Introducing Citadel
Subgraph OS is being rebuilt on a new base system called Citadel. This post describes what Citadel is and how it differs from the original Subgraph OS.
Who it is for
Subgraph OS is meant for people who are likely to be targeted directly: journalists, activists, human-rights defenders, security researchers, and staff at organizations under attack. Their attackers can spend a lot of time and money on one target. Reducing attack surface helps, but we also want to make it hard for malware to stay on the system once it gets in.
The base system
The Citadel root filesystem is mounted read-only and verified with
dm-verity. Each block is checked against a hash tree when it is read. A
modified block fails verification and the read fails. If modified blocks are
needed during startup, the system does not boot. Malware cannot write itself
into the base system, and a reboot starts from the same verified image.
Updates to the base system ship as a single signed image. The update is applied atomically. If the new image causes a problem, you can roll back to the previous one.
Realms
Applications run in realms, separate from the base system. A realm is either
a container managed by systemd-nspawn or a virtual machine running under
pH, a KVM hypervisor written in Rust. The root filesystem of each realm is a
signed RealmFS image.
You can create a realm for each project, client, or level of trust. A compromise in one realm does not give access to the data in another.
The desktop is GNOME on Wayland. Each window is labelled with the realm it belongs to.
Reproducible builds
Citadel is built with OpenEmbedded, and the builds are reproducible from source. You can rebuild an image yourself and compare it with the one we publish.
Relation to the original Subgraph OS
Citadel is the base of Subgraph OS. The original Subgraph OS, from around 2016, was based on Debian. It used the grsecurity kernel patches and sandboxed desktop applications one at a time with Oz. Citadel keeps the same goal of a usable desktop for people facing targeted attacks. It moves isolation from individual applications to whole realms, and runs them on a read-only, verified base system.
Later posts will cover the architecture, the pH hypervisor, and reproducible builds in more detail.