinks -- = 1 [PASS] fs.protected_hardlinks -- = 1 [PASS] fs.protected_fifos -- = 1 [PASS] fs.protected_regular -- = 1 [PASS] fs.suid_dumpable -- = 0 ======================================================================== 8. Network ======================================================================== [PASS] net.ipv4.tcp_syncookies -- = 1 [PASS] net.ipv4.conf.all.accept_redirects -- = 0 [PASS] net.ipv4.conf.all.send_redirects -- = 0 [PASS] net.ipv4.conf.all.accept_source_route -- = 0 [PASS] net.ipv6.conf.all.accept_redirects -- = 0 [PASS] net.ipv4.conf.default.rp_filter (reverse path filter) -- = 2 [PASS] no TCP port open to the network [PASS] a firewall ruleset is loaded (nftables) -- 20 lines ======================================================================== 9. Privileged programs ======================================================================== setuid/setgid: /overlayer/syshub/bin/elev setuid/setgid: /overlayer/syshub/bin/elevate setuid/setgid: /overlayer/syshub/bin/fusermount3 setuid/setgid: /overlayer/syshub/bin/pkexec setuid/setgid: /overlayer/syshub/lib/polkit-1/polkit-agent-helper-1 setuid/setgid: /overlayer/syshub/lib/qemu-bridge-helper setuid/setgid: /overlayer/syshub/lib/security/unix_chkpwd [FAIL] only the known setuid programs exist -- /overlayer/syshub/lib/qemu-bridge-helper ======================================================================== 10. Services ======================================================================== no failed units [PASS] no failed services ======================================================================== SUMMARY ======================================================================== PASS 51 FAIL 1 WARN 2 Score: 51/52 = 98.1% of scored checks FAILED: only the known setuid programs exist Audit took 20 s. Report: /home/alizain/zainium-audit-20261102-215714.txt