Amutable Foundations: A Technical Overview

The image-based OS approach enables us to enforce some very strict but powerful security properties, which elevate the security posture of the system substantially above traditional Linux systems.

Specifically, let's highlight seven major essential security properties of AOS here: No Shell + No SSH + No Language Interpreters.

By default AOS does not install a UNIX shell, nor makes remote access via SSH available on the nodes. Moreover, we do not install any of the usual language interpreters (Python, Perl, …) by default. For most nodes a shell or interpreted language support is not required and it removes a whole class of attacks.

Signed Images Only. On AOS only images that come with Verity data signed by a signing key listed in the Verity keyring may be activated. [...] No Shell + No SSH + No Language Interpreters. By default AOS does not install a UNIX shell, nor makes remote access via SSH available on the nodes.

Moreover, we do not install any of the usual language interpreters (Python, Perl, …) by default. For most nodes a shell or interpreted language support is not required and it removes a whole class of attacks. Signed Images Only. On AOS only images that come with Verity data signed by a signing key listed in the Verity keyring may be activated.

[...]