Defence in depth
Six layers, starting close to the hardware. You will never notice most of them, which is rather the idea. What follows is what each one actually does, and what it does not.
The system disk is read-only and checked cryptographically every time you boot. Change one byte of it and the machine refuses to start. If it booted, you know it is the OS we shipped.
Mainline Linux LTS, the hardened patch set, and our own configuration, compiled from source rather than taken from a distribution. The source is available, so the parts doing the protecting can be read rather than trusted.
Antivirus watches files. A network firewall watches packets. This one watches program execution inside the kernel itself, and can refuse programs launching from the temporary folders where malware usually lands.
SELinux in enforcing mode, kernel lockdown, sandboxing and capability limits. A compromised process stays one compromised process instead of becoming the whole machine.
Orynr works out what a file is from its bytes, not its name. A program wearing a document's name is flagged and refused. The attack is decades old and most desktops still fall for it.
Attackers already collect encrypted traffic today to break once quantum computers arrive. Update signing uses ML-DSA, the post-quantum signature standard, so an update cannot be forged later. Post-quantum key exchange is still ahead of us.
Secure Boot
Orynr's boot image is signed. There are two ways to make a stock PC accept a signed operating system, and the choice says a lot about who the machine really answers to.
Pay Microsoft to sign a small loader. Their certificate is already in every PC, so it boots with no effort from you. It also means Microsoft decides whether your operating system is allowed to start, and you stay downstream of that decision permanently.
We sign with our own key and you enrol it once, in firmware. Nobody else holds the authority, and you can just as easily enrol your own key and run your own build. The cost is one trip into firmware setup.
Secure Boot only accepts new keys in Setup Mode, which is the deliberate "I am changing who I trust" state.
orynr-secureboot.cer onto a FAT32 USB stick, or onto the Orynr stick.
Firmware can only read a certificate off a filesystem it understands.Don't take our word for it
A security claim you cannot check is just advertising. These run on a machine that is already booted.
| Is Secure Boot on, with our key? | bootctl status — look for Secure Boot: enabled (user). The (user) part means user-enrolled keys rather than the factory set. |
|---|---|
| Is SELinux enforcing? | getenforce should say Enforcing. |
| Is the root filesystem really read-only and verified? | findmnt / shows it mounted read-only; the device beneath it is a dm-verity target. |
| Is the kernel firewall running? | systemctl status orynr-kernfw. It reports observe mode by default, and logs every program that starts. |
| What is actually installed? | Every release ships orynr.manifest, a list of every package with its version and licence. |
Limits
Security marketing tends toward absolutes. Here is where the edges of this actually are, because you deserve to know before you rely on it.
No operating system is. Layers raise the cost of an attack and limit what a successful one reaches. Anyone promising more than that is selling something.
No independent security review has been done. When one has, we will publish it, including whatever it finds. Until then everything here is our own assessment of our own work.
Update signing is post-quantum today. Key exchange and data at rest are not yet, and we would rather say so than let "post-quantum" imply the lot.
Orynr is in active development. Features carry a status label throughout this site, and anything marked Architected is designed but not yet built.