Protocol 7 — LainOS Layer 02 System

Init-Agnostic Compatibility Architecture for OpenRC on Arch Linux (Single-User Desktop Stack)

---

Protocol 7 is not in a position to own your whole system. systemd, by contrast, is.

---

Overview

Protocol 7 is a minimal, interface-level compatibility layer and system architecture designed to run Arch Linux without systemd while preserving broad compatibility with AUR software.

It does not replace systemd and does not emulate full systemd behavior.

Instead, it provides a controlled compatibility surface that satisfies common systemd expectations in user applications while the system itself runs on a non-systemd init and IPC stack.

Protocol 7 eliminates roughly 1.28 million lines of systemd's codebase (verified via cloc against upstream) while retaining only systemd-libs for ABI compatibility.

The goal is simple:

Run a usable, modern desktop system (Wayland + AUR ecosystem) without systemd.

---

Security

Protocol 7 Core was developed with LLM assistance and has not undergone a formal security audit. Despite this, there is concrete evidence that it is more secure than the systemd stack it replaces.

Fuzz Testing

The two Protocol 7 daemons that process external, untrusted input have both been fuzz tested and hardened:

• lainos-dbus-bridge ~ the org.freedesktop.login1 D-Bus facade ~ fuzzed with dfuzzer 2.6 against the full interface (Exit status: 0, all methods and properties PASS) and an AddressSanitizer instrumented build (Exit status: 0, no memory errors detected). A systematic pointer type bug was found and fixed in 5.5.3-12, affecting seven methods and properties. All fixed.
• lainos-notifyd ~ the sd_notify UNIX socket sink ~ fuzzed with a libFuzzer harness (clang-18, ASan+UBSan) targeting the message-parsing path. 2,000,000 executions, coverage plateaued, zero crashes, zero leaks.

Why Protocol 7 Has a Smaller Attack Surface Than systemd

• Attack surface: ~1.28 million lines of systemd replaced by 1,871 of fuzz-tested C
• Privilege: All Protocol 7 daemons drop to nobody within seconds of startup. systemd-logind runs as root for the lifetime of the system
• Network exposure: Protocol 7 has no network-facing components. systemd-resolved has had real remote code execution CVEs
• Real CVEs in systemd: Remote code execution in systemd-resolved, local privilege escalation in systemd-logind ~ documented, public vulnerabilities affecting millions of production systems

Damage Ceiling

Even if a vulnerability were found and exploited in Protocol 7, the realistic worst case is a crashed desktop session that doesn't interrupt running apps. The bridge runs as nobody with a tight seccomp filter. There is no privilege escalation path. Recovery is a single command.

Exploiting Protocol 7 requires an attacker to already have a shell running as the logged-in user, or a malicious package installed with the user's consent ~ at which point crashing a session daemon is the least of the user's concerns.

Signed Package Repositories

Both protocol_7_repo and lainos_repo use SigLevel = Required. All packages and databases are signed with the LainOS maintainer PGP key. The lainos-keyring package ships the public key so pacman can verify the full trust chain automatically. The entire build chain runs on a single maintainer-controlled machine with no CI/CD infrastructure ~ no build bot supply chain attack surface.

---

Design Philosophy

Protocol 7 is built on three strict principles:

1. Interface over Implementation

Only the expected surface of systemd is provided:

• libraries
• return values
• D-Bus endpoints
• filesystem paths

No full subsystem logic is implemented.

2. Single-User Assumption

The system assumes:

• 1 user
• 1 session
• 1 seat (seat0)
• no session switching
• no multi-user runtime coordination

This eliminates logind-class complexity entirely and reduces attack surface.

3. Real System + Minimal Compatibility Layer

Protocol 7 is layered on top of a real system:

• Init: OpenRC
• IPC: dbus-openrc
• Session: seatd
• Compositor: Sway (Wayland)
• systemd libraries: systemd-libs (real, for ABI compatibility)

---

Library Strategy

Protocol 7 uses real systemd-libs for ABI compatibility. This is not a transitional state ~ it is the permanent design. Real libraries are simpler than mocks, and the ABI compatibility story is cleaner.

Library	Status	Notes
libsystemd.so.0	Real (systemd-libs)	Provides actual systemd symbols
libudev.so.1	Real (systemd-libs)	Provides actual udev symbols
libdbus-1.so.3	Real (dbus)	Standard D-Bus library

Mock libraries (liblainos-systemd-mock, liblainos-dbus-mock) were removed in v5.5. They are no longer shipped.

---

System Scope

Supported Environment

Protocol 7 is designed for:

• Wayland-based desktop (Sway)
• AUR-heavy workflows
• Electron / Chromium applications
• PipeWire audio stacks
• CLI and developer tooling

Explicitly Out of Scope

• KDE Plasma, GNOME, Cinnamon (logind/polkit dependency)
• systemd-based services (systemctl)
• journald, systemd-resolved, systemd-homed
• multi-seat or multi-user systems

---

Architecture

Protocol 7 consists of four layers:

Layer 0 ~ Base System (Real OS)

• Init: OpenRC
• IPC: dbus-openrc
• Session: seatd
• Audio: PipeWire / WirePlumber
• Networking: iwd + openresolv
• Privilege: doas
• systemd libraries: systemd-libs (real, for ABI)

This layer is fully real and authoritative.

Layer 1 ~ ABI Compatibility Layer

• systemd-libs (real) ~ AUR packages link against libsystemd.so.0 and libudev.so.1
• No mock libraries ~ removed in v5.5

Layer 2 ~ Runtime Compatibility Layer

Component	Function
lainos-dbus-bridge	org.freedesktop.login1 D-Bus facade ~ fuzz tested, runs as nobody
lainos-notifyd	Absorbs sd_notify messages ~ logged via syslog, fuzz tested
lainos-ghost-units	Creates /run/systemd/* ghost directories at boot

Layer 3 ~ Session & Initialization Layer

Component	Function
lainos-init	Session environment setup, execs Sway; launches lainos-audio-init
lainos-audio-init	PipeWire + WirePlumber orchestration

Layer 4 ~ Policy & Integrity Layer

• pacman.conf restrictions ~ systemd packages blocked by dummy packages
• systemd=1:999 provided by protocol7-core ~ satisfies any systemd>=X dependency permanently
• Installation sealing via Calamares shellprocess-final

---

Boot Chain

1. BIOS/UEFI ~ GRUB/Syslinux ~ kernel + initramfs
   ~ Kernel cmdline: init=/sbin/openrc-init

2. Dracut initramfs
   ~ dmsquash-live mounts squashfs as root
   ~ execs /sbin/openrc-init

3. OpenRC sysinit runlevel
   ~ dbus ~ D-Bus system bus
   ~ lainos-notifyd ~ sd_notify sink
   ~ lainos-machine-id ~ ephemeral machine-id

4. OpenRC boot runlevel
   ~ cgroup-delegate ~ cgroup v2 controller delegation
   ~ lainos-ghost-units ~ creates /run/systemd/* ghost dirs
   ~ syslog-ng ~ system logging

5. OpenRC default runlevel
   ~ seatd ~ seat management
   ~ lainos-dbus-bridge ~ login1 D-Bus facade
   ~ iwd ~ WiFi daemon
   ~ acpid ~ ACPI event handling (lid close ~ swaylock + suspend)
   ~ greetd ~ display manager on TTY1
   ~ polkit, chrony, nftables

6. greetd ~ tuigreet ~ Sway session

7. User login ~ lainos-init
   ~ WAYLAND_DISPLAY=wayland-1, sway
   ~ lainos-audio-init ~ PipeWire + WirePlumber + pipewire-pulse

---

System Hardening

LainOS Layer 02 ships with comprehensive hardening applied by default:

Kernel Parameters

• random.trust_cpu=off ~ CPU RNG not unconditionally trusted
• init_on_alloc=1 ~ zero memory on allocation
• init_on_free=1 ~ zero memory on free
• page_alloc.shuffle=1 ~ randomize page allocator freelist

sysctl Hardening (/etc/sysctl.d/99-lainos-hardening.conf)

• IPv6 disabled ~ prevents VPN/Tor leaks
• SYN flood protection, ICMP redirect rejection, reverse path filtering
• kernel.kptr_restrict=2 ~ kernel pointer exposure restricted
• kernel.dmesg_restrict=1 ~ dmesg restricted to root
• kernel.yama.ptrace_scope=1 ~ ptrace restricted to parent processes
• kernel.kexec_load_disabled=1 ~ kexec disabled
• kernel.unprivileged_userns_clone=0 ~ unprivileged user namespaces disabled
• kernel.randomize_va_space=2 ~ full ASLR
• fs.suid_dumpable=0 ~ core dumps disabled

Applied natively by OpenRC's own sysctl service reading this file at boot ~ not by a dedicated Protocol 7 component.

hardened_malloc

GrapheneOS hardened_malloc (light variant) preloaded via LD_PRELOAD for: alacritty, element, gnome-keyring-daemon, keepassxc, kleopatra, mpv, tor daemon.

Full Disk Encryption

LUKS FDE supported via Calamares (opt-in). Unlock at boot via dracut crypt and crypt-lib modules ~ no systemd-cryptsetup required. Confirmed working on baremetal.

Privacy

• Ephemeral machine-id ~ regenerated every boot
• iwd MAC randomization ~ new MAC per boot
• No systemd-resolved ~ no DNS caching/tracking
• IPv6 disabled by default

---

Compatibility Profile

Works Well

• Electron applications (Element, Signal)
• Chromium / LibreWolf / Firefox
• CLI tooling
• Wayland-native applications
• PipeWire audio stack
• KeePassXC, Kleopatra, GPG tooling
• virt-manager / KVM

Works With Limitations

• Applications querying login1 APIs (handled by lainos-dbus-bridge)

Not Supported

• systemctl-based workflows
• KDE Plasma, GNOME, Cinnamon
• systemd-resolved / journald / homed

---

The LainOS Layer 02 System

Complete supported userland for Protocol 7:

Category	Component	Role
Init	OpenRC	PID 1, service supervision
Initramfs	dracut	Modern initramfs with live boot and LUKS support
Device Mgmt	eudev	Genuine standalone udev implementation
IPC Bus	dbus-openrc	D-Bus system bus with OpenRC integration
Session	seatd	Minimalist seat management for Wayland
Compositor	Sway	Wayland tiling compositor
Login	greetd / tuigreet	TUI greeter with session selection
Status Bar	i3status-rs	Themed status bar
Terminal	alacritty	GPU-accelerated terminal
Notifications	dunst	Notification daemon
Audio	PipeWire / WirePlumber	Modern audio routing
WiFi	iwd	Standalone wireless daemon
DNS	openresolv	resolv.conf management
File Manager	Thunar + gvfs + thunar-volman	File management
Privilege	doas	Minimalist privilege escalation
Browser	LibreWolf	Hardened Firefox fork
Password Manager	KeePassXC	Local encrypted password management
Secrets	gnome-keyring	Secrets service backend for Electron apps
Encryption	Kleopatra / GPG	PGP key management
Firewall	nftables	Default-deny firewall
Tor	tor + torsocks	Anonymity network
ABI Compat	systemd-libs	Real systemd libraries for ABI surface
Memory	hardened_malloc	GrapheneOS allocator on key apps
Keyring	lainos-keyring	LainOS PGP key for repo verification

---

Custom Repo Packages

Both protocol_7_repo and lainos_repo are fully self-hosted on GitLab. All packages are signed with the LainOS maintainer PGP key. No Artix repositories are used.

protocol_7_repo

Package	Type	Purpose
protocol7-core	Real	Core compatibility layer, C daemons, OpenRC service scripts
eudev	Real	Genuine udev implementation, no libudev conflict
lainos-hardened-malloc	Real	GrapheneOS hardened_malloc light variant
lainos-utils	Real	Utility scripts (wifi, tor, kloak, wg-vpn, LESME, etc.)
lainos-keyring	Real	LainOS PGP public key for pacman verification
dbus-openrc	Real	OpenRC service for D-Bus
openrc	Real	Init system and service manager
tor-openrc	Real	OpenRC service for Tor
*-openrc	Real	OpenRC service scripts for acpid, chrony, dhcpcd, greetd, iwd, nftables, seatd, syslog-ng
systemd	Dummy	Blocks real systemd; satisfies dependency chain
systemd-sysvcompat	Dummy	Blocks real sysvcompat
elogind	Dummy	Blocks real elogind
mkinitcpio	Dummy	Blocks mkinitcpio; forces dracut
sudo	Dummy	Blocks real sudo; doas is used instead
libudev	Dummy	Satisfies libudev dependency chain

---

Package Integrity

protocol7-core provides systemd=1:999 ~ epoch 1 ensures Protocol 7 satisfies any systemd>=X dependency permanently regardless of upstream version. No future PKGBUILD changes required.

---

Summary

Protocol 7 is:

A real OpenRC-based Linux system with a minimal compatibility layer ~ the two components that parse untrusted external input are fuzz tested ~ that satisfies systemd-dependent applications without implementing systemd.

---

One-Line Definition

Protocol 7 = Real Linux system + constrained, fuzz-tested systemd compatibility surface for single-user Wayland desktop operation

---

Protocol 7 v5.5.3-19 / LainOS Layer 02 ~ 2026-07-04