lainOS/lainOS-layer-02
lainOS/lainOS-layer-02
4
1
Fork 0
Code Issues Pull requests Projects Releases 28 Packages Wiki Activity Actions
28 releases 29 tags
  • 2026.07.15-rc5 deb3df495b

    2026.07.15-rc5 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-16 01:30:36 +02:00 | 30 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    lainOS layer 02 ~ 2026.07.15-rc5 Changelog

    Fifth release candidate. Per-application Tor circuit isolation, and a RAM-extraction defense port from Whonix.

    This RC phase will continue until 2026.07.23, and layer 02 will be released as stable thereafter.

    First boot: getting online

    WiFi is off by default. To connect:

    wifi on
wscan

    Want WiFi to come up automatically on future boots instead? wifi-autostart enable.
    WiFi autoconnect is also disabled to preserve privacy, toggle it on with wifi-autoconnect enable

    New Tool ~ tor1 / tor2 / tor3 / tor4 (Tor Stream Isolation)

    Four dedicated, isolated Tor circuits, matching the wg1-wg4 WireGuard tunnel model exactly. One command, works the same way for every application:

    tor1 profanity -a user@example.onion
tor2 signal-desktop
tor3 element-desktop
tor4 gajim

    Whatever you run through tor1 never shares a circuit ~ or even a port ~ with anything run through tor2/tor3/tor4 or the default port (9050, which itself now also isolates by destination). The default port and all four dedicated ports are configured directly in torrc.

    Usage is seamless across every application type ~ tor1-tor4 auto-detect what they're launching and route it correctly without you needing to know or specify anything:

    • Plain CLI tools and GTK apps (curl, Gajim, Dino) route via torsocks, same as always.
    • Electron/Chromium apps (Signal, Element, confirmed) are detected automatically and routed via Chromium's own --proxy-server flag instead ~ torsocks's usual interception never reaches Electron's sandboxed networking, so this is necessary, not optional.
    • Detected Electron apps also get LD_PRELOAD stripped (alacritty's forced hardened_malloc wrapper otherwise gets inherited and crashes some Electron apps ~ confirmed with Signal) and XDG_CURRENT_DESKTOP overridden to GNOME (Chromium's keyring backend detection doesn't recognize sway, incorrectly reporting no supported keyring even when one is genuinely available ~ confirmed and fixed with Element).

    Known exception: Firefox-based browsers (LibreWolf) don't work reliably through torsocks at all ~ this is a known, documented limitation of torsocks itself for Firefox's multi-process architecture, not something specific to tor1-tor4. Configure LibreWolf's SOCKS5 proxy natively instead (about:preferences -> Network Settings). See the user guide for exact settings.

    lainos-privacy-help    # updated with a Tor Stream Isolation callout

    New Package ~ lainos-ram-wipe

    RAM-extraction attack defense, ported from Kicksecure/Whonix's ram-wipe: a dracut shutdown hook that wipes reclaimable disk cache from RAM at every reboot/poweroff, alongside init_on_alloc=1/init_on_free=1 kernel parameters that continuously poison memory pages on allocation and free.

    ram-wipe enable    # RAM wipe runs at shutdown/reboot (default)
ram-wipe disable   # skip the wipe pass, faster shutdown
ram-wipe status    # show current GRUB config and running kernel's cmdline

    Continuous protection (init_on_alloc/init_on_free) is always on and isn't affected by this toggle.

    ⚠️ Known limitation: the dracut module is confirmed correctly installed and baked into the initramfs, and multiple reboots with it active completed cleanly with no hangs ~ but the actual on-screen shutdown message could not be visually confirmed on Sway/wlroots test hardware, most likely due to how the GPU driver hands the screen back to a plain text console during that specific shutdown transition. If you can confirm this visually on your hardware, we'd like to hear about it.

    New Section ~ Sandboxed Build Requirements

    Some software (LibreWolf's own build process, confirmed) needs unprivileged user namespaces for its own build-time sandboxing, which LainOS locks down by default (kernel.unprivileged_userns_clone = 0, set via /etc/sysctl.d/99-lainos-hardening.conf). Temporarily enable it for builds that need it:

    doas sysctl -w kernel.unprivileged_userns_clone=1
# build your software
doas sysctl -w kernel.unprivileged_userns_clone=0    # restore afterward

    Resets to the hardened default automatically on reboot either way.

    Known Issues

    • Some Nvidia cards have trouble with Sway.

    Documentation

    • User guide: new "Tor Stream Isolation," "ram-wipe," and "Building Software ~ Sandboxed Build Requirements" sections; LESME's connect instructions updated to tor1; Tor section cross-references stream isolation.
    • Privacy Guide: "During your session" (step 6) updated with tor1-tor4 guidance, the single-instance-app caveat, and the LibreWolf exception.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads