Subsystem Features & Implementation Status | Snigdha OS Decentralized

System capabilities

Subsystem features & implementation status

Every feature is documented with its technical architecture, current development status, and transparent disclosure of physical boundaries. Data is governed by our centralized architecture model.

Filter capabilities

Category

Status

Showing 15 of 15 capabilities

Core SecurityAvailable

Amnesic Volatile Sessions

Stateless by default, leaving zero physical traces on host hardware.

All file mutations, transient cache, user activity, and application states live exclusively inside volatile system memory (RAM). The root filesystem operates as an OverlayFS backed by a read-only dm-verity compressed erofs image and a volatile tmpfs upperdir.

Architecture detail

Upon system power-off or USB removal, all volatile RAM pages are dereferenced. Internal hard drives and NVMe SSDs are neither mounted nor indexed. Udev and Polkit rules disallow unprivileged device access.

Amnesia does not eliminate cold-boot DRAM residual charge attacks if physical RAM modules are cryogenically frozen immediately upon power cutoff.

Read architecture doc

NetworkingAvailable

NetGuard Transparent Torification

Fail-closed nftables routing with zero external cleartext packets.

System-wide network traffic is strictly mediated by NetGuard. Non-Tor external TCP traffic is redirected to Tor TransPort (9040), and DNS is intercepted by Tor DNSPort (5353). Any packet attempting to bypass the circuit is dropped fail-closed.

Architecture detail

Implemented as an atomic nftables ruleset in the inet table. The Tor daemon starts locked (DisableNetwork 1) until the user explicitly authorizes network connection.

Tor does not defeat end-to-end traffic correlation if an adversary observes both entry guard and destination exit node traffic simultaneously.

Read architecture doc

NetworkingAvailable

DNS, UDP & IPv6 Leak Interception

Total suppression of out-of-band protocols and silent network leakage.

NetGuard eliminates silent leakage vectors. Outbound UDP traffic (which Tor cannot route directly) is dropped fail-closed, neutralizing WebRTC STUN leaks and QUIC bypasses. IPv6 has full parity enforcement.

Architecture detail

The nftables output chain matches `meta l4proto udp drop` for non-local traffic. Direct UDP port 53 and TCP port 853 (DoT) are strictly blocked.

Read architecture doc

NetworkingAvailable

Volatile Pluggable Transports & Bridges

Censorship circumvention using obfs4 and snowflake without persistent logs.

In censored or hostile network environments, users can configure obfs4 or Snowflake pluggable transports. Bridge configurations reside strictly in volatile tmpfs memory and Tor process RAM.

Architecture detail

Stored in /run/netguard/bridges.json. Redaction filters wipe bridge IP addresses and cryptographic fingerprints from GUI dialogs, Polybar status, and journal logs.

Read architecture doc

StorageAvailable

User-Controlled LUKS2 Persistence

Cryptographically isolated, selective persistent volume on the boot medium.

Users can selectively preserve configurations, PGP keys, bookmarks, or security tooling between reboots. Unlocked only with explicit passphrase entry via LUKS2 container with Argon2id key derivation.

Architecture detail

Separated from volatile memory via dedicated bind mounts. Features are modular: activating persistence for GnuPG does not expose browser history or chat logs.

Persistence diminishes plausible deniability: an adversary with physical possession of the USB drive can inspect the encrypted partition header.

Read architecture doc

Core SecurityAvailable

AppArmor Mandatory Access Control

Strict enforce-mode confinement for critical applications and services.

12 dedicated AppArmor profiles running in strict enforce mode (flags=(enforce)). Zero complain mode in production. Confines Tor Browser, OnionShare, KeePassXC, Thunderbird, and background daemons.

Architecture detail

Kernel boot parameters enforce `lsm=landlock,lockdown,yama,integrity,apparmor,bpf`. Access to raw sockets, physical storage devices, and ptrace is blocked.

Read architecture doc

Core SecurityAvailable

Bubblewrap User-Namespace Sandboxing

Ephemeral Linux containers with isolated PID, IPC, mount, and UTS namespaces.

The `snigdha-sandbox` CLI and Rofi menu launch user applications inside unprivileged namespaces with private volatile tmpfs mounts and restricted filesystem views.

Architecture detail

Session D-Bus is filtered via `xdg-dbus-proxy`, rejecting calls to privileged interfaces (NetGuard1, Persistence1, systemd1) with AccessDenied.

Read architecture doc

Core SecurityAvailable

Seccomp-BPF System Call Filtering

Kernel attack surface reduction blocking sensitive and exploit-prone syscalls.

Custom BPF bytecode compiler (`snigdha-seccomp-compiler`) compiles strict system call filters. Blocks ptrace, kexec_load, reboot, bpf, init_module, and raw packet sockets.

Architecture detail

Filters are attached before dropping user privileges. Any forbidden system call immediately terminates the application process via SECCOMP_RET_KILL.

Read architecture doc

ApplicationsAvailable

Pre-Configured Privacy Suite

Hardened user tools for communication, storage, and identity isolation.

Pre-installed and isolated ecosystem: Tor Browser, OnionShare, Thunderbird (with Tor SOCKS5 and autoconfig disabled), KeePassXC, GnuPG 2.4, and Metadata Cleaner.

Architecture detail

Tor Control Socket filtering proxy (`snigdha-tor-broker`) restricts Tor Browser control commands, preventing circuit teardown or malicious reconfigurations.

Read architecture doc

Core SecurityAvailable

Native Snigdha Security Center

Real-time posture telemetry and diagnostics built with Rust & GTK4.

An original, native desktop application providing consolidated status of NetGuard firewall, Tor circuits, amnesic tmpfs consumption, persistence mounts, and AppArmor confinement.

Architecture detail

Runs unprivileged as UID 1000. Communicates with system daemons exclusively through authenticated D-Bus interfaces with zero root escalation.

Read architecture doc

ApplicationsAvailable

Snigdha Penetration Center

Curated security tooling ecosystem with unprivileged signature validation.

Phase 9 delivers a native Rust + GTK4 interface for discovering and managing security testing tools across official Arch, BlackArch, and Chaotic-AUR repositories.

Architecture detail

Enforces that third-party repositories remain disabled by default, prevents partial upgrades, and requires valid OpenPGP signatures for all packages.

Read architecture doc

IntegrityAvailable

Secure Boot UKI & dm-verity Integrity

Cryptographic root verification from UEFI firmware to root filesystem.

Unified Kernel Images (UKIs) combining kernel, initramfs, and kernel command line, signed with isolated RSA-4096 keys. Lower root filesystem is verified by dm-verity Merkle tree hashes.

Architecture detail

Fails closed: any bit-level tampering with the underlying ISO filesystem immediately halts the boot process before user space is mounted.

Cannot prevent attacks originating from compromised UEFI motherboard firmware, Intel ME/AMD PSP, or malicious BIOS implants.

Read architecture doc

IntegrityIn development

Update, Recovery & Lifecycle Management

Cryptographically verified atomic upgrades and ISO media recovery.

Phase 10 tooling for performing atomic A/B updates of the live ISO image without compromising existing encrypted persistence containers or requiring full re-flashing.

Architecture detail

In active development in the codebase. Uses delta transfers over Tor with cryptographic signature verification before applying block updates.

Read architecture doc

Core SecurityNot supported

DRAM Cold-Boot Physical Erasure

Guaranteed instantaneous erasure of physical RAM capacitors upon power loss.

While `init_on_free=1` and kernel memory scrubbers wipe deallocated heap pages, the laws of physics dictate that semiconductor capacitors retain charges for seconds or minutes at cryogenic temperatures.

Architecture detail

No operating system running on standard x86_64 commercial hardware can physically override DRAM capacitance decay after main power rails are cut.

Adversaries with immediate physical access and liquid nitrogen can perform cold-boot attacks to read remnant encryption keys from DRAM chips.

Read architecture doc

Core SecurityNot supported

Complete X11 GUI Protocol Isolation

Total window and input event sandboxing between graphical client applications.

Snigdha OS Decentralized uses the lightweight i3 window manager with Xorg. The legacy X11 protocol inherently permits any connected client to snoop global keystrokes and window titles unless strictly patched or isolated.

Architecture detail

Mitigated via AppArmor socket restrictions, private user namespaces, and seccomp, but architectural X11 client separation is not equivalent to modern Wayland compositor boundaries.

Untrusted GUI applications running outside Bubblewrap could theoretically capture keystrokes from other X11 windows.

Read architecture doc