Building a hardened personal Linux OS with only proven tools, and why I ultimately abandoned cryptographic rootfs protection

I am a reporter composing an account of a story based on provided wire material. I will not copy or reuse more than four consecutive words directly from the source, but instead rephrase facts and present them in my own words while maintaining the overall narrative. Direct quotations from named speakers will be reproduced verbatim. Here is my account using only facts, names, figures and dates from the source:

I am constructing a defensive security application for Linux called RoamSwitch as an independent developer. Recently, I have taken this further by building a hardened Linux OS from scratch called RoamSwitch OS. This post combines two separate Japanese writings about my goals in building a secure OS and the reason I could not protect rootfs cryptographically. I go into more technical detail beyond just explaining what RoamSwitch OS is.

Building my own OS rather than just a userland application, like RoamSwitch, is important because core kernel level and default configurations are out of its control. So I created RoamSwitch OS out of curiosity to see how hardening at the OS layer impacts security compared to adding it on top of an existing OS. Currently, it is still very early and not ready for anyone but me to use.

The base OS is Arch Linux, prepared as a bootable live/installer ISO through archiso. I am not creating a distro from scratch, but layering hardening on top of a standard Arch install. Tools like AppArmor, fapolicyd, auditd, Falco/Tetragon, Landlock, AIDE and TPM2 have years of proven track records and will be used to add hardening.

Rather than an immutable, image-based OS like Fedora Silverblue or ChromeOS, I chose to build on Arch's rolling package ecosystem and existing driver support. The approach is to build a Rust workspace with about 39 crates, each providing a binary for a specific defensive feature. Most modules run as systemd services starting at boot, while others run occasionally through .timer units. They communicate through shared state in /var/lib/roamswitch/, including an incident timeline.

Some key modules include forensic-sweep monitoring persistence surfaces like cron, systemd user units and shell rc files. It flags new persistence attempts, ld.so.preload hijacking and fileless execution. Honeytokens plant fake credentials and decoy listeners to detect attacks. fapolicyd-mgr handles application allowlisting using pacman-managed file hashes as trust anchors. exfil-guard looks for sensitive file access and network connections. mitm-guard detects ARP cache and DHCP spoofing. privacy-guard randomizes MAC addresses, checks DNS settings, enables tor-mode and monitors Wi-Fi and Bluetooth. ransomware-rollback watches for suspicious file changes, takes snapshots and stops ransomware. These modules communicate through a shared incident timeline file.

The setup comes with AppArmor profiles, verification runs in real hardware and QEMU. However, it is still a research project and not recommended for production use yet. I have deliberately left out features like per-file cryptographic tamper checks and automatic network switching.