lainOS/lainOS-layer-02
lainOS/lainOS-layer-02
4
1
Fork 0
Code Issues Pull requests Projects Releases 28 Packages Wiki Activity Actions
28 releases 29 tags
  • 2026.07.01-beta-2 acd6b27e4b

    2026.07.01-beta-2 lainOS layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-02 05:45:50 +02:00 | 33 commits to main since this release

    ####INSTALLATION####

    ####layer 01/layer 02 migration and user guide ####

    Please read the lainOS layer 02 wiki links above before installing. INSTALLATION INSTRUCTIONS ARE IN THE WIKI. DO NOT USE BTRFS(it will likely be integrated within the month)

    Changelog

    2026-07-01

    LUKS / Full Disk Encryption(tested ~ operational)

    • Added crypt and crypt-lib dracut modules to 99-protocol7.conf
    • Enables LUKS unlock at boot via dracut's non-systemd crypto hooks
    • FDE is opt-in via Calamares partition module — users select "Encrypt system" during install

    Hardened Malloc

    • Added lainos-hardened-malloc to packages
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so wrappers for the following applications:
      • alacritty
      • element
      • gnome-keyring-daemon
      • keepassxc
      • kleopatra
      • mpv
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so to /etc/conf.d/tor for the tor daemon
    • Incompatible applications (mozjemalloc or bwrap/glycin conflicts): librewolf, torbrowser-launcher, signal, thunar, virt-manager

    Kernel Hardening

    • Added kernel parameters to GRUB_CMDLINE_LINUX:
      • init_on_alloc=1 — zero memory pages on allocation
      • init_on_free=1 — zero memory pages on free
      • page_alloc.shuffle=1 — randomize page allocator freelist
    • Updated /etc/sysctl.d/99-lainos-hardening.conf with additional hardening:
      • kernel.yama.ptrace_scope = 1 — restrict ptrace to parent processes
      • kernel.kexec_load_disabled = 1 — disable kexec
      • kernel.unprivileged_userns_clone = 0 — disable unprivileged user namespaces
      • kernel.randomize_va_space = 2 — full ASLR
      • kernel.perf_event_paranoid = 3 — restrict perf events
      • fs.suid_dumpable = 0 — disable setuid core dumps
      • kernel.core_pattern = |/bin/false — disable core dumps

    Gnome Keyring

    • Added gnome-keyring to packages
    • Added exec /usr/local/bin/gnome-keyring-daemon --start --components=secrets to skel sway config
    • Provides secrets service backend for Element and other Electron apps

    Calamares / shellprocess-final

    • lainos-ghost-units runlevel registration changed from sysinit to boot
    • doas.conf updated with permit nopass :wheel cmd openrc-shutdown and permit nopass :wheel cmd lainos-suspend
    • Added rc-update del for etmpfiles-dev, etmpfiles-setup, esysusers to clean up unused OpenRC services on install

    Overlay cleanup

    • Removed cgroup-delegate and lainos-ghost-units from airootfs/etc/runlevels/sysinit/

    2026-07-01(build 1)

    doas

    • Added permit nopass :wheel cmd openrc-shutdown and permit nopass :wheel cmd lainos-suspend to /etc/doas.conf so wlogout actions work correctly on the installed system without a TTY

    protocol7-core(cleaned up OpenRC boot runlevels)

    • Removed lainos-ghost-units init script and sysinit runlevel symlink from airootfs overlay ~ now correctly handled by the protocol7-core package post_install hook, users on past isos will need to run these commands before updating again:
    • doas rm -f /etc/init.d/lainos-ghost-units
    • doas rm -f /etc/runlevels/sysinit/lainos-ghost-units
    • doas rm -f /etc/runlevels/boot/lainos-ghost-units
    • doas rc-update del cgroup-delegate sysinit
    • doas rc-update del lainos-ghost-units sysinit
    • doas rc-update del etmpfiles-dev sysinit
    • doas rc-update del etmpfiles-setup boot
    • doas rc-update del esysusers boot
    • doas pacman -Syu

    Lid Close / Sleep

    • Added acpid event rule for lid close (/etc/acpi/events/lid-close)
    • Added dynamic lid-close handler (/etc/acpi/handlers/lid-close.sh)
      • Detects sway user dynamically via ps — works for any user on installed system and root on live ISO
      • Launches swaylock --daemonize in the correct Wayland session context
      • Skips su - when sway is running as root (live ISO)
      • Creates XDG_RUNTIME_DIR if not present
      • Suspends via echo mem > /sys/power/state (no elogind/logind required)
    • Added acpid to default runlevel

    Screen Lock

    • Added swaylock config to /root/.config/swaylock/config (live ISO) and /etc/skel/.config/swaylock/config (installed users via Calamares)
      • Uses /usr/share/lainos/wallpapers/layer02-wallpaper.png with scaling=fill

    Wlogout

    • Added lainos-suspend script (/usr/local/bin/lainos-suspend)
      • Suspends via echo mem > /sys/power/state
    • Added wlogout layout to /root/.config/wlogout/layout (live ISO) and /etc/skel/.config/wlogout/layout (installed users via Calamares)
      • Shutdown and reboot via doas openrc-shutdown
      • Suspend via doas lainos-suspend
      • Lock via swaylock -f
      • Logout via swaymsg exit

    Known issues

    • STILL NOT BTRFS COMPATIBLE YET. Use ext4 for now.

    • Some Nvidia cards have trouble with Sway(Follow Nvidia instructions above^^).

    Get connected

    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud

    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH

    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)

    • Website: https://lainos.net

    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion

    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads