Minimal, hardened Linux base — secure by default

osmo os by Osmosian boots with a signed UKI for UEFI Secure Boot; on legacy BIOS it boots without Secure Boot. Storage is encrypted with LUKS2 on Btrfs, the kernel is hardened, and userspace is BusyBox — runs under QEMU/KVM or on bare metal.

Review defaults Why osmo os

# boot status (UEFI) osmo@init:~$ bootctl status Secure Boot: enabled (UKI signature validated) UKI: stub+kernel+initramfs+cmdline (measured) # storage osmo@init:~$ cryptsetup luksDump /dev/root | grep -E "Version|PBKDF" Version: LUKS2 PBKDF: argon2id # kernel/sysctl osmo@init:~$ sysctl kernel.unprivileged_bpf_disabled dmesg_restrict kptr_restrict kernel.unprivileged_bpf_disabled = 1 kernel.dmesg_restrict = 1 kernel.kptr_restrict = 2 osmo@init:~$

Why osmo os

Secure Boot (UKI)

Unified Kernel Image signed for UEFI Secure Boot: single artifact (stub, kernel, initramfs, cmdline) — measured and verified at boot.

Encrypted by default

LUKS2 full-disk encryption on Btrfs with hardened mount options, controlled discard (TRIM) when enabled, and integrity-preserving defaults.

Hardened kernel

Lockdown mode, AppArmor, KASLR, strict sysctls, read-only kernel memory regions, and minimal module set reduce attack surface.

Small, auditable userspace

BusyBox core with essential tools only — no telemetry, no desktop, predictable boot, and fewer moving parts.

Security defaults

Area	Default	Status
Boot	UEFI path: signed Unified Kernel Image (UKI) with measured boot and a signed command line; dm-verity for read-only critical partitions. Legacy BIOS: boot without Secure Boot.	enforced
Storage	LUKS2 with argon2id, Btrfs subvolumes, hardened mounts, controlled discard (TRIM) when enabled.	enforced
Kernel	Lockdown integrity, AppArmor, KASLR, unprivileged BPF disabled, restricted dmesg/kptr, minimal modules.	strict
Networking	Default-deny firewall, reverse-path filtering, TCP hardening, drop unsolicited IPv6 RA, minimal services.	enabled

For production, enroll your own PK/KEK/db and sign UKIs in CI with organization keys.