bootclockrandomization (lainOS layer 02 port)

Randomize the system clock at boot for fingerprinting resistance.

A LainOS Layer 02 / OpenRC port of Kicksecure's bootclockrandomization.

---

What it does

Early in boot, before networking or Tor come up, this shifts the system clock by a small random amount ~ up to ±180 seconds, plus a random nanosecond offset ~ so this machine's clock is never exactly aligned with another machine's during the boot window.

This is a narrow, specific piece of fingerprinting resistance: a system clock that's always corrected the same way, at the same precision, via the same channel, can itself act as a stable identifier across sessions. Randomizing the boot-time offset breaks that stability without needing any network connection or user action.

This complements sdwdate rather than replacing it: bootclockrandomization handles the boot-time window before secure time sync is available; sdwdate (when enabled) handles ongoing accuracy afterward, over Tor, cross-validated against multiple independent sources.

---

Why it's installed by default

Unlike sdwdate, this package is installed and enabled by default on every lainOS layer 02 install. It's passive, automatic, requires no user decision, and has no tradeoff comparable to sdwdate's Tor dependency ~ it just runs once at boot and gets out of the way. This puts it in the same category as ephemeral machine-id or WiFi MAC randomization: hardening that happens without asking.

---

What's different from upstream

Ported as-is, with the core algorithm unchanged (same random delay range, same nanosecond randomization approach):

• The clock-randomization logic itself

Removed:

• Qubes-specific conditionals (ConditionPathExists=!/run/qubes/..., template-VM delay reduction) ~ not applicable, LainOS is not a Qubes template
• The helper-scripts package dependency ~ upstream sources a small shared library (check_runtime.bsh) purely to check "was this script run directly or sourced by another script." That single check ([ "$0" = "$1" ]) is reimplemented inline rather than pulling in a whole separate package for one line of logic.
• has_netvm_on_qubes execution condition ~ Qubes-specific, not applicable

OpenRC translation: upstream's systemd unit (Type=oneshot, RemainAfterExit=yes, Before=sdwdate.service/tor.service) is translated to a standard OpenRC oneshot-style init script in the boot runlevel, ordered before net, before tor, before iwd, before dhcpcd, and before chronyd ~ i.e., as early as possible, before anything that could be affected by or observe the clock change.

---

Installation

Installed by default on lainOS layer 02. To install manually on an existing system:

doas pacman -S bootclockrandomization
doas rc-update add lainos-bootclockrandomization boot

No configuration or user action needed afterward ~ it runs automatically on every boot.

---

Verifying it's working

doas grep -A3 "Randomizing boot clock" /var/log/rc.log

You should see output like:

LainOS Boot Clock Randomization
(ported from Kicksecure/bootclockrandomization)
+ 145 966932379
Changed time from <old time> to <new time>.

The clock will then be corrected to the real current time shortly after by your active time-sync method (chrony or sdwdate) once networking comes up ~ this is expected. The randomization only needs to hold during the boot window itself, before any time-sync mechanism has had a chance to run.

---

License

GPLv3, matching upstream.

Credits

• Kicksecure / Whonix ~ original design and implementation
• LainOS Layer 02 port: Grayson Giles