Security: the ID card

In NULLos every program has an ID card (Ausweis). It says what the program may do: which files it may read or write, whether it may use the network, whether it may start other programs. The kernel checks this on every access. Whatever is not on the ID card does not work – not even for the administrator.

How this is built inside is described in the project documentation under Security. This page shows what you notice of it as a user.

When the ID card forbids something

Then NULLos tells you exactly who may not do what. An example: mo shows the mounted file systems, but it may not look into /dev and /boot.

mo

Rechte: „mo“ darf laut Ausweis nicht „/dev“ ansehen
Rechte: „mo“ darf laut Ausweis nicht „/boot“ ansehen
Gerät                    Ordner                       Typ      Merkmale
initrd                   /                            ramfs    lokal
devfs                    /dev                         devfs    lokal
/dev/sda1                /boot                        fat      lokal, nur lesen

The program still keeps running and shows what it is allowed to show.

ID cards are improved all the time. On 29 Oct 2026, for example, fw was not yet allowed to read a rule file from /boot; on 30 Oct 2026 fw laden /boot/ssh/ssh.fw worked.

Rights only flow downwards

A program that starts another one cannot give it more rights than it has itself. If the caller may not do something, the started program may not do it either. The message for this looks like this:

Rechte: „s“ darf nicht Programme starten („/bin/pr“) – der Aufrufer darf es selbst nicht (Rechte fließen nur abwärts)

Scripts with an ID card

A shell script can have an ID card too. It sits at the top of the script, in comment lines starting with # ausweis:. The script then runs only with these rights.

#!/bin/s
# ausweis: datei lesen argumente
# ausweis: prozesse starten sh
sh "$1"
pr x > /tmp/neu.txt

So the script may show the named file, but may not write anything:

s lies.s a.txt

geheim
Rechte: „s“ hat sich selbst eingeschränkt (einschr) und darf nicht „/tmp/neu.txt“ anlegen
lies.s: Zeile 5: /tmp/neu.txt: Zugriff verweigert

A script without such lines runs with all of your rights. The shell points this out to you:

s: ohne.s: Skript ohne Ausweis – läuft mit allen Rechten des Aufrufers (Kopfzeile „# ausweis: …“)

Tip: Start with few rights and add what the messages ask for. How to write the lines is shown by h s under „Sicherheit“ ("Security").

What else protects you

• Firewall on by default: Nothing comes in from outside until you allow it. See Network and firewall.
• SSH only with a key: The SSH server ssd knows no passwords, only Ed25519 keys from authorized_keys. See QEMU and SSH.
• No silent overwriting: c, arc -x and others only overwrite existing files with -f.

You can look up the ID cards of all commands in the project documentation: under The commands it is listed for each command under „mehr“ ("more").

Physical security – what software cannot do

ID card, firewall and SSH keys protect against attacks through programs and the network. Someone who gets their hands on the computer itself, or gets close enough, has other ways. Against many of them no operating system can do anything, NULLos included. Most of these attacks need effort, equipment and closeness. Still, a few simple habits help.

Switch off instead of standby

Memory does not lose its contents right after power-off, but only after seconds to minutes, even later when it is cooled. Someone who then starts the computer right away with their own system can find keys in it ("Cold Boot", Princeton 2008). In standby (sleep, lid closed) the memory is even kept completely.

If you leave the computer alone, switch it off completely. NULLos itself has no standby yet. NULLos does not yet erase freed memory (as of 30 Oct 2026).

Unknown USB devices and charging cables

A USB stick can pretend to be a keyboard and type commands in seconds (BadUSB, 2014). Charging stations and cables can do the same, also with phones (TU Graz 2025). Some devices destroy the computer with high voltage.

Do not plug in anything whose origin you do not know. For charging on the go, use your own power adapter or a data blocker, an adapter that only lets power through. NULLos today accepts a new USB keyboard without asking (checked in QEMU on 30 Oct 2026).

Screen emissions and computers without a network

Screens, cables and keyboards give off faint radio waves. With an antenna and receiver the picture can be recovered from them; in 2024 this was also shown over an HDMI cable. In 2009 keyboards could be read along from 20 m away through walls. Researchers at Ben-Gurion University have also shown how malware can get data out of a computer without a network ("air gap"): via little lights, fan noise, heat or radio from the memory.

Only physics helps against this: shielding, distance, taping over the little lights. Software can at most make it harder.

Do not leave the device unattended

If a computer stands unguarded in a hotel room, someone can swap the boot loader for one that records your password ("Evil Maid", Joanna Rutkowska 2009). You notice nothing.

Take the device with you or lock it away. The NULLos boot loader nb does not yet check the kernel with a signature (as of 30 Oct 2026).

TPM only with a PIN

Many computers have a TPM, a chip that stores keys. If it unlocks the disk on its own, without a PIN, the key travels openly over the lines of the circuit board and can be tapped there (shown in 2019 on BitLocker).

Always use a TPM together with a PIN or password. NULLos does not use the TPM yet: the tool tpm can only read it out, and the driver is still missing on NULLos.

Long passphrase, Thunderbolt and FireWire

A short password can even be guessed from the heat traces on the keyboard (University of Glasgow 2022). Use a long passphrase made of several words.

Devices on Thunderbolt and FireWire may read and write memory directly (Thunderspy 2020). If you do not need these ports, switch them off in the firmware settings (UEFI). NULLos does not yet have a protection against this (IOMMU) (as of 30 Oct 2026).

The developers keep a list of all known attacks with sources and countermeasures, including what cannot be solved with software at all.