particleos

You do need some root process to be able to write the updated kernel image to a root owned directory. On macos that is presumably their update daemon, while on something like ParticleOS[0] IIRC it is the systemd-sysupdated daemon, though I don't know if you can initiate the update as an unprivileged user or if its done on a timer or only root initiated (sysupdate has had a lot of changes not too long ago that reworked it extensively. It use to be something only root invoked transiently with a possible timer to "update all", but now it has a full on daemon). Basically the reason we "need sudo access" (or anything to elevate privs to root) is because how the system is architected and changing that is mostly only possible on new distros which can decide to change the architecture. [0]: https://github.com/systemd/particleos

> What about /boot - encrypted and tamper proof? Resists evil maid attack? > Rabbit hole, I know, but so fascinating if you solved it all :) Encrypting `/boot/` is the wrong thing to do. One can just replace it with something that logs the encryption key instead (and sends it off to somewhere). You actually need to verify that what you expect to be there is actually there and a encryption isn't gonna do that for you. A reasonably secure boot chain looks roughly as follows: bootloader is checked by the UEFI (read secure-boot), bootloader chain loads a signed UKI which also uses secure boot verification (or just skip the bootloader if you only have a single kernel with no fallback), this then loads a signed dm-verity `/usr/` which brings you to the login screen. Root is just data (e.g. mounted `noexec`) and is encrypted using e.g. PCR 11 so

The real question is, when will this joke finally get old? Like is it really still funny to make joke after literally every thread about SystemD has made this joke for 10+ years. Btw, it already exists and its called ParticalOS: https://github.com/systemd/particleos

Immutable, signed systems do not intrinsically conflict with hackability. See this blog post of Lennart's[0] and systemd's ParticleOS meta-distro[1]. I do agree that these technologies can be abused. But system integrity is also a prerequisite for security; it's not like this is like Digital "Rights" Management, where it's unequivocally a bad thing that only advances evil interests. Like, Widevine should never have been made a thing in Firefox imo. So I think what's most productive here is to build immutable, signable systems that can preserve user freedom, and then use social and political means to further guarantee those freedoms. For instance a requirement that owning a device means being able to provision your own keys. Bans on certain attestation schemes. Etc. (I empathize with anyone who would be cynical about those particular possi

Standardizing that approach is one thing that the systemd project has been working on. They've built various components to help with that, including writing specifications (via the UAPI group) on how that should all fit together. ParticleOS[0] gives a look at how this can all fit together, in case you want to see some of it in action. [0] https://github.com/systemd/particleos

> Gnome OS these days uses A/B updates with dual read-only /usr partitions and verified boot in the mold of https://0pointer.net/blog/fitting-everything-together.html. Hang on. I have to say [[citation needed]] on this. I write about systemd regularly, and read Lennart's blog and Mastodon feed. As evidence, I did an in-depth on systemd 258 just a month or so ago: https://www.theregister.com/2025/07/25/systemd_258_first_rc_... I do not personally use GNOME or GNOME Boxes and I've never managed to get GNOME OS to so much as boot successfully in a hypervisor or on bare metal, and I've tried many times. But I don't think it adopts all these fancy features yet. ParticleOS does: https://github.com/systemd/particleos But that's a separate distro. It's not GNOME OS. It's the testbed for the "fitting everything together" concepts. Adrian Vovk's C

The article is more than one year old, systemd now even has specialized officially supported OS distro for immutable workflow namely ParticleOS [1],[2]. [1] ParticleOS: https://github.com/systemd/particleos [2] Systemd ParticleOS: https://news.ycombinator.com/item?id=43649088

Actually, I went ahead and just asked him. This was his response (if you’re reading this for some reason, Lennart, thanks again): > CarbonOS is close, and GnomeOS too. > and here, we build something generic to create images from Fedora/debian/suse/arch… distro packages: > https://github.com/systemd/particleos > There‘s a lot going on in the matrix channel of mkosi, I would recommend taking a look.