lainOS/lainOS-layer-02
lainOS/lainOS-layer-02
4
1
Fork 0
Code Issues Pull requests Projects Releases 22 Packages Wiki Activity Actions
22 releases 23 tags
  • 2026.07.03-beta 6ee13b7146

    2026.07.03-beta layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-04 09:14:58 +02:00 | 5 commits to main since this release

    ####INSTALLATION####

    #### layer 01/layer 02 migration and user guide ####

    Changelog

    2026-07-03

    Signed Package Repositories

    • Both protocol_7_repo and lainos_repo now require signed packages and databases (SigLevel = Required)
    • All packages are signed with the LainOS maintainer PGP key
    • lainos-keyring package added ~ ships the LainOS public key so pacman can verify the full trust chain automatically
    • pacman-key --populate lainos runs at install time via Calamares

    Tor / nyx

    • Added DataDirectoryGroupReadable 1 to torrc ~ fixes nyx losing access to auth cookie after tor restarts
    • Removed legacy sudo -u tor nyx wrapper from skel zshrc ~ nyx now works directly without doas

    lainos-utils 2.0-4

    • Added lainos-secure-messaging ~ LainOS Ephemeral Secure Messaging Environment (LESME)
      • Automated RSA 4096 PGP keypair generation with random identity
      • Encrypted XMPP credential storage via pass
      • Tor configuration with obfs4 bridges
      • Profanity pre-configuration with OMEMO encryption and PGP-unlocked login
      • Connects to LainOS onion XMPP server

    2026-07-02

    BTRFS

    • BTRFS is now the default filesystem
    • Separate ext4 /boot partition created automatically ~ resolves GRUB compatibility issue with BTRFS root
    • btrfs already present in dracut force_drivers
    • BTRFS confirmed working on baremetal (UEFI and BIOS)

    Calamares

    • Added Calamares autolaunch on liveuser login via sway config exec
    • Only triggers when session user is liveuser ~ does not affect installed systems

    protocol7-core 5.5.3-12

    • provides updated to systemd=1:999 ~ epoch 1 satisfies any future systemd>=X dependency permanently
    • lainos-dbus-bridge fuzz tested with dfuzzer and AddressSanitizer ~ Exit status: 0
    • Systematic pointer type bug fixed across seven methods and properties
    • seccomp filter tightened ~ privilege-setting syscalls removed post-drop
    • See protocol7-core changelog for full details

    lainos-utils 2.0-3

    • Added wg-vpn WireGuard tunnel manager
    • Supports tunnels wg1 - wg4 (up) and wg1d - wg4d (down)
    • Requires WireGuard configs at /etc/wireguard/wgX.conf

    2026-07-01

    LUKS / Full Disk Encryption

    • Added crypt and crypt-lib dracut modules to 99-protocol7.conf
    • Enables LUKS unlock at boot via dracut's non-systemd crypto hooks
    • FDE confirmed working on baremetal (UEFI and BIOS)

    Hardened Malloc

    • Added lainos-hardened-malloc to packages
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so wrappers for the following applications:
      • alacritty(all terminal applications)
      • element(if installed)
      • gnome-keyring-daemon
      • keepassxc
      • kleopatra
      • mpv
    • Added LD_PRELOAD=/usr/lib/libhardened_malloc.so to /etc/conf.d/tor for the tor daemon
    • Incompatible applications (mozjemalloc or bwrap/glycin conflicts): librewolf, torbrowser-launcher, signal, thunar, virt-manager

    Kernel Hardening

    • Added kernel parameters to GRUB_CMDLINE_LINUX:
      • init_on_alloc=1 ~ zero memory pages on allocation
      • init_on_free=1 ~ zero memory pages on free
      • page_alloc.shuffle=1 ~ randomize page allocator freelist
    • Updated /etc/sysctl.d/99-lainos-hardening.conf with additional hardening:
      • kernel.yama.ptrace_scope = 1 ~ restrict ptrace to parent processes
      • kernel.kexec_load_disabled = 1 ~ disable kexec
      • kernel.unprivileged_userns_clone = 0 ~ disable unprivileged user namespaces
      • kernel.randomize_va_space = 2 ~ full ASLR
      • kernel.perf_event_paranoid = 3 ~ restrict perf events
      • fs.suid_dumpable = 0 ~ disable setuid core dumps
      • kernel.core_pattern = |/bin/false ~ disable core dumps

    Gnome Keyring

    • Added gnome-keyring to packages
    • Added exec /usr/local/bin/gnome-keyring-daemon --start --components=secrets to sway config
    • Provides secrets service backend for Element and other Electron apps

    Calamares / shellprocess-final

    • lainos-ghost-units runlevel registration changed from sysinit to boot
    • doas.conf updated with permit nopass :wheel cmd openrc-shutdown and permit nopass :wheel cmd lainos-suspend
    • Added rc-update del for etmpfiles-dev, etmpfiles-setup, esysusers to clean up unused OpenRC services on install

    Overlay cleanup

    • Removed cgroup-delegate and lainos-ghost-units from airootfs/etc/runlevels/sysinit/

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3
    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads