veilor-org/veilor-os
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions
veilor-os/docs/research/2026-05-05-agent-wave/05-threat-model-launch.md
veilor-org 49a2e2557e docs: 9-agent research wave findings — v0.5.32 blocker map 
Logs the full output of the 9-agent deep-dive run on 2026-05-05 to
docs/research/2026-05-05-agent-wave/. Pulls every actionable finding
into one indexed location so v0.5.32 planning has a paper trail.

Files:
  docs/research/2026-05-05-agent-wave/README.md             — index
  docs/research/2026-05-05-agent-wave/01-...real-hardware.md — Plymouth + LUKS edge cases
  docs/research/2026-05-05-agent-wave/02-...firstboot-ux.md  — SDDM + first-boot UX
  docs/research/2026-05-05-agent-wave/03-...spike-plan.md    — bootc-image-builder 1-week spike
  docs/research/2026-05-05-agent-wave/04-...tier-2.md         — AppArmor + nftables + audit + homed
  docs/research/2026-05-05-agent-wave/05-...launch.md         — threat model + v0.7 launch checklist
  docs/research/2026-05-05-agent-wave/06-...log-capture.md    — virtio-9p host-share for anaconda logs
  docs/research/2026-05-05-agent-wave/07-...skel-branding.md  — /etc/skel gap audit
  docs/research/2026-05-05-agent-wave/08-...ci-hardening.md   — SHA-pin actions + SBOM + SLSA L3
  docs/research/2026-05-05-agent-wave/09-...failure-modes.md  — real-hardware pessimistic audit

Plus the prior linter-applied:
  docs/ROADMAP.md      — Lessons learned section, v0.5.32 active block,
                          v0.6 promotion of veilor-postinstall + veilor-doctor,
                          v0.7 bootc spike scheduled
  docs/THREAT-MODEL.md  — drafted by Agent 5; in/out scope, comparison
                          matrix, v0.7 launch checklist

Top blockers identified for v0.5.32 (cross-cited in README):
  1. Suspend/resume wifi death (kernel.modules_disabled=1)
  2. veilor-firstboot.service WantedBy=graphical.target
  3. kernel-upgrade grub drift
  4. USBGuard hash-rules problem (already learned on onyx)
  5. firewalld blocks tailscale0
  6. /etc/skel/ empty
  7. virtio-9p log capture replaces broken virtio-serial path

Wave + verifier pattern (per ROADMAP lessons learned #4) validated:
9 parallel agents on distinct topics produced converging blocker
list. The same pattern landed v0.5.31 four-bug fix from the prior
4-agent verification wave on v0.5.30 outcome.
2026-05-05 14:52:53 +01:00

2.2 KiB
Raw Blame History

Threat model + public launch prep

Agent 5 of 9-agent wave, 2026-05-05.

Deliverable

Threat model written to docs/THREAT-MODEL.md (1492 words). Slots into docs/ROADMAP.md v0.7 line item "Threat model published — honest scope".

Structure

  1. In-scope adversaries (9 rows): lost laptop, browser RCE, USB attacks, SSH brute-force, forensics, supply chain, LPE, network surface, time MITM. Each maps to specific veilor mitigation (LUKS2 argon2id mem=1GB, SELinux + veilor-systemd policy, USBGuard, fail2ban+firewalld, auditd, NTS chrony, etc.).

  2. Out-of-scope adversaries (9 rows): firmware implants, evil-maid on running system, hardware keylogger, session-level RCE (KDE not sandboxed), AES side-channels, TPM2 physical attacks, traffic correlation, TOFU MITM, sustained physical access. Each row points to right tool instead (Heads, Qubes, Tails).

  3. Hardening tradeoffs (6 honest costs):

    • SELinux app-compat
    • Slow LUKS boot
    • USBGuard friction
    • Module lockdown breaking NVIDIA prop / VBox
    • Drop-zone breaking KDE Connect / mDNS
    • No PackageKit

  4. Like Tails/Whonix/Qubes: published threat model, default-deny firewall, encrypted at rest.

  5. Differs from them: daily-driver vs session-only; single-VM vs Qubes compartmentalisation; persistent identity vs Tails amnesia.

  6. Comparison matrix: 10-axis × 6-distro grid (veilor-os / stock Fedora KDE / Kicksecure / Tails / Qubes / secureblue) covering encryption, MAC, firewall, USB, per-app isolation, anonymity, daily-driver fit, signed releases, threat-model publication, hardware compat.

  7. v0.7 launch checklist (9 items):

    • Threat model finalised
    • GPG signing (v0.4 dep)
    • mkdocs-material on veilor.org
    • Comparison + benchmarks
    • Press kit
    • "What veilor-os is not" preempt page (covers "why not Qubes/Tails/Fedora?")
    • r/linux + r/Fedora + HN posts
    • GitHub Release with ISO+sha256+.asc
    • Repo flip-public + DNS + Mastodon/Matrix/SimpleX announce

Tone

Matches repo voice — short paragraphs, no fluff, "honest scope" framing reused from roadmap. No emojis (per CLAUDE.md style).

See also

  • docs/THREAT-MODEL.md (full document)
  • docs/ROADMAP.md v0.7 section