# Peios Kernel (PKM)

> The Peios kernel as it is built: the KMES event subsystem, the KACS access control system, the stratafs layered filesystem, and the LCS registry.

The whole book as one markdown file: [/peios/advanced-peios/peios-kernel/print.md](/peios/advanced-peios/peios-kernel/print.md)

Contents:

- 1 [Introduction](/peios/advanced-peios/peios-kernel/introduction/overview.md)
    - 1.1 [Overview](/peios/advanced-peios/peios-kernel/introduction/overview.md)
- 2 [KMES](/peios/advanced-peios/peios-kernel/kmes/overview.md)
    - 2.1 [Overview](/peios/advanced-peios/peios-kernel/kmes/overview.md)
    - 2.2 [Event Model](/peios/advanced-peios/peios-kernel/kmes/event-model.md)
    - 2.3 [Emission API](/peios/advanced-peios/peios-kernel/kmes/emission-api.md)
    - 2.4 [Syscall Interface](/peios/advanced-peios/peios-kernel/kmes/syscall-interface.md)
    - 2.5 [Ring Buffers](/peios/advanced-peios/peios-kernel/kmes/ring-buffers.md)
    - 2.6 [Self-Configuration](/peios/advanced-peios/peios-kernel/kmes/self-configuration.md)
    - 2.7 [Failure Modes](/peios/advanced-peios/peios-kernel/kmes/failure-modes.md)
    - Appendix 2.A [KMES ABI Reference](/peios/advanced-peios/peios-kernel/kmes/kmes-abi.md)
    - Appendix 2.B [KMES ABI Notes](/peios/advanced-peios/peios-kernel/kmes/kmes-abi-notes.md)
- 3 [KACS](/peios/advanced-peios/peios-kernel/kacs/overview.md)
    - 3.1 [Overview](/peios/advanced-peios/peios-kernel/kacs/overview.md)
    - 3.2 [Tokens](/peios/advanced-peios/peios-kernel/kacs/tokens/model.md)
        - 3.2.1 [The Token Model](/peios/advanced-peios/peios-kernel/kacs/tokens/model.md)
        - 3.2.2 [Token Structure](/peios/advanced-peios/peios-kernel/kacs/tokens/structure.md)
        - 3.2.3 [Token Lifecycle](/peios/advanced-peios/peios-kernel/kacs/tokens/lifecycle.md)
        - 3.2.4 [Token Creation](/peios/advanced-peios/peios-kernel/kacs/tokens/creation.md)
        - 3.2.5 [Token Adjustment](/peios/advanced-peios/peios-kernel/kacs/tokens/adjustment.md)
        - 3.2.6 [Linked Tokens and Elevation](/peios/advanced-peios/peios-kernel/kacs/tokens/elevation.md)
        - 3.2.7 [LogonSessions and Revocation](/peios/advanced-peios/peios-kernel/kacs/tokens/logon-sessions.md)
        - 3.2.8 [Token Access Rights](/peios/advanced-peios/peios-kernel/kacs/tokens/access-rights.md)
    - 3.3 [The Process Security Block](/peios/advanced-peios/peios-kernel/kacs/process-security-block/model.md)
        - 3.3.1 [The PSB Model](/peios/advanced-peios/peios-kernel/kacs/process-security-block/model.md)
        - 3.3.2 [PSB Fields](/peios/advanced-peios/peios-kernel/kacs/process-security-block/fields.md)
        - 3.3.3 [Process Security Descriptors](/peios/advanced-peios/peios-kernel/kacs/process-security-block/process-security-descriptors.md)
        - 3.3.4 [PSB Lifecycle](/peios/advanced-peios/peios-kernel/kacs/process-security-block/lifecycle.md)
    - 3.4 [Privileges](/peios/advanced-peios/peios-kernel/kacs/privileges/model.md)
        - 3.4.1 [The Privilege Model](/peios/advanced-peios/peios-kernel/kacs/privileges/model.md)
        - 3.4.2 [Privilege Catalogue](/peios/advanced-peios/peios-kernel/kacs/privileges/catalogue.md)
    - 3.5 [Impersonation](/peios/advanced-peios/peios-kernel/kacs/impersonation/levels.md)
        - 3.5.1 [Impersonation Levels](/peios/advanced-peios/peios-kernel/kacs/impersonation/levels.md)
        - 3.5.2 [Impersonation Gates](/peios/advanced-peios/peios-kernel/kacs/impersonation/gates.md)
        - 3.5.3 [Impersonation Lifecycle](/peios/advanced-peios/peios-kernel/kacs/impersonation/lifecycle.md)
    - 3.6 [Binary Signature Verification](/peios/advanced-peios/peios-kernel/kacs/signature-verification.md)
    - 3.7 [Process Integrity Protection](/peios/advanced-peios/peios-kernel/kacs/process-integrity-protection.md)
    - 3.8 [AccessCheck](/peios/advanced-peios/peios-kernel/kacs/access-check/overview.md)
        - 3.8.1 [AccessCheck Overview](/peios/advanced-peios/peios-kernel/kacs/access-check/overview.md)
        - 3.8.2 [The DACL Walk](/peios/advanced-peios/peios-kernel/kacs/access-check/dacl-walk.md)
        - 3.8.3 [Mandatory Integrity Control](/peios/advanced-peios/peios-kernel/kacs/access-check/integrity.md)
        - 3.8.4 [Restricted Tokens](/peios/advanced-peios/peios-kernel/kacs/access-check/restricted-tokens.md)
        - 3.8.5 [Object ACEs and Property-Level Access](/peios/advanced-peios/peios-kernel/kacs/access-check/object-aces.md)
        - 3.8.6 [Application Confinement](/peios/advanced-peios/peios-kernel/kacs/access-check/confinement.md)
        - 3.8.7 [PIP in AccessCheck](/peios/advanced-peios/peios-kernel/kacs/access-check/pip.md)
        - 3.8.8 [Central Access and Auditing Policy](/peios/advanced-peios/peios-kernel/kacs/access-check/central-access-policy.md)
        - 3.8.9 [Auditing in AccessCheck](/peios/advanced-peios/peios-kernel/kacs/access-check/auditing.md)
        - 3.8.10 [The Algorithm](/peios/advanced-peios/peios-kernel/kacs/access-check/the-algorithm.md)
    - 3.9 [FACS](/peios/advanced-peios/peios-kernel/kacs/facs/handle-model.md)
        - 3.9.1 [The Handle Model](/peios/advanced-peios/peios-kernel/kacs/facs/handle-model.md)
        - 3.9.2 [KACS-Native Open](/peios/advanced-peios/peios-kernel/kacs/facs/native-open.md)
        - 3.9.3 [Legacy Open Compatibility](/peios/advanced-peios/peios-kernel/kacs/facs/legacy-open.md)
        - 3.9.4 [Use-Time Semantics](/peios/advanced-peios/peios-kernel/kacs/facs/use-time.md)
        - 3.9.5 [File Descriptor Storage](/peios/advanced-peios/peios-kernel/kacs/facs/descriptor-storage.md)
        - 3.9.6 [The Set-Security Interface](/peios/advanced-peios/peios-kernel/kacs/facs/set-security.md)
        - 3.9.7 [The StrataFS Copy-Up Context](/peios/advanced-peios/peios-kernel/kacs/facs/stratafs-copy-up.md)
    - 3.10 [The Linux Credential Model](/peios/advanced-peios/peios-kernel/kacs/linux-credentials/credential-projection.md)
        - 3.10.1 [Credential Projection](/peios/advanced-peios/peios-kernel/kacs/linux-credentials/credential-projection.md)
        - 3.10.2 [DAC Neutralisation](/peios/advanced-peios/peios-kernel/kacs/linux-credentials/dac-neutralisation.md)
        - 3.10.3 [setuid Behaviour](/peios/advanced-peios/peios-kernel/kacs/linux-credentials/setuid.md)
    - Appendix 3.A [KACS ABI Reference](/peios/advanced-peios/peios-kernel/kacs/kacs-abi.md)
    - Appendix 3.B [Departures from MS-DTYP](/peios/advanced-peios/peios-kernel/kacs/ms-dtyp-divergences.md)
    - Appendix 3.C [Audit Event Schemas](/peios/advanced-peios/peios-kernel/kacs/audit-events.md)
    - Appendix 3.D [KACS ABI Notes](/peios/advanced-peios/peios-kernel/kacs/kacs-abi-notes.md)
- 4 [stratafs](/peios/advanced-peios/peios-kernel/stratafs/overview.md)
    - 4.1 [Overview](/peios/advanced-peios/peios-kernel/stratafs/overview.md)
    - 4.2 [Strata and Mounting](/peios/advanced-peios/peios-kernel/stratafs/strata-and-mounting/the-stratum-stack.md)
        - 4.2.1 [The Stratum Stack](/peios/advanced-peios/peios-kernel/stratafs/strata-and-mounting/the-stratum-stack.md)
        - 4.2.2 [Mount Options](/peios/advanced-peios/peios-kernel/stratafs/strata-and-mounting/mount-options.md)
        - 4.2.3 [Mount Admission](/peios/advanced-peios/peios-kernel/stratafs/strata-and-mounting/mount-admission.md)
        - 4.2.4 [Absent Strata](/peios/advanced-peios/peios-kernel/stratafs/strata-and-mounting/absent-strata.md)
    - 4.3 [Name Resolution](/peios/advanced-peios/peios-kernel/stratafs/name-resolution/lookup.md)
        - 4.3.1 [Lookup](/peios/advanced-peios/peios-kernel/stratafs/name-resolution/lookup.md)
        - 4.3.2 [Directory Merge](/peios/advanced-peios/peios-kernel/stratafs/name-resolution/directory-merge.md)
        - 4.3.3 [Type Conflicts](/peios/advanced-peios/peios-kernel/stratafs/name-resolution/type-conflicts.md)
        - 4.3.4 [Enumeration](/peios/advanced-peios/peios-kernel/stratafs/name-resolution/enumeration.md)
    - 4.4 [Coherency](/peios/advanced-peios/peios-kernel/stratafs/coherency/the-model.md)
        - 4.4.1 [The Coherency Model](/peios/advanced-peios/peios-kernel/stratafs/coherency/the-model.md)
        - 4.4.2 [Revalidation](/peios/advanced-peios/peios-kernel/stratafs/coherency/revalidation.md)
        - 4.4.3 [Inode Identity and Lifecycle](/peios/advanced-peios/peios-kernel/stratafs/coherency/inode-identity.md)
    - 4.5 [Mutation](/peios/advanced-peios/peios-kernel/stratafs/mutation/write-routing.md)
        - 4.5.1 [Write Routing](/peios/advanced-peios/peios-kernel/stratafs/mutation/write-routing.md)
        - 4.5.2 [Copy-Up](/peios/advanced-peios/peios-kernel/stratafs/mutation/copy-up.md)
        - 4.5.3 [Creation](/peios/advanced-peios/peios-kernel/stratafs/mutation/creation.md)
        - 4.5.4 [Removal](/peios/advanced-peios/peios-kernel/stratafs/mutation/removal.md)
        - 4.5.5 [Rename](/peios/advanced-peios/peios-kernel/stratafs/mutation/rename.md)
        - 4.5.6 [Links](/peios/advanced-peios/peios-kernel/stratafs/mutation/links.md)
        - 4.5.7 [Locking](/peios/advanced-peios/peios-kernel/stratafs/mutation/locking.md)
        - 4.5.8 [Durability and Accounting](/peios/advanced-peios/peios-kernel/stratafs/mutation/durability.md)
    - 4.6 [Security](/peios/advanced-peios/peios-kernel/stratafs/security/delegation.md)
        - 4.6.1 [Access Check Delegation](/peios/advanced-peios/peios-kernel/stratafs/security/delegation.md)
        - 4.6.2 [Checks on Merged Directories](/peios/advanced-peios/peios-kernel/stratafs/security/merged-directory-checks.md)
        - 4.6.3 [Descriptors on Copy-Up](/peios/advanced-peios/peios-kernel/stratafs/security/copy-up-descriptors.md)
        - 4.6.4 [Mount Policy](/peios/advanced-peios/peios-kernel/stratafs/security/mount-policy.md)
        - 4.6.5 [Audit](/peios/advanced-peios/peios-kernel/stratafs/security/audit.md)
    - 4.7 [The Origin Attribute](/peios/advanced-peios/peios-kernel/stratafs/the-origin-attribute.md)
    - 4.8 [Failure Modes](/peios/advanced-peios/peios-kernel/stratafs/failure-modes.md)
    - Appendix 4.A [Constants](/peios/advanced-peios/peios-kernel/stratafs/constants.md)
- 5 [LCS](/peios/advanced-peios/peios-kernel/lcs/overview.md)
    - 5.1 [Overview](/peios/advanced-peios/peios-kernel/lcs/overview.md)
    - 5.2 [The Data Model](/peios/advanced-peios/peios-kernel/lcs/the-data-model/hives-and-routing.md)
        - 5.2.1 [Hives and Routing](/peios/advanced-peios/peios-kernel/lcs/the-data-model/hives-and-routing.md)
        - 5.2.2 [Private Hives](/peios/advanced-peios/peios-kernel/lcs/the-data-model/private-hives.md)
        - 5.2.3 [Keys](/peios/advanced-peios/peios-kernel/lcs/the-data-model/keys.md)
        - 5.2.4 [Symlinks](/peios/advanced-peios/peios-kernel/lcs/the-data-model/symlinks.md)
        - 5.2.5 [Path Entries](/peios/advanced-peios/peios-kernel/lcs/the-data-model/path-entries.md)
        - 5.2.6 [Values](/peios/advanced-peios/peios-kernel/lcs/the-data-model/values.md)
        - 5.2.7 [Tombstones](/peios/advanced-peios/peios-kernel/lcs/the-data-model/tombstones.md)
        - 5.2.8 [Names and Case](/peios/advanced-peios/peios-kernel/lcs/the-data-model/names-and-case.md)
        - 5.2.9 [Deletion and Orphans](/peios/advanced-peios/peios-kernel/lcs/the-data-model/deletion-and-orphans.md)
    - 5.3 [Layers](/peios/advanced-peios/peios-kernel/lcs/layers/the-layer-model.md)
        - 5.3.1 [The Layer Model](/peios/advanced-peios/peios-kernel/lcs/layers/the-layer-model.md)
        - 5.3.2 [The Base Layer](/peios/advanced-peios/peios-kernel/lcs/layers/the-base-layer.md)
        - 5.3.3 [Layer Metadata](/peios/advanced-peios/peios-kernel/lcs/layers/layer-metadata.md)
        - 5.3.4 [Writing Into a Layer](/peios/advanced-peios/peios-kernel/lcs/layers/layer-authorization.md)
        - 5.3.5 [Private Layers](/peios/advanced-peios/peios-kernel/lcs/layers/private-layers.md)
        - 5.3.6 [Resolution](/peios/advanced-peios/peios-kernel/lcs/layers/resolution.md)
        - 5.3.7 [The Sequence Counter](/peios/advanced-peios/peios-kernel/lcs/layers/the-sequence-counter.md)
    - 5.4 [Security](/peios/advanced-peios/peios-kernel/lcs/security/the-access-flow.md)
        - 5.4.1 [The Access Flow](/peios/advanced-peios/peios-kernel/lcs/security/the-access-flow.md)
        - 5.4.2 [Access Rights](/peios/advanced-peios/peios-kernel/lcs/security/access-rights.md)
        - 5.4.3 [Inheritance and Hive Roots](/peios/advanced-peios/peios-kernel/lcs/security/inheritance-and-hive-roots.md)
        - 5.4.4 [Audit](/peios/advanced-peios/peios-kernel/lcs/security/audit.md)
    - 5.5 [The Syscall Interface](/peios/advanced-peios/peios-kernel/lcs/the-syscall-interface/the-fd-model.md)
        - 5.5.1 [The Fd Model](/peios/advanced-peios/peios-kernel/lcs/the-syscall-interface/the-fd-model.md)
        - 5.5.2 [Syscalls](/peios/advanced-peios/peios-kernel/lcs/the-syscall-interface/syscalls.md)
        - 5.5.3 [Key Ioctls](/peios/advanced-peios/peios-kernel/lcs/the-syscall-interface/key-ioctls.md)
        - 5.5.4 [Transaction Ioctls](/peios/advanced-peios/peios-kernel/lcs/the-syscall-interface/transaction-ioctls.md)
        - 5.5.5 [The Error Model](/peios/advanced-peios/peios-kernel/lcs/the-syscall-interface/the-error-model.md)
    - 5.6 [Watches](/peios/advanced-peios/peios-kernel/lcs/watches/the-model.md)
        - 5.6.1 [The Watch Model](/peios/advanced-peios/peios-kernel/lcs/watches/the-model.md)
        - 5.6.2 [Event Records](/peios/advanced-peios/peios-kernel/lcs/watches/event-records.md)
        - 5.6.3 [Dispatch](/peios/advanced-peios/peios-kernel/lcs/watches/dispatch.md)
        - 5.6.4 [Queues and Overflow](/peios/advanced-peios/peios-kernel/lcs/watches/queues-and-overflow.md)
    - 5.7 [Transactions](/peios/advanced-peios/peios-kernel/lcs/transactions/scope-and-lifetime.md)
        - 5.7.1 [Scope and Lifetime](/peios/advanced-peios/peios-kernel/lcs/transactions/scope-and-lifetime.md)
        - 5.7.2 [Isolation and the Mutation Log](/peios/advanced-peios/peios-kernel/lcs/transactions/isolation-and-the-mutation-log.md)
        - 5.7.3 [Commit and Failure](/peios/advanced-peios/peios-kernel/lcs/transactions/commit-and-failure.md)
    - 5.8 [Sources](/peios/advanced-peios/peios-kernel/lcs/sources/the-source-model.md)
        - 5.8.1 [The Source Model](/peios/advanced-peios/peios-kernel/lcs/sources/the-source-model.md)
        - 5.8.2 [Registration and Slots](/peios/advanced-peios/peios-kernel/lcs/sources/registration-and-slots.md)
        - 5.8.3 [Request Dispatch](/peios/advanced-peios/peios-kernel/lcs/sources/request-dispatch.md)
        - 5.8.4 [Validation](/peios/advanced-peios/peios-kernel/lcs/sources/validation-and-trust.md)
        - 5.8.5 [Failure and Late Responses](/peios/advanced-peios/peios-kernel/lcs/sources/failure-and-late-responses.md)
    - 5.9 [Backup and Restore](/peios/advanced-peios/peios-kernel/lcs/backup-and-restore/the-stream.md)
        - 5.9.1 [The Stream](/peios/advanced-peios/peios-kernel/lcs/backup-and-restore/the-stream.md)
        - 5.9.2 [Backup](/peios/advanced-peios/peios-kernel/lcs/backup-and-restore/backup.md)
        - 5.9.3 [Restore](/peios/advanced-peios/peios-kernel/lcs/backup-and-restore/restore.md)
    - 5.10 [Bootstrap and Self-Configuration](/peios/advanced-peios/peios-kernel/lcs/bootstrap/the-bootstrap-problem.md)
        - 5.10.1 [The Bootstrap Problem](/peios/advanced-peios/peios-kernel/lcs/bootstrap/the-bootstrap-problem.md)
        - 5.10.2 [The Boot Sequence](/peios/advanced-peios/peios-kernel/lcs/bootstrap/the-boot-sequence.md)
        - 5.10.3 [Operational Parameters](/peios/advanced-peios/peios-kernel/lcs/bootstrap/operational-parameters.md)
        - 5.10.4 [The Self-Watch](/peios/advanced-peios/peios-kernel/lcs/bootstrap/the-self-watch.md)
    - Appendix 5.A [LCS ABI Reference](/peios/advanced-peios/peios-kernel/lcs/lcs-abi.md)
    - Appendix 5.B [LCS ABI Notes](/peios/advanced-peios/peios-kernel/lcs/lcs-abi-notes.md)
