Defence in depth
Six layers, starting close to the hardware. You will never notice most of them, which is rather the idea. What follows is what each one actually does, and what it does not.
The system disk is read-only and checked cryptographically every time you boot. Change one byte of it and the machine refuses to start. If it booted, you know it is the OS we shipped.
Mainline Linux LTS, the hardened patch set, and our own configuration, compiled from source rather than taken from a distribution. The source is available, so the parts doing the protecting can be read rather than trusted.
Antivirus watches files. A network firewall watches packets. This one watches program execution inside the kernel itself, and can refuse programs launching from the temporary folders where malware usually lands.
SELinux in enforcing mode, kernel lockdown, sandboxing and capability limits. A compromised process stays one compromised process instead of becoming the whole machine.
Orynr works out what a file is from its bytes, not its name. A program wearing a document's name is flagged and refused. The attack is decades old and most desktops still fall for it.
Attackers already collect encrypted traffic today to break once quantum computers arrive. Update signing uses ML-DSA, the post-quantum signature standard, so an update cannot be forged later. Post-quantum key exchange is still ahead of us.
Secure Boot
Orynr's boot image is signed. There are two ways to make a stock PC accept a signed operating system, and the choice says a lot about who the machine really answers to.
Pay Microsoft to sign a small loader. Their certificate is already in every PC, so it boots with no effort from you. It also means Microsoft decides whether your operating system is allowed to start, and you stay downstream of that decision permanently.
We sign with our own key and you enrol it once, in firmware. Nobody else holds the authority, and you can just as easily enrol your own key and run your own build. The cost is one trip into firmware setup.
Secure Boot only accepts new keys in Setup Mode, which is the deliberate "I am changing who I trust" state.
orynr-secureboot.cer onto a FAT32 USB stick, or onto the Orynr stick.
Firmware can only read a certificate off a filesystem it understands.Don't take our word for it
A security claim you cannot check is just advertising. These run on a machine that is already booted.
| Is Secure Boot on, with our key? | bootctl status, then look for Secure Boot: enabled (user). The (user) part means user-enrolled keys rather than the factory set. |
|---|---|
| Is SELinux enforcing? | getenforce should say Enforcing. |
| Is the root filesystem really read-only and verified? | findmnt / shows it mounted read-only; the device beneath it is a dm-verity target. |
| Is the kernel firewall running? | systemctl status orynr-kernfw. It reports observe mode by default, and logs every program that starts. |
| What is actually installed? | Every release ships orynr.manifest, a list of every package with its version and licence. |
Found something?
If you have found a vulnerability in Orynr, we want the report. A good-faith report is not an attack and we will not treat it as one.
security@orynr.com. Machine-readable details are at /.well-known/security.txt.
Tell us what you found, how to reproduce it, and what you think it lets someone do. A rough report now beats a polished one next month.
We acknowledge within 3 working days and tell you what we think within 10, including if we think it is not a problem and why.
We aim to fix and ship within 90 days. If something needs longer we will say so rather than go quiet.
Give us a reasonable chance to fix it before publishing. Do not access anyone else's data or degrade anyone's service while testing. Test against your own installation.
That is the whole of it. No paperwork, no non-disclosure agreement.
We will name you in the advisory unless you would rather we did not. There is no bounty programme yet, and we would rather say that plainly than imply one.
Limits
Security marketing tends toward absolutes. Here is where the edges of this actually are, because you deserve to know before you rely on it.
No operating system is. Layers raise the cost of an attack and limit what a successful one reaches. Anyone promising more than that is selling something.
No independent security review has been done. When one has, we will publish it, including whatever it finds. Until then everything here is our own assessment of our own work.
Update signing is post-quantum today. Key exchange and data at rest are not yet, and we would rather say so than let "post-quantum" imply the lot.
Orynr is in active development. Features carry a status label throughout this site, and anything marked Architected is designed but not yet built.