Security-focused operating system
This article possibly contains original research. (December 2012) (Learn how and when to remove this template message)
This is a list of operating systems with a sharp security focus. Here, "security-focused" means that the project is devoted to increasing the security as a major goal. As such, something may be secure without being "security-focused." For example, almost all of the operating systems mentioned here are faced with security bug fixes in their lifetime; however, they all strive consistently to approach all generic security flaws inherent in their design with new ideas in an attempt to create a secure computing environment. Security-focused does not mean security-evaluated operating system, which refers to operating systems that have achieved certification from an external security-auditing organization. An operating system that provides sufficient support for multilevel security and evidence of correctness to meet a particular set of government requirements is called a "trusted operating system".
The list is alphabetical and does not imply a ranking.
The Linux kernel provides among other security features, the Linux Security Module (LSM), officially integrated with the mainline Linux kernel since 2003. However, there have been specialized distributions and projects that attempt to make Linux more secure in general or for particular scenarios.
openSUSE uses a stateful network packet filter (also known as firewall) and includes a feature called AppArmor which monitors running programs for unusual behavior). The YaST system configuration module is included to provide configuration and reporting for the firewall and other system components.
The "Securing Debian Manual" contains information for Debian administrators. Debian includes support for SELinux since version 5.0, as well as AppArmor and Tomoyo. See also Debian Security information and policy.
Secure-K OS is a security & privacy oriented encrypted live operating system based on Debian. Its aim is to provide the safest possible environment in which to work: Secure-K OS features a unique partitioning scheme, which allows kernel update (on ISO 9660 read-only filesystem) and bootstrap-time anti-tampering measures. A "security area" is available, designed for anonymous browsing, encrypted chat and one-click encrypted emails exchange.
Whonix is an anonymous general purpose operating system based on VirtualBox, Debian GNU/Linux and Tor. By Whonix design, IP and DNS leaks are impossible. Not even Malware as Superuser can find out the user's real IP address/location. This is because Whonix consists of two (virtual) machines. One machine solely runs Tor and acts as a gateway, called Whonix-Gateway. The other machine, called Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.
Parrot Security OSEdit
Parrot Security OS is a Cloud oriented GNU/Linux distribution based on Debian and designed to perform security and penetration tests, do forensic analysis, or act in anonymity. It uses the MATE Desktop Environment, Linux Kernel 4.6 or higher and it is available as a live lightweight installable ISO image for 32-bit, 64-bit and ARM processors with forensic options at boot, optimizations for programmers, and new custom pentesting tools.
Fedora is a free, Red Hat-sponsored community-developed Linux distribution. Fedora is a mainstream distribution that makes significant efforts to improve security. As a consequence, it has a fully integrated SELinux MAC and fine-grained executable memory permission system (Exec Shield) and all binaries compiled with GCC's standard stack-smashing protection, as well as focusing on getting security updates into the system in a timely manner.
Qubes OS is a desktop operating system based around the Xen hypervisor that allows grouping programs into a number of isolated sandboxes (virtual machines) to provide security. Windows for programs running within these sandboxes ("security domains") can be color coded for easy recognition. The security domains are configurable, they can be transient (changes to the file system will not be preserved), and their network connection can be routed through special virtual machines (for example one that only provides Tor networking). The operating system provides secure mechanisms for copy and paste and for copying files between the security domains.
Red Hat Enterprise LinuxEdit
Red Hat Enterprise Linux offers the same security benefits as Fedora with the additional support of back-porting security fixes to the released versions of the packages (particularly the kernel) so the sys-admin does not have to perform a significant (and risky) upgrade to get a security fix.
Hardened Gentoo is a sub-project of the Gentoo Linux project. Hardened Gentoo offers a ProPolice protected and position-independent executable base using exactly the same package tree as Gentoo. Executable space protection in Hardened Gentoo is handled by PaX. The Hardened Gentoo project is an extremely modular[clarification needed] project, and also provides subprojects to integrate other intrusion-detection and mandatory access control systems into Gentoo. All of these can be optionally installed in any combination, with or without PaX and a ProPolice base.
Pentoo Penetration Testing Overlay and Livecd is a live CD and Live USB designed for penetration testing and security assessment. Based on Gentoo Linux, Pentoo is provided both as 32-bit and 64-bit installable live cd. Pentoo also is available as an overlay for an existing Gentoo installation. It features packet injection patched wifi drivers, GPGPU cracking software, and lots of tools for penetration testing and security assessment. The Pentoo kernel includes grsecurity and PAX hardening and extra patches – with binaries compiled from a hardened toolchain with the latest nightly versions of some tools available.
Replicant is a FOSS operating system based on the Android mobile platform, which aims to replace all proprietary Android components with their free software counterparts. It is available for several smartphones and tablet computers.
In March 2014, the Replicant project announced the discovery of a backdoor present in a wide range of Samsung Galaxy products that allows the baseband processor to read and write the device's storage, sometimes with normal user privileges and sometimes as the root user, depending on device model. It is not generally known whether Samsung's proprietary firmware for the radio chip can be remotely instructed to use these access features and the intentions of creating such a backdoor.
Alpine Linux is a lightweight musl and BusyBox-based distribution. It uses PaX and grsecurity patches in the default kernel and compiles all packages with stack-smashing protection. Version 3.7.0 was released November 30, 2017.
Annvix was originally forked from Mandriva to provide a security-focused server distribution that employs ProPolice protection, hardened configuration, and a small footprint. There were plans to include full support for the RSBAC mandatory access control system. However, Annvix is dormant, with the last version being released on December 30, 2007.
EnGarde Secure LinuxEdit
EnGarde Secure Linux is a secure platform designed for servers. It has had a browser-based tool for MAC using SELinux since 2003. Additionally, it can be accompanied with Web, DNS, and email enterprise applications, specifically focusing on security without any unnecessary software. The community platform of EnGarde Secure Linux is the bleeding-edge version freely available for download.
Immunix was a commercial distribution of Linux focused heavily on security. They supplied many systems of their own making, including StackGuard; cryptographic signing of executables; race condition patches; and format string exploit guarding code. Immunix traditionally releases older versions of their distribution free for non-commercial use. The Immunix distribution itself is licensed under two licenses: The Immunix commercial and non-commercial licenses. Many tools within are GPL, however; as is the kernel.
Solar Designer's Openwall Project (Owl) was the first distribution to have a non-executable userspace stack, /tmp race condition protection, and access control restrictions to /proc data, by way of a kernel patch. It also features a per-user tmp directory via the pam_mktemp PAM module, and supports Blowfish password encryption.
Subgraph OS is a Linux-based operating system designed to be resistant to surveillance and interference by sophisticated adversaries over the Internet. Subgraph OS is designed with features which aim to reduce the attack surface of the operating system, and increase the difficulty required to carry out certain classes of attack. This is accomplished through system hardening and a proactive, ongoing focus on security and attack resistance. Subgraph OS also places emphasis on ensuring the integrity of installed software packages through deterministic compilation.
Subgraph OS features a kernel hardedned with the Grsecurity and PaX patchset, Linux namespaces, and Xpra for application containment, mandatory file system encryption using LUKS, resistance to cold boot attacks, and is configured by default to isolate network communications for installed applications to independent circuits on the Tor anonymity network.
This section does not cite any sources. (December 2012) (Learn how and when to remove this template message)
BSD is a family of Unix variants derived from a code base originating at the University of California, Berkeley. All derived BSD operating systems are released under the terms of a BSD-style license. There are several BSD variants, with only one being heavily focused on security.
Anonym.OS was a Live CD operating system based on OpenBSD 3.8 with strong encryption and anonymization tools. The goal of the project was to provide secure, anonymous web browsing access to everyday users. The project was discontinued after the release of Beta 4 (2006).
OpenBSD is an open source BSD operating system that is known to be concerned heavily with security. The project has completed rigorous manual reviews of the code and addressed issues most systems have not. OpenBSD also supplies an executable space protection scheme known as W^X (memory is writeable xor executable), as well as a ProPolice compiled executable base. OpenBSD became the first mainstream operating system to support partial ASLR and to activate it by default; ASLR support was completed in 2008 when it added support for position-independent executable (PIE) binaries.
TrustedBSD is a sub-project of FreeBSD designed to add trusted operating system extensions, targeting the Common Criteria for Information Technology Security Evaluation (see also Orange Book). Its main focuses are working on access control lists, event auditing, extended attributes, mandatory access controls, and fine-grained capabilities. Since access control lists are known to be confronted with the confused deputy problem, capabilities are a different way to avoid this issue. As part of the TrustedBSD project, there is also a port of NSA's FLASK/TE implementation to run on FreeBSD. Many of these trusted extensions have been integrated into the main FreeBSD branch starting at 5.x.
HardenedBSD is a security-focused fork of FreeBSD founded in 2014 by Oliver Pinter and Shawn Webb. The primary changes introduced in HardenedBSD are Address Space Layout Randomization, defaults more suitable for security, a switch to LibreSSL for cryptography, and the base system compiled as Position Independent Executables. 
Solaris is a Unix variant created by Sun Microsystems. Solaris itself is not inherently security-focused. The major portion of the Solaris source code has been released via the OpenSolaris project, mostly under the Common Development and Distribution License. Enhancements to OpenSolaris, both security related and others, are backported to the official Solaris when Sun certifies their quality.
Trusted Solaris is a security-focused version of the Solaris Unix operating system. Aimed primarily at the government computing sector, Trusted Solaris adds detailed auditing of all tasks, pluggable authentication, mandatory access control, additional physical authentication devices, and fine-grained access control. Trusted Solaris is Common Criteria certified. (See  and ) The most recent version, Trusted Solaris 8 (released 2000), received the EAL4 certification level augmented by a number of protection profiles. Telnet was vulnerable to buffer overflow exploits until patched in April 2001.
Solaris 10 and trusted functionalityEdit
Trusted Solaris functionality has now been added to the mainstream version of Solaris. In the 11/06 update to Solaris 10, the Solaris Trusted Extensions feature adds mandatory access control and labelled security. Introduced in the same update, the Secure by Default Networking feature implements less services on by default compared to most previous releases that had most services enabled. RBAC, found in both mainstream Solaris and Trusted Solaris, dramatically lessens the need for using root directly by providing a way for fine grained control over various administrative tasks.
Microsoft Windows ServerEdit
Starting with Windows Server 2008, the server can run in "core" mode. In this mode of operation, the traditional graphical user interface is done away with, and replaced with a Windows command prompt. Roles and software for the server are then installed individually. This serves not only to lessen the strain on system resources produced by unwanted or unneeded applications, but also to reduce the overall "attack surface" of the operating system by virtue of excluding programs that may contain vulnerabilities.
These operating systems are all engineered around a different paradigm of security, object-capabilities, where instead of having the system deciding if an access request should be granted (usually through one or several access control lists), the bundling of authority and designation makes it impossible to request anything not legitimate.
- "Securing Debian Manual". debian.org. Retrieved 19 April 2015.
- "SELinux". debian.org. Retrieved 19 April 2015.
- "Kali Linux Has Been Released!". 2013-03-12. Retrieved 2013-03-18.
- Vervloesem, Koen (2011-04-27). "The Amnesic Incognito Live System: A live CD for anonymity [LWN.net]". lwn.net. Retrieved 2017-06-14.
- "SELinux: бронежилет для корпоративного пингвина" [SELinux: bullet-proof vest for corporate penguin] (in Russian). 6 September 2011. Retrieved 26 October 2011.
- "Redirecting.." qubes-os.org. Retrieved 30 April 2017.
- Dieguez Castro, Jose (2016). Introducing Linux Distros. Apress. p. 350. ISBN 978-1-4842-1393-3.
- "Tin Hat". D'Youville College.
- Porup, J.M. (9 August 2016). "Copperhead OS: The startup that wants to solve Android's woeful security". arstechnica.co.uk. Ars Technica UK.
- Corbet, Jonathan (17 February 2016). "CopperheadOS: Securing the Android". lwn.net.
- Linder, Brad (29 March 2016). "F-Droid, Copperhead, Guardian Project partner to create a security-focused, Android-based ecosystem". liliputing.com.
- "Overview - Replicant". Redmine.replicant.us. Retrieved 2013-09-30.
- Paul Kocialkowski (February 4, 2012). "WikiStart – Replicant". Redmine.replicant.us. Retrieved 2013-09-30.
- "Android and Users' Freedom - GNU Project - Free Software Foundation". Gnu.org. Retrieved 2013-09-30.
- "About". Replicant project. Retrieved 2013-09-30.
- Don Reisinger (13 March 2014). "Samsung Galaxy devices may have backdoor to user data, developer says". CNET. Retrieved 25 April 2014.
- Michael Larabel (12 March 2014). "Replicant Developers Find Backdoor In Android Samsung Galaxy Devices". Phoronix. Retrieved 25 April 2014.
- Paul Kocialkowski. "Samsung Galaxy Back-door". Replicant Wiki. Archived from the original on 6 April 2014. Retrieved 25 April 2014.
- Quinn Norton (January 14, 2006). "Anonyity on a Disc". Wired.com. Retrieved November 6, 2011.
- McIntire, Tim (8 August 2006). "Take a closer look at OpenBSD". IBM. Archived from the original on January 27, 2007. Retrieved 19 February 2015.
- "About|HardenedBSD". hardenedbsd.org. 2016. Retrieved 31 August 2017.
- "Easy Feature Comparison|HardenedBSD". hardenedbsd.org. 2016. Retrieved 31 August 2017.
- "Sun Patch: Trusted Solaris 8 4/01: in.telnet patch". 4 October 2002. Retrieved 13 August 2012.
4734086 in.telnetd vulnerable to buffer overflow ?? (Solaris bug 4483514)
- "What is Server Core?". Microsoft TechNet. Microsoft Corporation. Retrieved 17 October 2013.