Why a NoWayOS device has no shell

Most attacks on a dedicated device don't go after the job it does. They go after the rest of the computer it runs on: the shell left in for maintenance, the remote-access service nobody switched off, the browser behind the application, the desktop one crash away.

That "rest of the computer" is everywhere. The gateway that carries readings out of a water works, the terminal in a power network's control room, the devices a hospital relies on, the panel on the side of a machine, the screen in a station concourse: many of them run a general-purpose operating system with one job on top, and everything else still there underneath, switched off by settings. Kiosk mode is the simplest version. Every compromise is someone finding the one setting that was missed.

Leave it out instead

NoWayOS starts from the other end. A NoWayOS image holds the device's application, the drivers that application uses, and the seL4 microkernel. That's the whole list.

There's no shell to drop into, because no shell was ever built in. No remote login to guess a password for. No desktop to escape to. No browser engine waiting for a malicious page. You can't misconfigure a setting for software that isn't there.

All of that is about the operating system. The application on top is another matter: it can sign its users in, and sign in to other systems, whenever its job calls for it. What it doesn't sit on is an operating system anyone can log in to.

We call that a Single Purpose OS: a computer with nothing else to do.

And what is there is sealed

Leaving things out is half of it. Each part that remains (the network, the screen, the input, the application) runs in a compartment of its own, a protection domain in seL4's terms, and reaches only what it was granted. The network driver moves packets. The display driver draws. The application talks to each through fixed-size messages.

Every grant is written down in a file, one fact per line, and the build fails if the system and the file disagree. It's built so that a fault in one part stays in that part.

"But how do you fix it without a shell?"

Engineers ask this first, and fairly. You don't log in to the operating system of a NoWayOS device: it has no accounts, so there's no one to log in as. You build a new image and replace the old one. Today that means building it and loading it onto the board; signed updates, checked by the device and able to fall back safely, are designed and on their way.

What you get in return is a device that starts straight into its one job, with far less to patch and far less to attack. For the systems a country runs on, that trade is the whole point.

See for yourself

The evidence for one real NoWayOS image, its grants file, its bill of materials and its seL4 configuration record, is on our security page. No sign-up, no script. Just the files.