lainOS/lainOS-layer-02
lainOS/lainOS-layer-02
4
1
Fork 0
Code Issues Pull requests Projects Releases 22 Packages Wiki Activity Actions
22 releases 23 tags
  • 2026.07.11-rc3 deb3df495b

    2026.07.11-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-11 10:17:11 +02:00 | 0 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    lainOS layer 02 ~ 2026.07.10-rc3 Changelog

    Third release candidate to fix issues in second release candidate. This release is polished.

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    • ani-cli fixed!!!
    • Volume keys now work through wpctl

    ⚠️ To preserve privacy, WiFi does not autostart on first boot(read below for usage).

    WiFi (iwd) no longer starts automatically at first boot. Use wifi-autostart enable to activate WiFi autostart on subsequent boots. This is a deliberate change, consistent with lainOS's default-private posture elsewhere in the system (WiFi MAC randomization, ephemeral machine-id, boot clock randomization, time-sync over tor, IPv6 disabled by default etc...).

    To activate WiFi interface:

    wifi-toggle on

    To Scan for networks, use wifi (this tool prompts you to select your network and enter your password):

    wifi

    To activate WiFi autostart (start WiFi automatically at every boot):

    wifi-autostart enable

    See lainos-help for full documentation, or lainos-privacy-help for a guided walkthrough of using this alongside lainos-sdwdate and the new lainos-obfs4/lainos-snowflake bridge toggles for sensitive work.

    New Tools (lainos-utils)

    Tor Bridges ~ lainos-snowflake / lainos-obfs4

    Toggle scripts to enable/disable obfs4 or Snowflake pluggable transports, disguising Tor traffic to evade network-level censorship or hide Tor usage from your local network. Each writes a working bridge configuration on first use and toggles it on subsequent runs.

    snowflake enable    # or obfs4 enable
snowflake disable   # or obfs4 disable
snowflake status    # or obfs4 status

    WiFi Control ~ wifi-toggle / wifi-autostart

    • wifi-toggle {on|off|status} ~ fully powers the WiFi radio on/off (service + hardware rfkill block), not just disconnects.
    • wifi-autostart {enable|disable|status} ~ controls whether WiFi starts automatically at boot. Disabled by default for privacy (see warning above).

    Time Sync ~ lainos-sdwdate

    lainos-sdwdate enable   # activate time-sync over tor
lainos-sdwdate disable  # deactivate time-sync over tor; switches to chrony(default)
lainos-sdwdate status   # check if sdwdate or chrony is activated

    Toggle between chrony (default) and sdwdate (Tor-based). See New Packages below for details.

    Privacy Guide ~ lainos-privacy-help

    Opens a new, dedicated step-by-step privacy guide for sensitive work sessions, covering the correct order to enable WiFi controls, sdwdate, and bridges before connecting to any network, downloading Tor Browser safely over Tor, and returning to a clean default state afterward.

    New Packages

    sdwdate (new)

    Secure Distributed Web Date ~ Tor-based, fingerprint-resistant time synchronization. A lainOS port of Kicksecure/Whonix's sdwdate, fetching time from multiple independent Tor onion services and cross-validating against Tor's own network consensus data, instead of trusting plaintext, unauthenticated NTP.

    • Installed by default, but not enabled by default ~ chrony remains the active time-sync service out of the box. sdwdate has no fallback time source; if Tor is unreachable, it cannot sync time at all. Switching methods is a deliberate, local action: 
      lainos-sdwdate enable    # switch to Tor-based time-sync
lainos-sdwdate disable   # switch back to chrony (default)
lainos-sdwdate status    # check which is active
    • Verified working end-to-end on a fresh ISO install: real onion sources contacted, Tor consensus sanity checks passing, correct gradual clock correction applied via sclockadj.
    • Fresh-install log permission bug found and fixed during ISO testing ~ log file creation moved from the install-time hook into the init script's start_pre(), since the former was found not to reliably survive Calamares' chroot-based install process.
    • A separate first-sync permission bug was found and fixed after publishing: sdwdate's first-ever successful sync (or any hard clock jump) shells out to /bin/date directly rather than the gradual sclockadj path, and needed the same CAP_SYS_TIME capability grant.
    • See the package README for full technical details on what was ported, what was reimplemented for lainOS, and what was deliberately left out (AppArmor, privleap, Qubes-specific components).

    bootclockrandomization (new)

    Randomizes the system clock by a small amount (up to ±180 seconds) early in boot, before networking or Tor come up, so the machine's clock is never exactly aligned with another machine's during the boot window. A LainOS port of Kicksecure/Whonix's bootclockrandomization.

    • Installed and enabled by default ~ fully passive, no user decision or network dependency required.
    • Verified via a real reboot on baremetal (T480): fires correctly before networking, subsequently corrected to real time by the active time-sync service.

    snowflake-pt-client (new)

    Tor's official Snowflake pluggable transport client, packaged from upstream source. A dependency of lainos-snowflake.

    python-sdnotify (new)

    Small MIT-licensed Python implementation of the systemd sd_notify protocol, packaged from upstream source since it isn't available in Arch's official repos. A dependency of sdwdate.

    Bug Fixes

    • makepkg/doas: PACMAN_AUTH=(doas) is now shipped in the ISO's default /etc/makepkg.conf.
    • Tor control-port cookie access: DataDirectoryGroupReadable 1 (required alongside CookieAuthFileGroupReadable 1 for group-based access to Tor's control cookie, used by both nyx and sdwdate) confirmed present in the ISO's shipped torrc.

    Documentation

    • User guide fully updated: new "Pluggable Transports ~ Bridges," "Time Sync ~ sdwdate," and "Privacy Guide for Sensitive Work" sections; WiFi section updated with wifi-toggle/wifi-autostart; stale notes about LESME auto-configuring obfs4 removed.
    • New dedicated Privacy Guide for Sensitive Work, covering the correct sequencing of WiFi controls, sdwdate, bridges, and torbrowser-launcher for a single sensitive session.

    Known issues
    • Some Nvidia cards have trouble with Sway.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.10-rc3 deb3df495b

    2026.07.10-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-10 23:21:54 +02:00 | 0 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with 'lainos-help' in the terminal.)

    lainOS layer 02 ~ 2026.07.10-rc3 Changelog

    Third release candidate to fix issues in second release candidate

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    ⚠️ To preserve privacy, WiFi does not autostart on first boot(read below for usage).

    WiFi (iwd) no longer starts automatically at first boot. Use wifi-autostart enable to activate wifi autostart on each boot. This is a deliberate change, consistent with lainOS's default-private posture elsewhere in the system (WiFi MAC randomization, ephemeral machine-id, boot clock randomization, IPv6 disabled by default).

    To activate WiFi interface:

    wifi-toggle on

    To Scan for networks, use wifi (this tool prompts you to select your network and enter your password):

    wifi

    To activate WiFi autostart (start WiFi automatically at every boot):

    wifi-autostart enable

    See lainos-help for full documentation, or lainos-privacy-help for a guided walkthrough of using this alongside lainos-sdwdate and the new lainos-obfs4/lainos-snowflake bridge toggles for sensitive work.

    New Tools (lainos-utils)

    Tor Bridges ~ lainos-snowflake / lainos-obfs4

    Toggle scripts to enable/disable obfs4 or Snowflake pluggable transports, disguising Tor traffic to evade network-level censorship or hide Tor usage from your local network. Each writes a working bridge configuration on first use and toggles it on subsequent runs.

    lainos-snowflake enable    # or lainos-obfs4 enable
lainos-snowflake disable
lainos-snowflake status

    WiFi Control ~ wifi-toggle / wifi-autostart

    • wifi-toggle {on|off|status} ~ fully powers the WiFi radio on/off (service + hardware rfkill block), not just disconnects.
    • wifi-autostart {enable|disable|status} ~ controls whether WiFi starts automatically at boot. Disabled by default for privacy (see warning above).

    Time Sync ~ lainos-sdwdate

    Toggle between chrony (default) and sdwdate (Tor-based). See New Packages below for details.

    Privacy Guide ~ lainos-privacy-help

    Opens a new, dedicated step-by-step privacy guide for sensitive work sessions, covering the correct order to enable WiFi controls, sdwdate, and bridges before connecting to any network, downloading Tor Browser safely over Tor, and returning to a clean default state afterward.

    New Packages

    sdwdate (new)

    Secure Distributed Web Date ~ Tor-based, fingerprint-resistant time synchronization. A LainOS port of Kicksecure's sdwdate, fetching time from multiple independent Tor onion services and cross-validating against Tor's own network consensus data, instead of trusting plaintext, unauthenticated NTP.

    • Installed by default, but not enabled by default ~ chrony remains the active time-sync service out of the box. sdwdate has no fallback time source; if Tor is unreachable, it cannot sync time at all. Switching methods is a deliberate, local action: 
      lainos-sdwdate enable    # switch to Tor-based sync
lainos-sdwdate disable   # switch back to chrony (default)
lainos-sdwdate status    # check which is active
    • Verified working end-to-end on a fresh ISO install: real onion sources contacted, Tor consensus sanity checks passing, correct gradual clock correction applied via sclockadj.
    • Fresh-install log permission bug found and fixed during ISO testing ~ log file creation moved from the install-time hook into the init script's start_pre(), since the former was found not to reliably survive Calamares' chroot-based install process.
    • A separate first-sync permission bug was found and fixed after publishing: sdwdate's first-ever successful sync (or any hard clock jump) shells out to /bin/date directly rather than the gradual sclockadj path, and needed the same CAP_SYS_TIME capability grant.
    • See the package README for full technical details on what was ported, what was reimplemented for lainOS, and what was deliberately left out (AppArmor, privleap, Qubes-specific components).

    bootclockrandomization (new)

    Randomizes the system clock by a small amount (up to ±180 seconds) early in boot, before networking or Tor come up, so the machine's clock is never exactly aligned with another machine's during the boot window. A LainOS port of Kicksecure's bootclockrandomization.

    • Installed and enabled by default ~ fully passive, no user decision or network dependency required.
    • Verified via a real reboot on baremetal (T480): fires correctly before networking, subsequently corrected to real time by the active time-sync service.

    snowflake-pt-client (new)

    Tor's official Snowflake pluggable transport client, packaged from upstream source. A dependency of lainos-snowflake.

    python-sdnotify (new)

    Small MIT-licensed Python implementation of the systemd sd_notify protocol, packaged from upstream source since it isn't available in Arch's official repos. A dependency of sdwdate.

    Bug Fixes

    • makepkg/doas: PACMAN_AUTH=(doas) is now shipped in the ISO's default /etc/makepkg.conf.
    • Tor control-port cookie access: DataDirectoryGroupReadable 1 (required alongside CookieAuthFileGroupReadable 1 for group-based access to Tor's control cookie, used by both nyx and sdwdate) confirmed present in the ISO's shipped torrc.

    Documentation

    • User guide fully updated: new "Pluggable Transports ~ Bridges," "Time Sync ~ sdwdate," and "Privacy Guide for Sensitive Work" sections; WiFi section updated with wifi-toggle/wifi-autostart; stale notes about LESME auto-configuring obfs4 removed.
    • New dedicated Privacy Guide for Sensitive Work, covering the correct sequencing of WiFi controls, sdwdate, bridges, and torbrowser-launcher for a single sensitive session.

    Known issues
    • Some Nvidia cards have trouble with Sway.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.09-rc3 deb3df495b

    2026.07.09-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-10 07:08:38 +02:00 | 0 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with 'lainos-help' in the terminal.)

    lainOS layer 02 ~ RC3 Changelog

    Third release candidate to fix issues in second release candidate

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    • Relocated lainos-layer02-userguide.md from /usr/share/lainos into the lainos-utils package itself, so it can be updated in repo as features are added.

    lainos-utils

    • Added lainos-hardened-malloc ~ toggle script for system-wide hardened_malloc (enable/disable/status via LD_PRELOAD in /etc/environment).
    • Added lainos-help ~ opens the lainOS layer 02 user guide with glow -p.

    Known issues
    • Some Nvidia cards have trouble with Sway.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.08-rc3 6e795c7c96

    2026.07.08-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-09 02:57:13 +02:00 | 2 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with 'lainos-help' in the terminal.)

    lainOS layer 02 ~ RC3 Changelog

    Third release candidate to fix issues in second release candidate

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    protocol7-core-Security Analysis(new valgrind section~zero mem leaks detected)

    Fixes were verified on baremetal and in KVM.

    lainos-utils

    • Added lainos-hardened-malloc ~ toggle script for system-wide hardened_malloc (enable/disable/status via LD_PRELOAD in /etc/environment).
    • Added lainos-help ~ opens the lainOS layer 02 user guide with glow -p.

    Critical Fixes

    • Kernel 7.1.3 initramfs regeneration regression fixed. Verified on baremetal 35eudev-coldplug dracut module now explicitly includes kmod/modprobe in the initramfs (previously relied on incidental staging that broke under kernel 7.1.3, causing i915/WiFi kernel modules to fail to load on the machine). Confirmed working via KVM guest kernel upgrade test (7.1.2 → 7.1.3), all modules loading correctly.

    Logging

    • syslog-ng now fully configured in /etc/syslog-ng.conf. Previously only daemon.log and everything.log were active; /var/log/messages itself was never written despite the config's stated purpose. Now enabled: messages, auth.log, cron.log, debug.log, errors.log, iptables.log, kernel.log, mail.log, messages.log, syslog.log, plus emergency-level broadcast to console.
    • Fixed Error resolving group; group='log' ~ the log group referenced by syslog-ng's config was never created on install. groupadd -r log added to shellprocess-final.

    KVM / Networking

    • Fixed KVM guest networking (DHCP worked, but guests could not reach the network). Root cause: the base nftables.conf forward chain had policy drop with zero rules, silently discarding all forwarded traffic before it ever reached libvirt's own NAT/forward rules.
    • New lainos-kvm-enable-firewall script, shipped with the lainos-kvm package. Adds the necessary virbr0 forward-accept rules to nftables.conf. This is opt-in (not applied automatically at install) to preserve the default-drop security posture for systems not using KVM. Run manually after installing lainos-kvm.

    Minor Fixes

    • tor system user shell corrected from /usr/bin/nologin (does not exist on this system) to /usr/bin/false.
    • libvirt-qemu system user shell corrected the same way, in lainos-kvm.install.

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.07-rc2 b0c5316a56

    2026.07.07-rc2 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-07 18:09:57 +02:00 | 4 commits to main since this release

    ####INSTALLATION####

    MAINTENANCE WAIT FOR NEXT ISO

    #### layer 01/layer 02 migration and user guide ####

    Changelog

    Second release candidate to fix issues in first release candidate

    All features are now fully functional. PipeWire capability (now handled by the lainos-audio-init package, which was relocated from within protocol7-core to its own separate package) and syslog-ng logging capability are fixed. The whole protocol7-core stack has undergone fuzz testing with dfuzzer, AddressSanitizer, and libFuzzer. All interfaces pass clean. This RC phase will continue for another week or two, and will be released as stable thereafter.

    protocol7-core-Security Analysis(final)

    2026.07.07-rc2

    fixed from rc1

    lainos-utils 2.0-5

    • Added disconnect option in wifi scan.

    Calamares / shellprocess-final(dhcpcd group and user)

    • Added groupadd -r dhcpcd 2>/dev/null || true ~ creates dhcpcd group on install
    • Added useradd -r -s /usr/bin/nologin -d /var/lib/dhcpcd dhcpcd 2>/dev/null || true ~
      creates dhcpcd user on install

    pacman.conf cleanup

    • Removed hardcoded mirror server lines from both pacman.conf files
      (profile root and airootfs/etc/) ~ replaced with Include = /etc/pacman.d/mirrorlist

    profiledef.sh

    • Added hardened_malloc wrapper scripts to file_permissions with 0:0:755 ~
      alacritty, element, gnome-keyring-daemon, keepassxc, kleopatra, mpv
    • Fixes wrappers being non-executable on installed systems in RC1

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

  • 2026.07.06-r1 b0c5316a56

    2026.07.06-rc1 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-07 08:44:14 +02:00 | 4 commits to main since this release

    ####INSTALLATION####

    #### layer 01/layer 02 migration and user guide ####

    Missing dhcpcd user discovered upon router failure, wait until tomorrow or run this command to create it

    doas useradd -r -s /usr/bin/nologin -d /var/lib/dhcpcd dhcpcd

    Changelog

    This release marks the first layer 02 release candidate(with added cleanup and hardened_malloc activated).

    All features are now fully functional. PipeWire capability (now handled by the lainos-audio-init package, which was relocated from within protocol7-core to its own separate package) and syslog-ng logging capability are fixed. The whole protocol7-core stack has undergone fuzz testing with dfuzzer, AddressSanitizer, and libFuzzer. All interfaces pass clean. This RC phase will continue for another week or two, and will be released as stable thereafter.

    Security Analysis(final)

    2026-07-07

    pacman.conf cleanup

    • Removed hardcoded mirror server lines from both pacman.conf files
      (profile root and airootfs/etc/) ~ replaced with Include = /etc/pacman.d/mirrorlist

    profiledef.sh

    • Added hardened_malloc wrapper scripts to file_permissions with 0:0:755 ~
      alacritty, element, gnome-keyring-daemon, keepassxc, kleopatra, mpv
    • Fixes wrappers being non-executable on installed systems from RC1

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.05-rc1 6ee13b7146

    2026.07.05-rc1 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-06 00:04:29 +02:00 | 5 commits to main since this release

    ####INSTALLATION####

    #### layer 01/layer 02 migration and user guide ####

    EDIT: The hardened-malloc for these apps needs to be activated with the following command because i forgot in this ISO(will fix later):

    doas chmod +x /usr/local/bin/{alacritty,element,gnome-keyring-daemon,keepassxc,kleopatra,mpv}

    Changelog

    This release marks the first layer 02 release candidate.

    All features are now fully functional. PipeWire capability (now handled by the lainos-audio-init package, which was relocated from within protocol7-core to its own separate package) and syslog-ng logging capability are fixed. The whole protocol7-core stack has undergone fuzz testing with dfuzzer, AddressSanitizer, and libFuzzer. All interfaces pass clean. This RC phase will continue for another week or two, and will be released as stable thereafter.

    Security Analysis

    2026-07-05

    PipeWire / Audio

    • Added lainos-audio-init to packages.x86_64
    • Added exec /usr/libexec/lainos/lainos-audio-init to skel sway config
    • Orchestrates PipeWire + WirePlumber + pipewire-pulse on session start
    • Double-fork pattern ~ no zombie processes, clean session lifecycle
    • Confirmed working: pactl connected, alsa_output sink available

    syslog-ng

    • Enabled daemon facility in ISO framework syslog-ng.conf (was commented out)
    • All Protocol 7 daemon logs now routed to /var/log/daemon.log
    • lainos-notifyd messages confirmed appearing with sender uid/pid

    protocol7-core 5.5.3-21

    • lainos-ghost-units: added after syslog-ng to depend() ~ fixes syslog-ng
      treating the system as systemd-based when /run/systemd/system existed before
      syslog-ng started, causing /dev/log to never be created
    • lainos-notifyd v4.6/v4.7: signal handler hang fixed, SCM_CREDENTIALS added,
      MSG_TRUNC detection, log injection prevention, broken shutdown unlink removed
    • lainos-net-init removed ~ dead code, no callers
    • lainos-audio-init removed from protocol7-core ~ now a separate package

    Calamares / shellprocess-final

    • Added notify to usermod group list ~ required for notifyd socket access

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.03-beta 6ee13b7146

    2026.07.03-beta layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-04 09:14:58 +02:00 | 5 commits to main since this release

    ####INSTALLATION####

    #### layer 01/layer 02 migration and user guide ####

    Changelog

    2026-07-03

    Signed Package Repositories

    • Both protocol_7_repo and lainos_repo now require signed packages and databases (SigLevel = Required)
    • All packages are signed with the LainOS maintainer PGP key
    • lainos-keyring package added ~ ships the LainOS public key so pacman can verify the full trust chain automatically
    • pacman-key --populate lainos runs at install time via Calamares

    Tor / nyx

    • Added DataDirectoryGroupReadable 1 to torrc ~ fixes nyx losing access to auth cookie after tor restarts
    • Removed legacy sudo -u tor nyx wrapper from skel zshrc ~ nyx now works directly without doas

    lainos-utils 2.0-4

    • Added lainos-secure-messaging ~ LainOS Ephemeral Secure Messaging Environment (LESME)
      • Automated RSA 4096 PGP keypair generation with random identity
      • Encrypted XMPP credential storage via pass
      • Tor configuration with obfs4 bridges
      • Profanity pre-configuration with OMEMO encryption and PGP-unlocked login
      • Connects to LainOS onion XMPP server

    2026-07-02

    BTRFS

    • BTRFS is now the default filesystem
    • Separate ext4 /boot partition created automatically ~ resolves GRUB compatibility issue with BTRFS root
    • btrfs already present in dracut force_drivers
    • BTRFS confirmed working on baremetal (UEFI and BIOS)

    Calamares

    • Added Calamares autolaunch on liveuser login via sway config exec
    • Only triggers when session user is liveuser ~ does not affect installed systems

    protocol7-core 5.5.3-12

    • provides updated to systemd=1:999 ~ epoch 1 satisfies any future systemd>=X dependency permanently
    • lainos-dbus-bridge fuzz tested with dfuzzer and AddressSanitizer ~ Exit status: 0
    • Systematic pointer type bug fixed across seven methods and properties
    • seccomp filter tightened ~ privilege-setting syscalls removed post-drop
    • See protocol7-core changelog for full details

    lainos-utils 2.0-3

    • Added wg-vpn WireGuard tunnel manager
    • Supports tunnels wg1 - wg4 (up) and wg1d - wg4d (down)
    • Requires WireGuard configs at /etc/wireguard/wgX.conf

    2026-07-01

    LUKS / Full Disk Encryption

    • Added crypt and crypt-lib dracut modules to 99-protocol7.conf
    • Enables LUKS unlock at boot via dracut's non-systemd crypto hooks
    • FDE confirmed working on baremetal (UEFI and BIOS)

    Hardened Malloc

    • Added lainos-hardened-malloc to packages
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so wrappers for the following applications:
      • alacritty(all terminal applications)
      • element(if installed)
      • gnome-keyring-daemon
      • keepassxc
      • kleopatra
      • mpv
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so to /etc/conf.d/tor for the tor daemon
    • Incompatible applications (mozjemalloc or bwrap/glycin conflicts): librewolf, torbrowser-launcher, signal, thunar, virt-manager

    Kernel Hardening

    • Added kernel parameters to GRUB_CMDLINE_LINUX:
      • init_on_alloc=1 ~ zero memory pages on allocation
      • init_on_free=1 ~ zero memory pages on free
      • page_alloc.shuffle=1 ~ randomize page allocator freelist
    • Updated /etc/sysctl.d/99-lainos-hardening.conf with additional hardening:
      • kernel.yama.ptrace_scope = 1 ~ restrict ptrace to parent processes
      • kernel.kexec_load_disabled = 1 ~ disable kexec
      • kernel.unprivileged_userns_clone = 0 ~ disable unprivileged user namespaces
      • kernel.randomize_va_space = 2 ~ full ASLR
      • kernel.perf_event_paranoid = 3 ~ restrict perf events
      • fs.suid_dumpable = 0 ~ disable setuid core dumps
      • kernel.core_pattern = |/bin/false ~ disable core dumps

    Gnome Keyring

    • Added gnome-keyring to packages
    • Added exec /usr/local/bin/gnome-keyring-daemon --start --components=secrets to sway config
    • Provides secrets service backend for Element and other Electron apps

    Calamares / shellprocess-final

    • lainos-ghost-units runlevel registration changed from sysinit to boot
    • doas.conf updated with permit nopass :wheel cmd openrc-shutdown and permit nopass :wheel cmd lainos-suspend
    • Added rc-update del for etmpfiles-dev, etmpfiles-setup, esysusers to clean up unused OpenRC services on install

    Overlay cleanup

    • Removed cgroup-delegate and lainos-ghost-units from airootfs/etc/runlevels/sysinit/

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3
    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.02-beta-3 6ee13b7146

    2026.07.02-beta-3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-03 03:34:49 +02:00 | 5 commits to main since this release

    ####INSTALLATION####

    #### layer 01/layer 02 migration and user guide ####

    This ISO marks the completion of layer 02.

    Changelog

    2026-07-02

    Tor / nyx

    • Added DataDirectoryGroupReadable 1 to torrc ~ fixes nyx losing access to auth cookie after tor restarts
    • Removed legacy sudo -u tor nyx wrapper from skel zshrc ~ nyx now works directly without doas
    • User is added to tor group via Calamares shellprocess-final for nyx access on installed systems
    • nyx confirmed working out of the box on fresh installs

    lainos-utils 2.0-4

    • Added lainos-secure-messaging ~ LainOS Ephemeral Secure Messaging Environment (LESME)
      • Automated RSA 4096 PGP keypair generation with random identity
      • Encrypted XMPP credential storage via pass
      • Tor configuration with obfs4 bridges
      • Profanity pre-configuration with OMEMO encryption and PGP-unlocked login
      • Connect toany server or LainOS onion XMPP server
      • Added wg-vpn WireGuard tunnel manager
      • Supports tunnels wg1 - wg4 (up) and wg1d - wg4d (down)
      • Requires WireGuard configs at /etc/wireguard/wgX.conf

    BTRFS

    • BTRFS is now the default filesystem
    • Separate ext4 /boot partition created automatically ~ resolves GRUB compatibility issue with BTRFS root
    • btrfs already present in dracut force_drivers
    • BTRFS confirmed working on baremetal (UEFI and BIOS)

    Calamares

    • Added Calamares autolaunch on liveuser login via sway config exec
    • Only triggers when session user is liveuser ~ does not affect installed systems

    protocol7-core

    • provides updated to systemd=1:999 ~ epoch 1 satisfies any future systemd>=X dependency permanently, no future PKGBUILD changes required

    2026-07-01

    LUKS / Full Disk Encryption

    • Added crypt and crypt-lib dracut modules to 99-protocol7.conf
    • Enables LUKS unlock at boot via dracut's non-systemd crypto hooks
    • FDE confirmed working on baremetal (UEFI and BIOS)

    Hardened Malloc

    • Added lainos-hardened-malloc to packages
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so wrappers for the following applications:
      • alacritty(all terminal applications)
      • element(if installed)
      • gnome-keyring-daemon
      • keepassxc
      • kleopatra
      • mpv
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so to /etc/conf.d/tor for the tor daemon
    • Incompatible applications (mozjemalloc or bwrap/glycin conflicts): librewolf, torbrowser-launcher, signal, thunar, virt-manager

    Kernel Hardening

    • Added kernel parameters to GRUB_CMDLINE_LINUX:
      • init_on_alloc=1 ~ zero memory pages on allocation
      • init_on_free=1 ~ zero memory pages on free
      • page_alloc.shuffle=1 ~ randomize page allocator freelist
    • Updated /etc/sysctl.d/99-lainos-hardening.conf with additional hardening:
      • kernel.yama.ptrace_scope = 1 ~ restrict ptrace to parent processes
      • kernel.kexec_load_disabled = 1 ~ disable kexec
      • kernel.unprivileged_userns_clone = 0 ~ disable unprivileged user namespaces
      • kernel.randomize_va_space = 2 ~ full ASLR
      • kernel.perf_event_paranoid = 3 ~ restrict perf events
      • fs.suid_dumpable = 0 ~ disable setuid core dumps
      • kernel.core_pattern = |/bin/false ~ disable core dumps

    Gnome Keyring

    • Added gnome-keyring to packages
    • Added exec /usr/local/bin/gnome-keyring-daemon --start --components=secrets to sway config
    • Provides secrets service backend for Element and other Electron apps

    Calamares / shellprocess-final

    • lainos-ghost-units runlevel registration changed from sysinit to boot
    • doas.conf updated with permit nopass :wheel cmd openrc-shutdown and permit nopass :wheel cmd lainos-suspend
    • Added rc-update del for etmpfiles-dev, etmpfiles-setup, esysusers to clean up unused OpenRC services on install

    Overlay cleanup

    • Removed cgroup-delegate and lainos-ghost-units from airootfs/etc/runlevels/sysinit/

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.02-beta-btrfs 6ee13b7146

    2026.07.02-beta-btrfs layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-03 00:33:28 +02:00 | 5 commits to main since this release

    ####INSTALLATION####

    #### layer 01/layer 02 migration and user guide ####

    Changelog

    2026-07-02

    BTRFS

    • BTRFS is now the default filesystem
    • Separate ext4 /boot partition created automatically ~ resolves GRUB compatibility issue with BTRFS root
    • btrfs already present in dracut force_drivers
    • BTRFS confirmed working on baremetal (UEFI and BIOS)

    Calamares

    • Added Calamares autolaunch on liveuser login via sway config exec
    • Only triggers when session user is liveuser ~ does not affect installed systems

    protocol7-core

    • provides updated to systemd=1:999 ~ epoch 1 satisfies any future systemd>=X dependency permanently, no future PKGBUILD changes required

    lainos-utils 2.0-3

    • Added wg-vpn WireGuard tunnel manager
    • Supports tunnels wg1 - wg4 (up) and wg1d - wg4d (down)
    • Requires WireGuard configs at /etc/wireguard/wgX.conf

    2026-07-01

    LUKS / Full Disk Encryption

    • Added crypt and crypt-lib dracut modules to 99-protocol7.conf
    • Enables LUKS unlock at boot via dracut's non-systemd crypto hooks
    • FDE confirmed working on baremetal (UEFI and BIOS)

    Hardened Malloc

    • Added lainos-hardened-malloc to packages
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so wrappers for the following applications:
      • alacritty(all terminal applications)
      • element(if installed)
      • gnome-keyring-daemon
      • keepassxc
      • kleopatra
      • mpv
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so to /etc/conf.d/tor for the tor daemon
    • Incompatible applications (mozjemalloc or bwrap/glycin conflicts): librewolf, torbrowser-launcher, signal, thunar, virt-manager

    Kernel Hardening

    • Added kernel parameters to GRUB_CMDLINE_LINUX:
      • init_on_alloc=1 ~ zero memory pages on allocation
      • init_on_free=1 ~ zero memory pages on free
      • page_alloc.shuffle=1 ~ randomize page allocator freelist
    • Updated /etc/sysctl.d/99-lainos-hardening.conf with additional hardening:
      • kernel.yama.ptrace_scope = 1 ~ restrict ptrace to parent processes
      • kernel.kexec_load_disabled = 1 ~ disable kexec
      • kernel.unprivileged_userns_clone = 0 ~ disable unprivileged user namespaces
      • kernel.randomize_va_space = 2 ~ full ASLR
      • kernel.perf_event_paranoid = 3 ~ restrict perf events
      • fs.suid_dumpable = 0 ~ disable setuid core dumps
      • kernel.core_pattern = |/bin/false ~ disable core dumps

    Gnome Keyring

    • Added gnome-keyring to packages
    • Added exec /usr/local/bin/gnome-keyring-daemon --start --components=secrets to sway config
    • Provides secrets service backend for Element and other Electron apps

    Calamares / shellprocess-final

    • lainos-ghost-units runlevel registration changed from sysinit to boot
    • doas.conf updated with permit nopass :wheel cmd openrc-shutdown and permit nopass :wheel cmd lainos-suspend
    • Added rc-update del for etmpfiles-dev, etmpfiles-setup, esysusers to clean up unused OpenRC services on install

    Overlay cleanup

    • Removed cgroup-delegate and lainos-ghost-units from airootfs/etc/runlevels/sysinit/

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads