{{Header}}
{{title|title=
Security Research by {{project_name_short}}
}}
{{#seo:
|description=Security research, audits, and vulnerability reports published by {{project_name_short}}.
}}
{{about_mininav}}
{{intro|
This page tracks security research and vulnerability reports contributed by {{project_name_short}}, including links to upstream bug reports and internal research notes.
}}

= Security Vulnerability Bug Reports =
Security issue reports filed at other projects. See:

* [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108288 Local privilege escalation via zuluPolkit, caused by Debian patch]

= Security Research =
{{IntroLike|
Practical defensive security research: hardening work, threat modeling, and attack surface analysis. Synthesis of Linux distribution maintainer oriented decision making, security engineering, and [[Dev/maintainability|maintainability]] considerations.
}}

{| class="wikitable"
|+ Design pages: Security research triage (in progress)
|-

! <!-- Column Headers --> Page
! <!-- Column Headers --> Short summary
! <!-- Column Headers --> Type
|-

| [[Dev/Strong_Linux_User_Account_Isolation|Strong Linux User Account Isolation]]
| Overview of Linux user and <code>root</code> separation, attack vectors, and default and optional hardening measures.
| Research
|-

| [[Verified_Boot|Verified Boot]]
| Explains verified boot and chain of trust goals, advantages, limitations, and implementation considerations.
| Research
|-

| [[ram-wipe]] / [[Dev/RAM_Wipe|Dev/RAM Wipe]]
| Research and implementation of a dracut module that wipes RAM on shutdown.
| Research
|-

| [[Dev/Entropy|Entropy]]
| Technical discussion of entropy sources and randomness topics.
| Research
|-

| [[Dev/remount-secure|remount-secure]]
| Hardening proposal for secure mount options and a maintainable way for a distribution to apply them.
| Research
|-

| <!-- Page --> [[Dev/compiler_hardening|Compiler Hardening]]
| <!-- Short summary --> Overview of compiler hardening flags and link time options for GCC and Clang, focusing on exploit mitigation and diagnostics.
| <!-- Security research? --> Notepad
|-

| [[Dev/About_Computer_(In)Security|About Computer (In)Security]]
| Broad background notes and examples about computer insecurity and related concepts.
| Essay
|-

<!--
| [[Dev/VirtualBox|VirtualBox]]
| VirtualBox integration notes and issues; includes questions about virtualization security but several sections are unfinished.
| No
|-
-->

<!--
| [[Dev/Qubes|Qubes]]
| Kicksecure Qubes template build notes and integration status.
| No
|-
-->

<!--
| [[Security_Reviews_and_Feedback|Security Reviews and Feedback]]
| Explains what "audits" and "security research" mean in practice and collects examples and calls for review.
| No
|-
-->

<!--
| [[Dev/Derivative-Maker|Derivative-Maker]]
| Documentation for the image build tool used to build Debian derivatives such as Kicksecure and Whonix.
| No
|-
-->

<!--
| [[Build_Configuration|Build Configuration]]
| Build and configuration options for building Kicksecure from source, including caching and build environment settings.
| No
|-
-->

<!--
| [[Dev/Expected_Build_Warnings|Expected Build Warnings]]
| Catalog of build warnings considered expected during image builds and how to interpret them.
| No
|-
-->

<!--
| [[Dev/Relationship_With_Upstream|Relationship With Upstream]]
| Notes on how Kicksecure relates to upstream projects (for example Debian) and expectations around patching and collaboration.
| No
|-
-->

<!--
| [[Dev/About_Infrastructure|About Infrastructure]]
| Infrastructure overview (repositories, build systems, hosting related notes); mostly project operations.
| No
|-
-->

| [[Trust|Trusting Kicksecure]]
| Trust model discussion (backdoors, signatures, image verification) and how to place trust in the supply chain.
| Essay
|-

| [[Dev/Secure_Boot|Secure Boot]]
| Critical discussion of Secure Boot design tradeoffs, threat model, and limitations for user controlled trust currently on Intel/AMD64.
| Summary
|-

| [[Dev/Stateless|Factory Reset, Stateless Systems, Anti-Hysteresis]]
| Discussion of stateless and anti-hysteresis systems, upgrades and rollback risks, and links to related immutable approaches.
| Notepad
|-

<!--
| [[Dev/bootstrappable_builds|bootstrappable builds]]
| Overview of bootstrappable builds and obstacles to fully verifiable build chains; currently incomplete.
| Notepad
|-
-->

<!--
| [[Dev/Automatic_Updates|Automatic Updates (APT)]]
| Analysis of whether to enable automatic updates, including usability and security tradeoffs, and APT behavior considerations.
| Notepad
|-
-->

| [[Dev/apt-revoker|apt-revoker]]
| Proposal for tooling to revoke compromised APT signing keys.
| Design
|-

<!--
| [[Dev/APT|APT Signing Key Folders]]
| Explains APT keyring locations and how <code>signed-by</code> influences which keys are used for repository trust.
| No
|-
-->

<!--
| [[Dev/About_Debian_Packaging|About Debian Packaging]]
| Packaging guidance for Kicksecure packages, including dependency analysis and configuration file practices.
| No
|-
-->

<!--
| [[Dev/Versioning_Format_Conventions|Versioning Format Conventions]]
| Describes versioning conventions for Kicksecure maintained packages and release tagging practices.
| No
|-
-->

<!--
| [[Stable_Version_User_Experience|Stable Version User Experience]]
| User experience goals for stable releases, focusing on reliability and minimizing breakage.
| No
|-
-->

| [[Dev/Stable_vs_Rolling_Distributions|Stable vs Rolling Distributions - Security Analysis]]
| Security analysis of stable and rolling release models.
| Analysis
|-

<!--
| [[Dev/maintainability|maintainability]]
| Discussion of maintenance constraints and development philosophy, linking security goals to sustainability.
| No
|-
-->

<!--
| [[Privacy|Privacy Goals and Non-Goals]]
| Clarifies that Kicksecure is primarily security focused and outlines what privacy expectations are and are not.
| No
|-
-->

<!--
| [[Dev/coding_style|Coding Style]]
| Coding style and development guidelines (simplicity, brevity, forking policies).
| No
|-
-->

<!--
| [[Dev/nonfree|non-freedom firmware and drivers]]
| Policy and discussion around proprietary firmware, microcode, and drivers.
| No
|-
-->

<!--
| [[Dev/filesystem|filesystem]]
| File system choice considerations, including rollback and snapshot ideas.
| No
|-
-->

<!--
| [[Dev/image_formats|image formats]]
| Image format tradeoffs (ISO vs RAW and related concerns like compression and encryption).
| No
|-
-->

<!--
| [[Digital_Signature_Policy|Kicksecure Digital Signature Policy]]
| Policy requiring signed commits, tags, and images and prohibiting unsigned code execution or deployment.
| No
|-
-->

<!--
| [[Security_Roadmap|Security Roadmap]]
| Roadmap of future security enhancements and links to sub projects; planning oriented.
| No
|-
-->

| [[Dev/Permanent_Takedown_Attack_Defender|Permanent Takedown Attack Defender]]
| Proposal to keep project metadata and update communication resilient against takedown, rollback, and freeze attacks, with Tor and signature considerations.
| Design
|-

<!--
| [[Dev/project-news|Project / Emergency News]]
| Draft proposal for a package to deliver important project news and security notices to users.
| No
|-
-->

<!--
| [[Dev/reviewer|Proposal: Base Distribution Developers = Derivative Developers]]
| Governance proposal about code review and merge rights to improve review bandwidth and quality.
| No
|-
-->

| [[Dev/confidential_computing|Confidential Computing]]
| Survey and threat model notes around encrypted RAM and remote attestation technologies for cloud and hardware trust.
| Survey
|-

| [[Vm-app-manager|vm-app-manager]]
| Proposal for a virtualization based application sandbox with reduced VM escape surface and user controllable isolation features.
| Notepad
|-

<!--
| [[Design|Other pages linked from Design (General Developer Pages, Website Developer Pages, Download / Installation, Build from Source Code, etc.)]]
| -
| No
|-
-->

|}

Pages marked "Notepad" are security relevant working notes or drafts that likely need more structure or completion before being presented as finished security research. Pages marked "Essay" are mostly conceptual discussion.

= Privacy and Anonymity Research =
See {{whonix_wiki
|wikipage=Dev/research
|text=Whonix research
}}.

{{Footer}}
[[Category:Development]]