Under the hood
Orynr is Linux underneath, and that is deliberate: it is the only way to get real hardware and software compatibility. What sits on top, and how the kernel is configured, is ours.
The kernel
| Base | Mainline Linux long-term-support, taken from the stable tree rather than a distribution's build. LTS because it receives security fixes for years, and because a security product should never track a branch that changes daily. |
|---|---|
| Hardening | The linux-hardened patch set, plus roughly 180 configuration options of our own covering memory protection, attack-surface reduction and mandatory access control. |
| Compiler | Clang with whole-kernel link-time optimisation. A faster kernel from how it is compiled rather than from cutting anything out. |
| Our changes | Kept as a small patch queue rather than a fork, so upstream security fixes keep applying cleanly. Published under the GPL. |
| Not Android | A common assumption, and wrong. Android's kernel is a mobile fork whose good parts are upstreamed anyway; for a security-focused desktop and server OS, mainline LTS plus hardening is the stronger base. |
The system
The system lives on a compressed read-only filesystem with a cryptographic hash tree over it. Every block is checked as it is read, so tampering is caught at the moment of use rather than during a scan that runs later.
A writable area holds your documents, settings and application state. The system cannot be modified by anything running on it, and your data is never mixed into the part that gets replaced on update.
An update replaces the verified system image as a unit. There is no partially-patched state to end up stuck in, which is where a surprising share of real-world breakage lives.
The build is deterministic, so the same inputs produce the same image. That is what makes it possible to check that a released image matches the source it claims to come from.
The boot chain
| 1. Firmware | Checks the boot image's signature against a key you enrolled. Refuses anything else. See Secure Boot. |
|---|---|
| 2. One signed image | Kernel, startup environment and boot options are fused into a single signed file, so none of them can be swapped independently. |
| 3. Verified root | That signed file carries the hash of the system filesystem, so verifying it also fixes what the root filesystem must be. There is no gap between "firmware approved something" and "this is the right system". |
| 4. Desktop | A compositor and the Orynr shell, with a splash covering the wait so you see the product rather than kernel messages. |
The desktop
Not a theme over someone else's desktop environment. The shell, the file manager, the security centre and the assistant are one program, built in Rust.
Memory-safety bugs are the largest single category of security vulnerability. Writing the desktop in a language that prevents them removes that class from our own code.
A modern display protocol where applications cannot read each other's windows or keystrokes, which the older X11 design allowed by default.
Light by default. The palette is defined once and shared by the desktop and this website, so they cannot drift apart.