What each trust boundary establishes

This figure documents the historical i386 source baseline. Current native x86-64/AArch64 qualification is recorded separately; this is not an ELF64 or native SMP implementation diagram.

Full-size SVG
What each trust boundary establishes User mappings and the syscall gate separate user processes from kernel privilege. Kernel components themselves share ring 0. Mesh encryption authenticates channel traffic under exchanged keys. A self-derived SPIFFE-shaped identity and advertised signing key are not external workload certification. Signed roots establish cryptographic consistency with a selected key, not the truth of peer claims. Capability checks only enforce operations at actual check sites. user->syscall syscall->kernel kernel->channel message traffic channel->peer message traffic peer->root root->scope user Ring-3 process private user mappings syscall Hardware privilege gate page walk + scoped operation checks kernel Shared ring-0 kernel actors / drivers / filesystem / graph channel Inter-machine encrypted mesh key exchange + authenticated ciphertext peer Peer node self-derived spiffe://slos.local identity root Advertised signing key + signed epoch root scope Verify cryptographic consistency within selected local trust context note No external CA / workload attestation is implied by a SPIFFE-shaped URI. Kernel components share privilege; encryption does not make peer claims true. Capability checks apply where invoked, not a universal isolation guarantee.
What each trust boundary establishes User mappings and the syscall gate separate user processes from kernel privilege. Kernel components themselves share ring 0. Mesh encryption authenticates channel traffic under exchanged keys. A self-derived SPIFFE-shaped identity and advertised signing key are not external workload certification. Signed roots establish cryptographic consistency with a selected key, not the truth of peer claims. Capability checks only enforce operations at actual check sites. user->syscall syscall->kernel kernel->channel message traffic channel->peer message traffic peer->root root->scope user Ring-3 process private user mappings syscall Hardware privilege gate page walk + scoped operation checks kernel Shared ring-0 kernel actors / drivers / filesystem / graph channel Inter-machine encrypted mesh key exchange + authenticated ciphertext peer Peer node self-derived spiffe://slos.local identity root Advertised signing key + signed epoch root scope Verify cryptographic consistency within selected local trust context note No external CA / workload attestation is implied by a SPIFFE-shaped URI. Kernel components share privilege; encryption does not make peer claims true. Capability checks apply where invoked, not a universal isolation guarantee.

Page isolation, encrypted transport and signed evidence establish different, limited claims.

Text equivalent and source references
  • User mappings and the syscall gate separate user processes from kernel privilege. Kernel components themselves share ring 0.
  • Mesh encryption authenticates channel traffic under exchanged keys. A self-derived SPIFFE-shaped identity and advertised signing key are not external workload certification.
  • Signed roots establish cryptographic consistency with a selected key, not the truth of peer claims. Capability checks only enforce operations at actual check sites.

Trust-flow map. Source paths refer to the atlas baseline; the kernel checkout is private.

  • include/memory.h · user pointer validation
  • include/cap.h · cap_require
  • kernel/graph/mesh.c · compute_spiffe_id, handle_handshake
  • kernel/graph/federation.c · signing-key / epoch-root handling

Download SVG · Editable DOT