Maze Linux / Features

What makes Maze different.

Arch, hardened out of the box: security in layers, privacy by default, and a system that can roll back when something breaks.

Defense in depth

Security isn't one feature — it's rings of protection, from the hardware up. Most layers are active from first boot; the rest are one click away.

• Hardware & Boot (Root of trust): Secure Boot, Full-disk encryption, USBGuard (optional), Signed kernel image
• Kernel & System (Hardened core): Kernel lockdown & LSMs, AppArmor (enforcing), auditd, sysctl hardening
• Network (Perimeter): firewalld, Maze Guard, Encrypted DNS (Firefox · Entropy Shield), mDNS/LLMNR off
• Privacy & Anonymity (Identity): Tor, Proton VPN, MAC randomization (optional), Tor Browser
• Applications (Sandbox): QLAM antivirus, Firejail, Curated repos, Signed packages

Break it, and come back.

The thing people fear about a rolling release is an update that breaks the system. Maze prepares the way back before every update.

• Always a second kernel — Maze keeps two kernels: the current one and the long-term-support one. If the current kernel will not boot, you pick the recovery kernel from the boot menu — already installed, built and signed.
• A snapshot before every update — A btrfs snapshot is taken before and after every pacman transaction. If an update breaks something, you can see exactly what changed and undo it.
• Checked before you reboot — After every update the whole boot chain is verified — kernel image, signature, encrypted-disk unlock. If something is wrong, the system warns you before you shut down and tells you what it is.
• Was it Maze, or the hardware? — When your machine freezes, maze-doctor tells you why: a USB device that vanished, a disk that stopped answering, overheating — or a real software fault. No more hours spent looking in the wrong place.

Maze vs other distros

Arch gives you parts; Ubuntu and Fedora give you a plain desktop. Maze gives you a hardened, AI-ready workstation on first boot — and keeps Arch's rolling release, AUR and full control.

	Stock Arch	Ubuntu	Fedora	Maze Linux
Out of the box	Minimal base, no GUI	Full GNOME desktop	Full GNOME desktop	Complete KDE Plasma Wayland desktop
Installation	Manual / generic archinstall	Graphical installer	Anaconda installer	Install Maze Linux (Calamares)
Security	You configure it	AppArmor on, firewall off	SELinux on, firewall on	AppArmor, firewall, auditd, Maze Guard on by default
Privacy	You configure it	Telemetry opt-out	No telemetry by default	Tor, Proton VPN preconfigured; MAC randomization one click away
AI tooling	None	None	None	Ollama + AI utilities + dev toolchain
Live ISO	Console rescue shell	Full desktop	Full desktop	Full desktop, testable live & offline
Antivirus	None	None	None	QLAM (YARA, MalwareBazaar)
Release model	Rolling	6-month / LTS	6-month	Rolling, Arch-based
Package manager	pacman + AUR	apt	dnf	pacman + AUR + Maze tools