lainOS/lainOS-layer-02
lainOS/lainOS-layer-02
4
1
Fork 0
Code Issues Pull requests Projects Releases 28 Packages Wiki Activity Actions
28 releases 29 tags
  • 2026.07.20 3bd8bf8681

    2026.07.20-rc6 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-20 19:40:27 +02:00 | 16 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    lainOS layer 02 security

    lainOS layer 02 ~ 2026.07.20-rc6 Changelog

    Sixth release candidate. Per-application Tor circuit isolation, and a RAM-extraction defense port from Whonix.

    This RC phase will continue until 2026.07.23, and layer 02 will be released as stable thereafter.

    • Package list reduced to remove redundant packages left over from the layer 01 package list. ISO is now 2.75GB down from 3.15GB(2026.07.16)
    • Quickstart guide added. This pops up on first boot instead of the full user guide, provides the user with the needed commands to run the system, and directs the user to all of the other guides.
    • dnsmasq added as experimental privacy feature to hide dns state from the rest of the system. lainOS DNS Mediation Layer

    First boot: getting online

    WiFi is off by default. To connect:

    wifi on
wscan

    Want WiFi to come up automatically on future boots instead? wifi-autostart enable.
    WiFi autoconnect is also disabled to preserve privacy, toggle it on with wifi-autoconnect enable

    New Tool ~ tor1 / tor2 / tor3 / tor4 (Tor Stream Isolation)

    Four dedicated, isolated Tor circuits, matching the wg1-wg4 WireGuard tunnel model exactly. One command, works the same way for every application:

    tor1 profanity -a user@example.onion
tor2 signal-desktop
tor3 element-desktop
tor4 gajim

    Whatever you run through tor1 never shares a circuit ~ or even a port ~ with anything run through tor2/tor3/tor4 or the default port (9050, which itself now also isolates by destination). The default port and all four dedicated ports are configured directly in torrc.

    Usage is seamless across every application type ~ tor1-tor4 auto-detect what they're launching and route it correctly without you needing to know or specify anything:

    • Plain CLI tools and GTK apps (curl, Gajim, Dino) route via torsocks, same as always.
    • Electron/Chromium apps (Signal, Element, confirmed) are detected automatically and routed via Chromium's own --proxy-server flag instead ~ torsocks's usual interception never reaches Electron's sandboxed networking, so this is necessary, not optional.
    • Detected Electron apps also get LD_PRELOAD stripped (alacritty's forced hardened_malloc wrapper otherwise gets inherited and crashes some Electron apps ~ confirmed with Signal) and XDG_CURRENT_DESKTOP overridden to GNOME (Chromium's keyring backend detection doesn't recognize sway, incorrectly reporting no supported keyring even when one is genuinely available ~ confirmed and fixed with Element).

    Privacy Guide

    lainos-privacy-help    # updated with a Tor Stream Isolation callout

    New Package ~ lainos-apparmor (AppArmor Mandatory Access Control)

    Per-daemon AppArmor profiles for all Protocol 7 components with external input surfaces (lainos-dbus-bridge, lainos-notifyd, lainos-init), loaded at boot by an OpenRC init script before the daemons start. The lainos-apparmor init script loads only Protocol 7 profiles, not all of /etc/apparmor.d/* indiscriminately.

    • Path-based MAC complements the existing seccomp filters and mount namespaces: if an attacker escapes the private mount namespace (e.g., via a kernel vulnerability), AppArmor still blocks access to real user data (/home/**, /root/**), sensitive kernel interfaces (/sys/kernel/security/**), and /etc/shadow.
    • Network denials are enforced independently of seccomp — inet, inet6, netlink, and packet are explicitly denied in the lainos-dbus-bridge and lainos-notifyd profiles.
    • Capability rules in the lainos-dbus-bridge and lainos-notifyd profiles grant only the seven capabilities required for pre-drop mount namespace setup (sys_admin, chown, fowner, setgid, setuid, setpcap, dac_override, mknod), then the daemons drop to nobody and clear their bounding set.
    • Verified via adversarial test suite: 26/26 tests passed, including nsenter-based namespace isolation effectiveness tests, path-blocking tests (/etc/shadow, /home, /root), capability-abuse tests, and AppArmor enforcement confirmation.

    This closes the largest remaining architectural gap in Protocol 7 Core's defensive stack.

    New Package ~ lainos-ram-wipe

    RAM-extraction attack defense, ported from Kicksecure/Whonix's ram-wipe: a dracut shutdown hook that wipes reclaimable disk cache from RAM at every reboot/poweroff, alongside init_on_alloc=1/init_on_free=1 kernel parameters that continuously poison memory pages on allocation and free.

    ram-wipe enable    # RAM wipe runs at shutdown/reboot (default)
ram-wipe disable   # skip the wipe pass, faster shutdown
ram-wipe status    # show current GRUB config and running kernel's cmdline

    Continuous protection (init_on_alloc/init_on_free) is always on and isn't affected by this toggle.

    ⚠️ Known limitation: the dracut module is confirmed correctly installed and baked into the initramfs, and multiple reboots with it active completed cleanly with no hangs ~ but the actual on-screen shutdown message could not be visually confirmed on Sway/wlroots test hardware, most likely due to how the GPU driver hands the screen back to a plain text console during that specific shutdown transition. If you can confirm this visually on your hardware, we'd like to hear about it.

    New Section ~ Sandboxed Build Requirements

    Some software (LibreWolf's own build process, confirmed) needs unprivileged user namespaces for its own build-time sandboxing, which LainOS locks down by default (kernel.unprivileged_userns_clone = 0, set via /etc/sysctl.d/99-lainos-hardening.conf). Temporarily enable it for builds that need it:

    doas sysctl -w kernel.unprivileged_userns_clone=1
# build your software
doas sysctl -w kernel.unprivileged_userns_clone=0    # restore afterward

    Resets to the hardened default automatically on reboot either way.

    Known Issues

    • Some Nvidia cards have trouble with Sway.

    Documentation

    • User guide: new "Tor Stream Isolation," "ram-wipe," and "Building Software ~ Sandboxed Build Requirements" sections; LESME's connect instructions updated to tor1; Tor section cross-references stream isolation.
    • Privacy Guide: "During your session" (step 6) updated with tor1-tor4 guidance, the single-instance-app caveat, and the LibreWolf exception.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads