VertexOS — Security-Hardened Linux Distribution

URL: os.vertexelite.org Base: Void Linux musl Init: runit Desktop: XFCE4 with Windows 7 Aero Glass aesthetic ISO Size: ~1.9 GB Status: Live on GitHub Releases with SHA-256 published

Security Stack

Kernel Hardening

• KSPP (Kernel Self-Protection Project) hardening flags

Mandatory Access Control

• AppArmor MAC profiles

Network Security

• nftables default-deny firewall
• XDP Sentinel hooks (custom eBPF-based network filtering)

Sensor Stack (VertexSense — Go-based TUI aggregator)

• Falco — runtime threat detection
• Suricata — network IDS/IPS
• Zeek — network analysis
• Wazuh — HIDS
• ntopng — network traffic monitoring

Additional Hardening

• auditd rules
• USBGuard policy
• PAM hardening
• sysctl tuning
• Hardened /etc/skel

CVE Watch

• vertexos/tools/cve-watch/ — daily KEV radar for VertexOS shipped component stack

rootfs Overlay Structure

build/rootfs-overlay/etc/
├── apparmor.d/        — AppArmor profiles
├── audit/             — auditd rules
├── falco/             — Falco detection rules
├── suricata/          — Suricata rules
├── usbguard/          — USBGuard policy
├── pam.d/             — PAM hardening
├── sysctl.d/          — Kernel parameter tuning
└── skel/              — Hardened user skeleton

Published by VertexElite Security Research · research@vertexelite.org