Recommended Free Tools
Tetsuharu Fujiki says he left whole-root-filesystem cryptographic protection out of RoamSwitch OS because the available approaches did not fit the project he wanted to build: dm-verity is designed around an immutable block device, while RoamSwitch was based on Arch Linux’s rolling, package-managed system; IMA appraisal looked more compatible with changing files, but the Arch kernel configurations he inspected had IMA disabled. Enabling it would mean maintaining a custom kernel, which conflicted with his goal of composing established tools rather than taking on distribution maintenance.
What RoamSwitch OS was designed to be
In his September 14, 2026 account, Fujiki describes RoamSwitch OS as an early-stage personal hardening project based on Arch Linux, delivered as an installer and live ISO. Its guiding constraint was to build on existing tools, Arch’s rolling package ecosystem, and existing driver support—not to create a new immutable-image distribution or maintain a custom kernel. As Fujiki put it: “The governing principle stayed simple: don’t reinvent tools that already work, build on Arch’s rolling package ecosystem and existing driver support rather than around them.”
As an Amazon Associate I earn from qualifying purchases.
He also described the project as a research and showcase effort, not a production-ready operating system. The choice to omit full-rootfs integrity verification is therefore a project-specific design decision, not a claim that Linux cannot protect a root filesystem cryptographically.
What encryption, integrity checks, and boot trust each do
These controls address different points in a system’s lifecycle. Disk encryption is primarily about confidentiality when a device is powered off or its storage is otherwise unavailable to an attacker. Arch Linux’s Security guidance warns that data on a mounted, unlocked volume is as vulnerable as data on an unencrypted drive. Encryption alone does not show that system files have not been changed.
#1 Best Overall
Integrity mechanisms instead compare or verify system content against an expected state. Whether they prevent altered content from being used, or merely report that it changed, depends on the mechanism and configuration. Neither disk encryption nor a rootfs integrity check, by itself, establishes a trusted boot chain from firmware through the bootloader, kernel, and initramfs.
Arch’s dm-crypt documentation describes configurations involving LUKS, Secure Boot, and TPMs. These are configurable arrangements, not automatic guarantees that every boot component is trustworthy. In systemd’s systemd-cryptenroll(1) documentation, TPM2-bound key release depends on selected Platform Configuration Register (PCR) measurements. The choice of PCRs affects which measured system states can unlock a secret and how updates affect access. A TPM can enforce a configured release condition; it does not independently prove that a running system is free of compromise.
Rank #2
Why dm-verity did not fit the rolling-root design
dm-verity verifies data read from a block device against a cryptographic hash tree. Its natural fit is an image or other block device whose contents are treated as immutable: the expected data and its verification metadata can be built and deployed together. When system packages change, the verified image and its metadata must remain consistent.
Fujiki’s objection was about that update model. RoamSwitch was intended to use Arch’s rolling package system, where packages update files in place on a managed root filesystem. To use dm-verity in this design, the project would need a more substantial image-generation and boot-update workflow. Fujiki judged that a larger architectural change inconsistent with the project’s goals. This is not a general limitation that prevents dm-verity from protecting Linux root filesystems; it is a mismatch between an immutable-block verification model and this project’s intended mutable, package-managed root.
Why IMA appraisal was not a straightforward alternative
Linux Integrity Measurement Architecture (IMA) can measure files and, with appraisal configured, evaluate them against integrity policy. Unlike an immutable whole-device image, that approach can be designed around file-level policy. But availability depends on the kernel build and the policy and key-management setup; the name “Linux” or “Arch” alone does not establish that a given installation has IMA appraisal enabled.
Fujiki reports that, in September 2026, he inspected the configurations for Arch’s standard linux kernel and linux-hardened kernel and found CONFIG_IMA unset in both. That is his finding for those inspected configurations, not a statement about every Arch kernel or every Linux build. He concluded that enabling IMA would require replacing the official kernel packages with a kernel build he would have to maintain. That maintenance burden violated the project’s preference for established distribution components.
How the project scoped integrity monitoring instead
Rather than claim cryptographic verification of the entire root filesystem, Fujiki describes a layered approach: integrity checking on selected system paths, tamper evidence for one incident log, and monitoring with rollback for user data that changes regularly. These measures have different coverage and response characteristics.
| Approach described | Role | Important boundary |
|---|---|---|
| AIDE on selected system paths | Compares covered files with a recorded baseline and can report changes. | Fujiki describes coverage of selected paths, not continuous cryptographic verification of the entire root filesystem. Detection does not itself block altered files from being used. |
| TPM2-based tamper evidence for one incident log | Provides a way to detect tampering with that specific log under the project’s setup. | This is a narrowly scoped example, not evidence that all logs or system files are protected. TPM behavior depends on the configured keys and measurements. |
| Behavior monitoring and rollback for user files | Looks for suspicious activity affecting changeable user data and can support recovery. | Monitoring and rollback are not the same as preventing rootfs modification; the account does not establish independently measured ransomware protection. |
The distinction is operationally useful: a baseline checker can flag that covered content changed, while a behavior monitor can respond to a pattern of activity and initiate recovery. Neither should be described as a substitute for a verified boot chain or as a guarantee against compromise.
What the reported scan times do—and do not—show
Fujiki reports that AIDE scans over a narrow set of paths took 1 to 15 seconds, while a broader scan took 2 minutes 33 seconds. These are the author’s measurements on his project, not a published benchmark or a general estimate for AIDE, another machine, or a full-filesystem scan. Scan time depends on the paths, files, storage, and system involved.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to decide whether a different design is a better fit
The right choice depends less on which mechanism sounds strongest in isolation than on what you need to protect and what system model you can operate reliably. Before adopting one, map it against these questions:
- What threat are you addressing? Data theft from powered-off media, unauthorized changes to system files, an untrusted boot component, and malicious activity after login are distinct problems.
- How does the root change? An immutable image can align naturally with block-device verification. A rolling, package-managed root needs an approach and update process compatible with file changes.
- What is in the trust chain? Identify how firmware, bootloader, kernel, initramfs, root filesystem, and any TPM-unsealed secret are authenticated or measured. A control over one stage does not automatically secure the others.
- Can you sustain the operational work? Account for image generation, signing, kernel maintenance, update failures, key recovery, and testing restoration. A design that cannot be updated or recovered safely may undermine the protection it is meant to provide.
- Does the control prevent or detect? Establish whether it blocks modified content before use, reports a change afterward, or detects behavior and attempts recovery. Treat these outcomes as different guarantees.
Arch’s Security and dm-crypt documentation provide configuration context for encryption, Secure Boot, and TPM use. The Linux kernel’s fscrypt documentation covers filesystem-level encryption; that is a separate confidentiality mechanism, not proof that files have not been altered. For TPM-bound disk-unlocking details and PCR behavior, consult systemd’s systemd-cryptenroll(1) manual.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe reason for leaving full-rootfs verification out
Fujiki did not conclude that cryptographic rootfs protection is inherently unsuitable for Linux. He concluded that the mechanisms he considered imposed a design or maintenance cost that did not fit this early personal project: dm-verity pointed toward an immutable image workflow, while IMA appraisal would require a custom kernel based on the configurations he inspected. He chose narrower checks and monitoring rather than claim a whole-root guarantee that the project’s architecture and maintenance scope did not support.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
