Technical Blueprint
Operating System Architecture
Explore the 7-layer defense-in-depth architecture that enforces sovereign computation from UEFI firmware execution down to user-space application sandboxing.
Full boot & runtime trust hierarchy
Select any layer to inspect its data flows, trust boundaries, and verified components.
UEFI Secure Boot & UKI
Verified components & primitives
- ›UEFI DB X.509 key enrollment (snigdha-secureboot-db.crt)
- ›Unified Kernel Image combining systemd-stub + Kernel 6.18 LTS
- ›Cryptographically sealed kernel cmdline locking initramfs parameters
- ›SBAT metadata for secure boot revocation resistance
Data flow & enforcement mechanism
Security invariant guarantee
UEFI Secure Boot & Unified Kernel Image (UKI)
Conventional live Linux media use unauthenticated bootloaders like Syslinux or unverified GRUB scripts that can be tampered with on physical flash media. Snigdha OS Decentralized implements modern Unified Kernel Images (UKIs) compiled using ukify and signed with dedicated RSA-4096 keys.
UKI Composition
- • systemd-stub EFI entry point
- • Linux 6.18 LTS kernel binary
- • Cryptographically sealed kernel cmdline
- • Early initramfs with dm-verity verification hooks
- • SBAT revocation metadata
Fail-Closed Guarantee
If the kernel command line or initramfs is altered on the USB drive, the UEFI signature verification check fails immediately. The motherboard halts execution before any code is run.
Read UKI Architecture Guide →dm-verity Root & Volatile Amnesia OverlayFS
Root storage consists of a two-tiered Linux OverlayFS. The lower directory is a compressed read-only EROFS filesystem verified block-by-block against a SHA-256 Merkle tree. The upper directory is an in-memory tmpfs instance.
Root Merkle Tree
Every 4096-byte read operation from airootfs.erofs is cryptographically validated by dm-verity. Any corruption triggers a kernel panic.
Complete Swap Elimination
Kernel arguments systemd.swap=0 and systemd unit masking guarantee that no swap files or swap partitions are ever activated.
C99 Media Watchdog
The snigdha-media-watchdog daemon actively polls the boot USB medium. If the physical drive is removed, it triggers an emergency amnesic shutdown.
Fail-Closed Transparent Torification
NetGuard operates in the kernel packet filter layer using modern nftables. It eliminates the architectural flaws of user-space SOCKS proxy wrappers (which can be bypassed by buggy applications or malicious shell scripts).
User-Controlled LUKS2 Persistence with Selective Bind Mounts
Persistence in Snigdha OS Decentralized avoids global read-write persistence, which can lead to unintended file leakage. Instead, the snigdha-persistenced daemon mounts an encrypted volume and binds only authorized directory structures.
Argon2id Key Derivation
Uses LUKS2 header format with memory-hard Argon2id key derivation, providing maximum resistance against GPU and ASIC dictionary attacks on seized flash drives.
Selective Feature Isolation
Enabling persistence for GnuPG or SSH keys does not persist browser history, chat transcripts, or system logs. Each feature is an independent toggle.