Is Maze Linux based on Arch?

Yes. Maze Linux is built on Arch Linux and follows a rolling-release model, so you always get current packages. You get Arch's power without the manual assembly — a complete, hardened KDE Plasma 6 desktop is ready on first boot.

Do I have to configure the security and privacy tools myself?

No. AppArmor, the firewall, Maze Guard, auditd, Tor and VPN are already set up out of the box. Things that change how you appear on a network, like MAC randomization in Maze Cloak, are off until you switch them on. Local AI via Ollama is also ready to run, fully offline.

Can I try it without installing?

Yes. Maze ships as a Live ISO — boot it from USB and try the full desktop before installing. When you're ready, a guided installer sets it up in minutes.

Does Maze Linux collect any telemetry?

No. Maze has zero telemetry — nothing phones home and there is no tracking. Privacy is the default, not an option you have to turn on.

What are the hardware requirements?

A 64-bit (x86-64) CPU with UEFI (no BIOS/Legacy), at least 4 GB of RAM (8 GB recommended, 16 GB for local AI) and 40 GB of disk space. Secure Boot and full-disk encryption are supported.

Is it free and open source?

Yes. Maze Linux is free to download and use, and built on open-source software. Maze's own tools are free software (GPL-3.0, AGPL-3.0, MIT). A few third-party apps it ships, such as Steam and Discord, are proprietary.

Maze Linux / Wiki

Kernel Management

Maze always keeps two kernels installed:

Kernel	Role
`linux`	Current Arch kernel — the one you normally boot
`linux-lts`	Long-term-support kernel — kept for recovery

When a bad update arrives, the second kernel is already installed, built and signed. You do not have to download or repair anything to get back in — you pick it from the boot menu. See If the System Won't Boot.

Both kernels are sealed into signed Unified Kernel Images, so both boot with Secure Boot enabled.

Checking what is installed

pacman -Q linux linux-lts

Choosing the default kernel

Maze Kernel Switcher

Graphical: Maze Kernel Switcher (maze-kernel), in the application menu. It can also install or remove the other supported kernels — linux-zen and linux-hardened — and asks for your administrator password for every change.

From a terminal:

sudo maze-kernel-helper set-default linux-lts   # the GUI normally does this for you
sudo maze-kernel-helper clear-default           # back to "newest mainline kernel"

The choice is stored in /etc/maze/kernel-default and survives updates — Maze will not silently switch you back. Without a pinned choice, the newest installed mainline kernel is the default and linux-lts is the recovery entry.

Why the ESP needs room

Each kernel is stored as a single signed image of roughly 90 MB. The ESP holds one per installed kernel (EFI/Linux/), the boot copy (EFI/BOOT/grubx64.efi), the recovery copy (EFI/maze-recovery/) and the previous image as a fallback (grubx64.efi.maze-prev). If space runs short Maze drops the recovery copy first rather than risk a failed update. A 512 MB EFI System Partition is tight; 1 GB or more is comfortable. If your ESP is too small, maze-boot-check will say so rather than failing silently at the next update.

See also: Updating · Secure Boot · Diagnostics

Prefer the GUI. maze-kernel-helper is the privileged backend that the Kernel Switcher calls through pkexec. Running it directly works, but the supported path is maze-kernel.