Security Model
VernisOS uses a capability-based security model. No process has implicit access to resources — every operation must be explicitly authorized through capabilities.
Core Principles
Least Privilege
Processes receive only the capabilities they need — nothing more
Complete Mediation
Every resource access is checked by the kernel, every time
Tamper-Proof Audit
All security events are SHA-256 signed and logged in append-only audit trail
Process Isolation
Each process has its own address space — no shared memory between untrusted processes
sandbox — Capability Isolation
The sandbox command launches a process with restricted capabilities:
> sandbox myapp
Launching 'myapp' in sandboxed mode.
Capabilities: [file_read]
Denied: [file_write, module_manage, ai_control, admin]
PID: 0x0042
Memory cap: 256 KB
CPU cap: 10% max
Sandboxed process running. Type 'exit' to terminate.Security Layers
x86 ring-based protection (Ring 0 for kernel, Ring 3 for user)
Capability checks on every syscall, address space isolation
Runtime behavioral monitoring, anomaly detection, trust scoring
SHA-256 signed event log — tamper-evident record of all security decisions
User-defined security rules enforced by the kernel policy engine