System Plane (FreeBSD)

The premier 4.4BSD Unix userland, Capsicum security framework, and ZFS storage engine for Synrc Virtualization Environment VE OS.1.

FreeBSD Guest Environment

The FreeBSD System Plane provides a high-assurance, enterprise-grade 4.4BSD-Lite2 derived UNIX guest environment for OS.1. Utilizing Capsicum capability mode sandboxing, FreeBSD Jails, OpenZFS 128-bit storage, bhyve hypervisor primitives, and kqueue event scheduling, it delivers unrivaled networking performance and security compliance.

FREEBSD & CAPSICUM

Fine-grained capability-based security framework restricting process syscalls and file descriptor rights inside capability sandboxes.

/* Capsicum Sandbox Mode */
cap_rights_t rights;
cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT);
cap_rights_limit(fd, &rights);
cap_enter(); /* Enter capability sandbox */

OPENZFS & GELI ENCRYPTION

128-bit storage engine featuring copy-on-write transactions, end-to-end data integrity checksums, atomic snapshots, and disk encryption.

# FreeBSD ZFS Pool & GELI Encryption
geli init -s 4096 -e AES-XTS -l 256 /dev/vtbd1
geli attach /dev/vtbd1
zpool create -O compression=lz4 tank /dev/vtbd1.eli

JAILS & VIMAGE NETWORK

OS-level lightweight container virtualization with isolated process trees, memory boundaries, and virtualized network stacks (VNET/VIMAGE).

# FreeBSD Jail Execution
jail -c name=sandbox path=/usr/jails/app \
  host.hostname=app.local ip4.addr=192.168.1.50 \
  exec.start="/bin/sh /etc/rc"

KQUEUE & VIRTIO

High-performance event notification mechanism paired with VirtIO network and disk drivers for low-overhead hypervisor guest execution.

/* kqueue Event Loop */
int kq = kqueue();
EV_SET(&ev, fd, EVFILT_READ, EV_ADD | EV_ENABLE, 0, 0, NULL);
kevent(kq, &ev, 1, &ev_out, 1, NULL);

Security & Kernel

  • CAPSICUM — Process capability sandboxing
  • JAILS — Lightweight container virtualization
  • MAC — Mandatory Access Control policy framework
  • KQUEUE — Scalable I/O event notification

Networking & Storage

  • OPENZFS — 128-bit file system & snapshots
  • VIMAGE — Virtualized TCP/IP network stack
  • PF & IPFW — Stateful packet filtering firewall
  • BHYVE — BSD micro-hypervisor primitives

Specification & Architecture

0. FreeBSD 14.x / 4.4BSD Architecture

The complete FreeBSD system architecture is structured around modular kernel subsystems, Capsicum capability enforcement, and enterprise networking primitives:

FREEBSD SPEC

FREEBSD CODE POLICY

1. VirtIO & Hypervisor Handoff

When running as a System Plane image in Synrc VE OS.1, FreeBSD boots via Limine, TianoCore EDK II, or native FreeBSD Loader inside raw seL4 Protection Domains (PDs). Storage and network devices route through VirtIO-Block (vtbd) and VirtIO-Net (vtnet) drivers with Capsicum capability enforcement.