lainOS/lainOS-layer-02
lainOS/lainOS-layer-02
4
1
Fork 0
Code Issues Pull requests Projects Releases 28 Packages Wiki Activity Actions
28 releases 29 tags
  • 2026.07.21-rc7 60cef3f22b

    2026.07.21-rc7 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-22 02:46:23 +02:00 | 5 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    lainOS layer 02 security

    lainOS layer 02 ~ 2026.07.21-rc7 Changelog

    Seventh release candidate. User-togglable encrypted DNS(DoT or Tor DNSport) with stateful mode persistence, and a complete blind DNS mediation architecture that abstracts DNS resolver state away from the rest of the system.

    This RC phase will continue until 2026.07.23, and layer 02 will be released as stable thereafter.

    First boot: getting online

    WiFi is off by default. To connect:

    wifi on
wscan

    Want WiFi to come up automatically on future boots instead? wifi-autostart enable.
    WiFi autoconnect is also disabled to preserve privacy, toggle it on with wifi-autoconnect enable

    New in RC7

    • DNS Mediation Architecture ~ dnsmasq is now a centralized, stateless blind forwarding resolver. All applications resolve through 127.0.0.1:53. Three modes: plaintext (default, DHCP with fallbacks), encrypted (DoT via stubby on :5053), and private (Tor DNSPort on :9059). Mode transitions are explicit and stateful; private-mode remembers and restores your previous mode on exit. lainOS DNS Mediation Architecture
    • lainos-dns utility ~ lainos-dns {plaintext|encrypted|status} toggles between plaintext and encrypted DNS, detects installed proxy, warns if not running. Respects private-mode state.
    • private-mode updated ~ Now tracks DNS mode state via /var/lib/lainos/dns-mode and /var/lib/lainos/dns-mode-previous. When entering private mode, saves current mode; when exiting, restores it (plaintext or encrypted). Bootstrap DNS uses non-private config until Tor DNSPort is ready.
    • Stubby DoT proxy ~stubby is the encrypted DNS proxy. Ships with OpenRC init script since Arch doesn't provide one. Auto-starts in default runlevel.
    • DNS config templates ~dnsmasq.conf.plaintext, dnsmasq.conf.encrypted, dnsmasq.conf.private installed via airootfs overlay to avoid package conflicts.
    • ISO size ~ 2.7GB

    DNS Quick Reference

    lainos-dns plaintext    # Plaintext fallbacks (1.1.1.1, 9.9.9.9)
lainos-dns encrypted    # Encrypted DoT via stubby
lainos-dns status       # Show current mode and proxy state

private-mode on        # Tor DNSPort (saves previous mode)
private-mode off       # Restore previous mode (plaintext or encrypted)

    Documentation

    • User guide: Updated with lainos-dns and DNS architecture sections.
    • Privacy Guide: Updated private-mode description to reflect DNS mode restoration.
    • New document: lainOS DNS Mediation Architecture

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.20 3bd8bf8681

    2026.07.20-rc6 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-20 19:40:27 +02:00 | 16 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    lainOS layer 02 security

    lainOS layer 02 ~ 2026.07.20-rc6 Changelog

    Sixth release candidate. Per-application Tor circuit isolation, and a RAM-extraction defense port from Whonix.

    This RC phase will continue until 2026.07.23, and layer 02 will be released as stable thereafter.

    • Package list reduced to remove redundant packages left over from the layer 01 package list. ISO is now 2.75GB down from 3.15GB(2026.07.16)
    • Quickstart guide added. This pops up on first boot instead of the full user guide, provides the user with the needed commands to run the system, and directs the user to all of the other guides.
    • dnsmasq added as experimental privacy feature to hide dns state from the rest of the system. lainOS DNS Mediation Layer

    First boot: getting online

    WiFi is off by default. To connect:

    wifi on
wscan

    Want WiFi to come up automatically on future boots instead? wifi-autostart enable.
    WiFi autoconnect is also disabled to preserve privacy, toggle it on with wifi-autoconnect enable

    New Tool ~ tor1 / tor2 / tor3 / tor4 (Tor Stream Isolation)

    Four dedicated, isolated Tor circuits, matching the wg1-wg4 WireGuard tunnel model exactly. One command, works the same way for every application:

    tor1 profanity -a user@example.onion
tor2 signal-desktop
tor3 element-desktop
tor4 gajim

    Whatever you run through tor1 never shares a circuit ~ or even a port ~ with anything run through tor2/tor3/tor4 or the default port (9050, which itself now also isolates by destination). The default port and all four dedicated ports are configured directly in torrc.

    Usage is seamless across every application type ~ tor1-tor4 auto-detect what they're launching and route it correctly without you needing to know or specify anything:

    • Plain CLI tools and GTK apps (curl, Gajim, Dino) route via torsocks, same as always.
    • Electron/Chromium apps (Signal, Element, confirmed) are detected automatically and routed via Chromium's own --proxy-server flag instead ~ torsocks's usual interception never reaches Electron's sandboxed networking, so this is necessary, not optional.
    • Detected Electron apps also get LD_PRELOAD stripped (alacritty's forced hardened_malloc wrapper otherwise gets inherited and crashes some Electron apps ~ confirmed with Signal) and XDG_CURRENT_DESKTOP overridden to GNOME (Chromium's keyring backend detection doesn't recognize sway, incorrectly reporting no supported keyring even when one is genuinely available ~ confirmed and fixed with Element).

    Privacy Guide

    lainos-privacy-help    # updated with a Tor Stream Isolation callout

    New Package ~ lainos-apparmor (AppArmor Mandatory Access Control)

    Per-daemon AppArmor profiles for all Protocol 7 components with external input surfaces (lainos-dbus-bridge, lainos-notifyd, lainos-init), loaded at boot by an OpenRC init script before the daemons start. The lainos-apparmor init script loads only Protocol 7 profiles, not all of /etc/apparmor.d/* indiscriminately.

    • Path-based MAC complements the existing seccomp filters and mount namespaces: if an attacker escapes the private mount namespace (e.g., via a kernel vulnerability), AppArmor still blocks access to real user data (/home/**, /root/**), sensitive kernel interfaces (/sys/kernel/security/**), and /etc/shadow.
    • Network denials are enforced independently of seccomp — inet, inet6, netlink, and packet are explicitly denied in the lainos-dbus-bridge and lainos-notifyd profiles.
    • Capability rules in the lainos-dbus-bridge and lainos-notifyd profiles grant only the seven capabilities required for pre-drop mount namespace setup (sys_admin, chown, fowner, setgid, setuid, setpcap, dac_override, mknod), then the daemons drop to nobody and clear their bounding set.
    • Verified via adversarial test suite: 26/26 tests passed, including nsenter-based namespace isolation effectiveness tests, path-blocking tests (/etc/shadow, /home, /root), capability-abuse tests, and AppArmor enforcement confirmation.

    This closes the largest remaining architectural gap in Protocol 7 Core's defensive stack.

    New Package ~ lainos-ram-wipe

    RAM-extraction attack defense, ported from Kicksecure/Whonix's ram-wipe: a dracut shutdown hook that wipes reclaimable disk cache from RAM at every reboot/poweroff, alongside init_on_alloc=1/init_on_free=1 kernel parameters that continuously poison memory pages on allocation and free.

    ram-wipe enable    # RAM wipe runs at shutdown/reboot (default)
ram-wipe disable   # skip the wipe pass, faster shutdown
ram-wipe status    # show current GRUB config and running kernel's cmdline

    Continuous protection (init_on_alloc/init_on_free) is always on and isn't affected by this toggle.

    ⚠️ Known limitation: the dracut module is confirmed correctly installed and baked into the initramfs, and multiple reboots with it active completed cleanly with no hangs ~ but the actual on-screen shutdown message could not be visually confirmed on Sway/wlroots test hardware, most likely due to how the GPU driver hands the screen back to a plain text console during that specific shutdown transition. If you can confirm this visually on your hardware, we'd like to hear about it.

    New Section ~ Sandboxed Build Requirements

    Some software (LibreWolf's own build process, confirmed) needs unprivileged user namespaces for its own build-time sandboxing, which LainOS locks down by default (kernel.unprivileged_userns_clone = 0, set via /etc/sysctl.d/99-lainos-hardening.conf). Temporarily enable it for builds that need it:

    doas sysctl -w kernel.unprivileged_userns_clone=1
# build your software
doas sysctl -w kernel.unprivileged_userns_clone=0    # restore afterward

    Resets to the hardened default automatically on reboot either way.

    Known Issues

    • Some Nvidia cards have trouble with Sway.

    Documentation

    • User guide: new "Tor Stream Isolation," "ram-wipe," and "Building Software ~ Sandboxed Build Requirements" sections; LESME's connect instructions updated to tor1; Tor section cross-references stream isolation.
    • Privacy Guide: "During your session" (step 6) updated with tor1-tor4 guidance, the single-instance-app caveat, and the LibreWolf exception.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.17 d60326084c

    2026.07.17-rc5 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-18 02:59:07 +02:00 | 18 commits to main since this release

    this iso accidentally had linux firmware removed when i cut the package list down. building a new one now.

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    lainOS layer 02 security

    lainOS layer 02 ~ 2026.07.16-rc5 Changelog

    Fifth release candidate. Per-application Tor circuit isolation, and a RAM-extraction defense port from Whonix.

    This RC phase will continue until 2026.07.23, and layer 02 will be released as stable thereafter.

    • Package list reduced to remove redundant packages left over from the layer 01 package list. ISO is now 2.46GB down from 3.15GB(2026.07.16)
    • Quickstart guide added. This pops up on first boot instead of the full user guide, provides the user with the needed commands to run the system, and directs the user to all of the other guides.

    First boot: getting online

    WiFi is off by default. To connect:

    wifi on
wscan

    Want WiFi to come up automatically on future boots instead? wifi-autostart enable.
    WiFi autoconnect is also disabled to preserve privacy, toggle it on with wifi-autoconnect enable

    New Tool ~ tor1 / tor2 / tor3 / tor4 (Tor Stream Isolation)

    Four dedicated, isolated Tor circuits, matching the wg1-wg4 WireGuard tunnel model exactly. One command, works the same way for every application:

    tor1 profanity -a user@example.onion
tor2 signal-desktop
tor3 element-desktop
tor4 gajim

    Whatever you run through tor1 never shares a circuit ~ or even a port ~ with anything run through tor2/tor3/tor4 or the default port (9050, which itself now also isolates by destination). The default port and all four dedicated ports are configured directly in torrc.

    Usage is seamless across every application type ~ tor1-tor4 auto-detect what they're launching and route it correctly without you needing to know or specify anything:

    • Plain CLI tools and GTK apps (curl, Gajim, Dino) route via torsocks, same as always.
    • Electron/Chromium apps (Signal, Element, confirmed) are detected automatically and routed via Chromium's own --proxy-server flag instead ~ torsocks's usual interception never reaches Electron's sandboxed networking, so this is necessary, not optional.
    • Detected Electron apps also get LD_PRELOAD stripped (alacritty's forced hardened_malloc wrapper otherwise gets inherited and crashes some Electron apps ~ confirmed with Signal) and XDG_CURRENT_DESKTOP overridden to GNOME (Chromium's keyring backend detection doesn't recognize sway, incorrectly reporting no supported keyring even when one is genuinely available ~ confirmed and fixed with Element).

    Privacy Guide

    lainos-privacy-help    # updated with a Tor Stream Isolation callout

    New Package ~ lainos-apparmor (AppArmor Mandatory Access Control)

    Per-daemon AppArmor profiles for all Protocol 7 components with external input surfaces (lainos-dbus-bridge, lainos-notifyd, lainos-init), loaded at boot by an OpenRC init script before the daemons start. The lainos-apparmor init script loads only Protocol 7 profiles, not all of /etc/apparmor.d/* indiscriminately.

    • Path-based MAC complements the existing seccomp filters and mount namespaces: if an attacker escapes the private mount namespace (e.g., via a kernel vulnerability), AppArmor still blocks access to real user data (/home/**, /root/**), sensitive kernel interfaces (/sys/kernel/security/**), and /etc/shadow.
    • Network denials are enforced independently of seccomp — inet, inet6, netlink, and packet are explicitly denied in the lainos-dbus-bridge and lainos-notifyd profiles.
    • Capability rules in the lainos-dbus-bridge and lainos-notifyd profiles grant only the seven capabilities required for pre-drop mount namespace setup (sys_admin, chown, fowner, setgid, setuid, setpcap, dac_override, mknod), then the daemons drop to nobody and clear their bounding set.
    • Verified via adversarial test suite: 26/26 tests passed, including nsenter-based namespace isolation effectiveness tests, path-blocking tests (/etc/shadow, /home, /root), capability-abuse tests, and AppArmor enforcement confirmation.

    This closes the largest remaining architectural gap in Protocol 7 Core's defensive stack.

    New Package ~ lainos-ram-wipe

    RAM-extraction attack defense, ported from Kicksecure/Whonix's ram-wipe: a dracut shutdown hook that wipes reclaimable disk cache from RAM at every reboot/poweroff, alongside init_on_alloc=1/init_on_free=1 kernel parameters that continuously poison memory pages on allocation and free.

    ram-wipe enable    # RAM wipe runs at shutdown/reboot (default)
ram-wipe disable   # skip the wipe pass, faster shutdown
ram-wipe status    # show current GRUB config and running kernel's cmdline

    Continuous protection (init_on_alloc/init_on_free) is always on and isn't affected by this toggle.

    ⚠️ Known limitation: the dracut module is confirmed correctly installed and baked into the initramfs, and multiple reboots with it active completed cleanly with no hangs ~ but the actual on-screen shutdown message could not be visually confirmed on Sway/wlroots test hardware, most likely due to how the GPU driver hands the screen back to a plain text console during that specific shutdown transition. If you can confirm this visually on your hardware, we'd like to hear about it.

    New Section ~ Sandboxed Build Requirements

    Some software (LibreWolf's own build process, confirmed) needs unprivileged user namespaces for its own build-time sandboxing, which LainOS locks down by default (kernel.unprivileged_userns_clone = 0, set via /etc/sysctl.d/99-lainos-hardening.conf). Temporarily enable it for builds that need it:

    doas sysctl -w kernel.unprivileged_userns_clone=1
# build your software
doas sysctl -w kernel.unprivileged_userns_clone=0    # restore afterward

    Resets to the hardened default automatically on reboot either way.

    Known Issues

    • Some Nvidia cards have trouble with Sway.

    Documentation

    • User guide: new "Tor Stream Isolation," "ram-wipe," and "Building Software ~ Sandboxed Build Requirements" sections; LESME's connect instructions updated to tor1; Tor section cross-references stream isolation.
    • Privacy Guide: "During your session" (step 6) updated with tor1-tor4 guidance, the single-instance-app caveat, and the LibreWolf exception.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

  • 2026.07.16-rc5 deb3df495b

    2026.07.16-rc5 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-16 22:05:57 +02:00 | 30 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    lainOS layer 02 ~ 2026.07.16-rc5 Changelog

    Fifth release candidate. Per-application Tor circuit isolation, and a RAM-extraction defense port from Whonix.

    This RC phase will continue until 2026.07.23, and layer 02 will be released as stable thereafter.

    • Package list reduced to remove redundant packages left over from the layer 01 package list. ISO is now 2.46GB down from 3.15GB(2026.07.16)
    • Quickstart guide added. This pops up on first boot instead of the full user guide, provides the user with the needed commands to run the system, and directs the user to all of the other guides.

    First boot: getting online

    WiFi is off by default. To connect:

    wifi on
wscan

    Want WiFi to come up automatically on future boots instead? wifi-autostart enable.
    WiFi autoconnect is also disabled to preserve privacy, toggle it on with wifi-autoconnect enable

    New Tool ~ tor1 / tor2 / tor3 / tor4 (Tor Stream Isolation)

    Four dedicated, isolated Tor circuits, matching the wg1-wg4 WireGuard tunnel model exactly. One command, works the same way for every application:

    tor1 profanity -a user@example.onion
tor2 signal-desktop
tor3 element-desktop
tor4 gajim

    Whatever you run through tor1 never shares a circuit ~ or even a port ~ with anything run through tor2/tor3/tor4 or the default port (9050, which itself now also isolates by destination). The default port and all four dedicated ports are configured directly in torrc.

    Usage is seamless across every application type ~ tor1-tor4 auto-detect what they're launching and route it correctly without you needing to know or specify anything:

    • Plain CLI tools and GTK apps (curl, Gajim, Dino) route via torsocks, same as always.
    • Electron/Chromium apps (Signal, Element, confirmed) are detected automatically and routed via Chromium's own --proxy-server flag instead ~ torsocks's usual interception never reaches Electron's sandboxed networking, so this is necessary, not optional.
    • Detected Electron apps also get LD_PRELOAD stripped (alacritty's forced hardened_malloc wrapper otherwise gets inherited and crashes some Electron apps ~ confirmed with Signal) and XDG_CURRENT_DESKTOP overridden to GNOME (Chromium's keyring backend detection doesn't recognize sway, incorrectly reporting no supported keyring even when one is genuinely available ~ confirmed and fixed with Element).

    Known exception: Firefox-based browsers (LibreWolf) don't work reliably through torsocks at all ~ this is a known, documented limitation of torsocks itself for Firefox's multi-process architecture, not something specific to tor1-tor4. Configure LibreWolf's SOCKS5 proxy natively instead (about:preferences -> Network Settings). See the user guide for exact settings.

    lainos-privacy-help    # updated with a Tor Stream Isolation callout

    New Package ~ lainos-ram-wipe

    RAM-extraction attack defense, ported from Kicksecure/Whonix's ram-wipe: a dracut shutdown hook that wipes reclaimable disk cache from RAM at every reboot/poweroff, alongside init_on_alloc=1/init_on_free=1 kernel parameters that continuously poison memory pages on allocation and free.

    ram-wipe enable    # RAM wipe runs at shutdown/reboot (default)
ram-wipe disable   # skip the wipe pass, faster shutdown
ram-wipe status    # show current GRUB config and running kernel's cmdline

    Continuous protection (init_on_alloc/init_on_free) is always on and isn't affected by this toggle.

    ⚠️ Known limitation: the dracut module is confirmed correctly installed and baked into the initramfs, and multiple reboots with it active completed cleanly with no hangs ~ but the actual on-screen shutdown message could not be visually confirmed on Sway/wlroots test hardware, most likely due to how the GPU driver hands the screen back to a plain text console during that specific shutdown transition. If you can confirm this visually on your hardware, we'd like to hear about it.

    New Section ~ Sandboxed Build Requirements

    Some software (LibreWolf's own build process, confirmed) needs unprivileged user namespaces for its own build-time sandboxing, which LainOS locks down by default (kernel.unprivileged_userns_clone = 0, set via /etc/sysctl.d/99-lainos-hardening.conf). Temporarily enable it for builds that need it:

    doas sysctl -w kernel.unprivileged_userns_clone=1
# build your software
doas sysctl -w kernel.unprivileged_userns_clone=0    # restore afterward

    Resets to the hardened default automatically on reboot either way.

    Known Issues

    • Some Nvidia cards have trouble with Sway.

    Documentation

    • User guide: new "Tor Stream Isolation," "ram-wipe," and "Building Software ~ Sandboxed Build Requirements" sections; LESME's connect instructions updated to tor1; Tor section cross-references stream isolation.
    • Privacy Guide: "During your session" (step 6) updated with tor1-tor4 guidance, the single-instance-app caveat, and the LibreWolf exception.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.15-rc5 deb3df495b

    2026.07.15-rc5 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-16 01:30:36 +02:00 | 30 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    lainOS layer 02 ~ 2026.07.15-rc5 Changelog

    Fifth release candidate. Per-application Tor circuit isolation, and a RAM-extraction defense port from Whonix.

    This RC phase will continue until 2026.07.23, and layer 02 will be released as stable thereafter.

    First boot: getting online

    WiFi is off by default. To connect:

    wifi on
wscan

    Want WiFi to come up automatically on future boots instead? wifi-autostart enable.
    WiFi autoconnect is also disabled to preserve privacy, toggle it on with wifi-autoconnect enable

    New Tool ~ tor1 / tor2 / tor3 / tor4 (Tor Stream Isolation)

    Four dedicated, isolated Tor circuits, matching the wg1-wg4 WireGuard tunnel model exactly. One command, works the same way for every application:

    tor1 profanity -a user@example.onion
tor2 signal-desktop
tor3 element-desktop
tor4 gajim

    Whatever you run through tor1 never shares a circuit ~ or even a port ~ with anything run through tor2/tor3/tor4 or the default port (9050, which itself now also isolates by destination). The default port and all four dedicated ports are configured directly in torrc.

    Usage is seamless across every application type ~ tor1-tor4 auto-detect what they're launching and route it correctly without you needing to know or specify anything:

    • Plain CLI tools and GTK apps (curl, Gajim, Dino) route via torsocks, same as always.
    • Electron/Chromium apps (Signal, Element, confirmed) are detected automatically and routed via Chromium's own --proxy-server flag instead ~ torsocks's usual interception never reaches Electron's sandboxed networking, so this is necessary, not optional.
    • Detected Electron apps also get LD_PRELOAD stripped (alacritty's forced hardened_malloc wrapper otherwise gets inherited and crashes some Electron apps ~ confirmed with Signal) and XDG_CURRENT_DESKTOP overridden to GNOME (Chromium's keyring backend detection doesn't recognize sway, incorrectly reporting no supported keyring even when one is genuinely available ~ confirmed and fixed with Element).

    Known exception: Firefox-based browsers (LibreWolf) don't work reliably through torsocks at all ~ this is a known, documented limitation of torsocks itself for Firefox's multi-process architecture, not something specific to tor1-tor4. Configure LibreWolf's SOCKS5 proxy natively instead (about:preferences -> Network Settings). See the user guide for exact settings.

    lainos-privacy-help    # updated with a Tor Stream Isolation callout

    New Package ~ lainos-ram-wipe

    RAM-extraction attack defense, ported from Kicksecure/Whonix's ram-wipe: a dracut shutdown hook that wipes reclaimable disk cache from RAM at every reboot/poweroff, alongside init_on_alloc=1/init_on_free=1 kernel parameters that continuously poison memory pages on allocation and free.

    ram-wipe enable    # RAM wipe runs at shutdown/reboot (default)
ram-wipe disable   # skip the wipe pass, faster shutdown
ram-wipe status    # show current GRUB config and running kernel's cmdline

    Continuous protection (init_on_alloc/init_on_free) is always on and isn't affected by this toggle.

    ⚠️ Known limitation: the dracut module is confirmed correctly installed and baked into the initramfs, and multiple reboots with it active completed cleanly with no hangs ~ but the actual on-screen shutdown message could not be visually confirmed on Sway/wlroots test hardware, most likely due to how the GPU driver hands the screen back to a plain text console during that specific shutdown transition. If you can confirm this visually on your hardware, we'd like to hear about it.

    New Section ~ Sandboxed Build Requirements

    Some software (LibreWolf's own build process, confirmed) needs unprivileged user namespaces for its own build-time sandboxing, which LainOS locks down by default (kernel.unprivileged_userns_clone = 0, set via /etc/sysctl.d/99-lainos-hardening.conf). Temporarily enable it for builds that need it:

    doas sysctl -w kernel.unprivileged_userns_clone=1
# build your software
doas sysctl -w kernel.unprivileged_userns_clone=0    # restore afterward

    Resets to the hardened default automatically on reboot either way.

    Known Issues

    • Some Nvidia cards have trouble with Sway.

    Documentation

    • User guide: new "Tor Stream Isolation," "ram-wipe," and "Building Software ~ Sandboxed Build Requirements" sections; LESME's connect instructions updated to tor1; Tor section cross-references stream isolation.
    • Privacy Guide: "During your session" (step 6) updated with tor1-tor4 guidance, the single-instance-app caveat, and the LibreWolf exception.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.13 deb3df495b

    2026.07.13-rc4 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-13 10:47:13 +02:00 | 30 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    lainOS layer 02 ~ 2026.07.13-rc4 Changelog

    Fourth release candidate. FEATURES ARE NOW FROZEN UNTIL STABLE RELEASE.
    New automated privacy-mode tool, command renames for consistency, and more convenient wifi commands.

    This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    • ani-cli updated and CoplandOS shell prompt glyph fixed.
    • Volume keys work through wpctl

    The lainOS-layer02-user-guide now appears on first boot the first time you open the terminal. You must Press Ctrl+C to close it.

    First boot: getting online

    WiFi is off by default. To connect:

    wifi on   # Activates wireless interface
wscan   # Scans for networks and asks for password

    If you want wifi to auto start on subsequent boots, run wifi-autostart enable.

    To toggle on USB automounting across boots, use usb-automount enable.

    ⚠️ Wifi Commands

    Three commands were renamed for a more consistent naming scheme, these are the commands now:

    | wscan | Scan for networks and connect |
    | wifi on/off | Turn the WiFi radio on/off |
    | eth0 on/off | Turn the wired interface on/off |

    wifi and eth0 are now a consistent pair (both take on|off|status),
    with wscan as the separate, explicit connect step.

    New Tool ~ private-mode

    One-command automation of the full sensitive-work network sequence from
    the Privacy Guide.

    private-mode on       # forces WiFi/eth0 off, confirms the network is
                       # actually down, enables Snowflake + sdwdate,
                       # then brings WiFi/eth0 back up.
                      
private-mode off       # forces WiFi/eth0 off, confirms the network is
                       # actually down, then disables sdwdate(starting chrony) and stops Tor
                      
private-mode status    # shows current state of Snowflake, sdwdate,
                        # WiFi, and eth0 together
    • Single password prompt per direction, not per sub-step.
    • Enforces network-down-before-Tor/sdwdate-start on on, and
      network-down-before-sdwdate-disable on off ~ closing a plaintext-leak
      window that exists if either direction is done manually out of order.
    • Does not replace the manual verification steps in the Privacy Guide
      (nyx, lainos-sdwdate status) ~ private-mode automates the
      mechanical ordering, not the judgment call of confirming Tor actually
      bootstrapped and sdwdate actually synced.

    Read the Privacy Guide in full before relying on private-mode for
    anything that matters    . The guide opens with a warning to this effect.

    lainos-privacy-help

    WiFi Changes

    wscan no longer lets networks silently reconnect. Every successful
    connection now has AutoConnect disabled immediately afterward. The
    passphrase stays saved (so reconnecting later via wscan won't re-prompt
    for it), but iwd will never reconnect to a network on its own just
    because it's in range and the radio is up ~ every connection is something
    you deliberately chose.

    WiFi (iwd) does not start automatically at boot by default ~
    this was already true as of rc3 and remains unchanged. Use wifi-autostart enable to activate WiFi autostart on subsequent boots if you want that
    convenience back.

    wifi on           # power on the WiFi radio (was: wifi-toggle on)
wscan             # scan and connect
wifi-autostart enable   # enable wifi autostart(wifi starts automatically on each boot)

    New in this cycle ~ Ethernet Control

    eth0 (renamed from ethernet) brings the wired interface fully up or
    down, same on/off/status model as wifi:

    eth0 on
eth0 off
eth0 status

    While down, no DHCP request can fire even if a cable is plugged in ~ same
    privacy rationale as WiFi being off by default.

    Documentation

    • User guide: new "Ethernet" and "private-mode" sections; WiFi section
      updated for the wifi/wscan rename and the new AutoConnect
      behavior; command references updated throughout for all three renames.
    • New user guide is now shown automatically the first time a new user
      opens a terminal on a fresh install, so it can't be missed ~ shown
      exactly once per user via a marker file, never again after that.

    Known issues
    • Some Nvidia cards have trouble with Sway.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.11-rc3 deb3df495b

    2026.07.11-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-11 10:17:11 +02:00 | 30 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    lainOS layer 02 ~ 2026.07.10-rc3 Changelog

    Third release candidate to fix issues in second release candidate. This release is polished.

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    • ani-cli fixed!!!
    • Volume keys now work through wpctl

    ⚠️ To preserve privacy, WiFi does not autostart on first boot(read below for usage).

    WiFi (iwd) no longer starts automatically at first boot. Use wifi-autostart enable to activate WiFi autostart on subsequent boots. This is a deliberate change, consistent with lainOS's default-private posture elsewhere in the system (WiFi MAC randomization, ephemeral machine-id, boot clock randomization, time-sync over tor, IPv6 disabled by default etc...).

    To activate WiFi interface:

    wifi-toggle on

    To Scan for networks, use wifi (this tool prompts you to select your network and enter your password):

    wifi

    To activate WiFi autostart (start WiFi automatically at every boot):

    wifi-autostart enable

    See lainos-help for full documentation, or lainos-privacy-help for a guided walkthrough of using this alongside lainos-sdwdate and the new lainos-obfs4/lainos-snowflake bridge toggles for sensitive work.

    New Tools (lainos-utils)

    Tor Bridges ~ lainos-snowflake / lainos-obfs4

    Toggle scripts to enable/disable obfs4 or Snowflake pluggable transports, disguising Tor traffic to evade network-level censorship or hide Tor usage from your local network. Each writes a working bridge configuration on first use and toggles it on subsequent runs.

    snowflake enable    # or obfs4 enable
snowflake disable   # or obfs4 disable
snowflake status    # or obfs4 status

    WiFi Control ~ wifi-toggle / wifi-autostart

    • wifi-toggle {on|off|status} ~ fully powers the WiFi radio on/off (service + hardware rfkill block), not just disconnects.
    • wifi-autostart {enable|disable|status} ~ controls whether WiFi starts automatically at boot. Disabled by default for privacy (see warning above).

    Time Sync ~ lainos-sdwdate

    lainos-sdwdate enable   # activate time-sync over tor
lainos-sdwdate disable  # deactivate time-sync over tor; switches to chrony(default)
lainos-sdwdate status   # check if sdwdate or chrony is activated

    Toggle between chrony (default) and sdwdate (Tor-based). See New Packages below for details.

    Privacy Guide ~ lainos-privacy-help

    Opens a new, dedicated step-by-step privacy guide for sensitive work sessions, covering the correct order to enable WiFi controls, sdwdate, and bridges before connecting to any network, downloading Tor Browser safely over Tor, and returning to a clean default state afterward.

    New Packages

    sdwdate (new)

    Secure Distributed Web Date ~ Tor-based, fingerprint-resistant time synchronization. A lainOS port of Kicksecure/Whonix's sdwdate, fetching time from multiple independent Tor onion services and cross-validating against Tor's own network consensus data, instead of trusting plaintext, unauthenticated NTP.

    • Installed by default, but not enabled by default ~ chrony remains the active time-sync service out of the box. sdwdate has no fallback time source; if Tor is unreachable, it cannot sync time at all. Switching methods is a deliberate, local action: 
      lainos-sdwdate enable    # switch to Tor-based time-sync
lainos-sdwdate disable   # switch back to chrony (default)
lainos-sdwdate status    # check which is active
    • Verified working end-to-end on a fresh ISO install: real onion sources contacted, Tor consensus sanity checks passing, correct gradual clock correction applied via sclockadj.
    • Fresh-install log permission bug found and fixed during ISO testing ~ log file creation moved from the install-time hook into the init script's start_pre(), since the former was found not to reliably survive Calamares' chroot-based install process.
    • A separate first-sync permission bug was found and fixed after publishing: sdwdate's first-ever successful sync (or any hard clock jump) shells out to /bin/date directly rather than the gradual sclockadj path, and needed the same CAP_SYS_TIME capability grant.
    • See the package README for full technical details on what was ported, what was reimplemented for lainOS, and what was deliberately left out (AppArmor, privleap, Qubes-specific components).

    bootclockrandomization (new)

    Randomizes the system clock by a small amount (up to ±180 seconds) early in boot, before networking or Tor come up, so the machine's clock is never exactly aligned with another machine's during the boot window. A LainOS port of Kicksecure/Whonix's bootclockrandomization.

    • Installed and enabled by default ~ fully passive, no user decision or network dependency required.
    • Verified via a real reboot on baremetal (T480): fires correctly before networking, subsequently corrected to real time by the active time-sync service.

    snowflake-pt-client (new)

    Tor's official Snowflake pluggable transport client, packaged from upstream source. A dependency of lainos-snowflake.

    python-sdnotify (new)

    Small MIT-licensed Python implementation of the systemd sd_notify protocol, packaged from upstream source since it isn't available in Arch's official repos. A dependency of sdwdate.

    Bug Fixes

    • makepkg/doas: PACMAN_AUTH=(doas) is now shipped in the ISO's default /etc/makepkg.conf.
    • Tor control-port cookie access: DataDirectoryGroupReadable 1 (required alongside CookieAuthFileGroupReadable 1 for group-based access to Tor's control cookie, used by both nyx and sdwdate) confirmed present in the ISO's shipped torrc.

    Documentation

    • User guide fully updated: new "Pluggable Transports ~ Bridges," "Time Sync ~ sdwdate," and "Privacy Guide for Sensitive Work" sections; WiFi section updated with wifi-toggle/wifi-autostart; stale notes about LESME auto-configuring obfs4 removed.
    • New dedicated Privacy Guide for Sensitive Work, covering the correct sequencing of WiFi controls, sdwdate, bridges, and torbrowser-launcher for a single sensitive session.

    Known issues
    • Some Nvidia cards have trouble with Sway.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.10-rc3 deb3df495b

    2026.07.10-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-10 23:21:54 +02:00 | 30 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with 'lainos-help' in the terminal.)

    lainOS layer 02 ~ 2026.07.10-rc3 Changelog

    Third release candidate to fix issues in second release candidate

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    ⚠️ To preserve privacy, WiFi does not autostart on first boot(read below for usage).

    WiFi (iwd) no longer starts automatically at first boot. Use wifi-autostart enable to activate wifi autostart on each boot. This is a deliberate change, consistent with lainOS's default-private posture elsewhere in the system (WiFi MAC randomization, ephemeral machine-id, boot clock randomization, IPv6 disabled by default).

    To activate WiFi interface:

    wifi-toggle on

    To Scan for networks, use wifi (this tool prompts you to select your network and enter your password):

    wifi

    To activate WiFi autostart (start WiFi automatically at every boot):

    wifi-autostart enable

    See lainos-help for full documentation, or lainos-privacy-help for a guided walkthrough of using this alongside lainos-sdwdate and the new lainos-obfs4/lainos-snowflake bridge toggles for sensitive work.

    New Tools (lainos-utils)

    Tor Bridges ~ lainos-snowflake / lainos-obfs4

    Toggle scripts to enable/disable obfs4 or Snowflake pluggable transports, disguising Tor traffic to evade network-level censorship or hide Tor usage from your local network. Each writes a working bridge configuration on first use and toggles it on subsequent runs.

    lainos-snowflake enable    # or lainos-obfs4 enable
lainos-snowflake disable
lainos-snowflake status

    WiFi Control ~ wifi-toggle / wifi-autostart

    • wifi-toggle {on|off|status} ~ fully powers the WiFi radio on/off (service + hardware rfkill block), not just disconnects.
    • wifi-autostart {enable|disable|status} ~ controls whether WiFi starts automatically at boot. Disabled by default for privacy (see warning above).

    Time Sync ~ lainos-sdwdate

    Toggle between chrony (default) and sdwdate (Tor-based). See New Packages below for details.

    Privacy Guide ~ lainos-privacy-help

    Opens a new, dedicated step-by-step privacy guide for sensitive work sessions, covering the correct order to enable WiFi controls, sdwdate, and bridges before connecting to any network, downloading Tor Browser safely over Tor, and returning to a clean default state afterward.

    New Packages

    sdwdate (new)

    Secure Distributed Web Date ~ Tor-based, fingerprint-resistant time synchronization. A LainOS port of Kicksecure's sdwdate, fetching time from multiple independent Tor onion services and cross-validating against Tor's own network consensus data, instead of trusting plaintext, unauthenticated NTP.

    • Installed by default, but not enabled by default ~ chrony remains the active time-sync service out of the box. sdwdate has no fallback time source; if Tor is unreachable, it cannot sync time at all. Switching methods is a deliberate, local action: 
      lainos-sdwdate enable    # switch to Tor-based sync
lainos-sdwdate disable   # switch back to chrony (default)
lainos-sdwdate status    # check which is active
    • Verified working end-to-end on a fresh ISO install: real onion sources contacted, Tor consensus sanity checks passing, correct gradual clock correction applied via sclockadj.
    • Fresh-install log permission bug found and fixed during ISO testing ~ log file creation moved from the install-time hook into the init script's start_pre(), since the former was found not to reliably survive Calamares' chroot-based install process.
    • A separate first-sync permission bug was found and fixed after publishing: sdwdate's first-ever successful sync (or any hard clock jump) shells out to /bin/date directly rather than the gradual sclockadj path, and needed the same CAP_SYS_TIME capability grant.
    • See the package README for full technical details on what was ported, what was reimplemented for lainOS, and what was deliberately left out (AppArmor, privleap, Qubes-specific components).

    bootclockrandomization (new)

    Randomizes the system clock by a small amount (up to ±180 seconds) early in boot, before networking or Tor come up, so the machine's clock is never exactly aligned with another machine's during the boot window. A LainOS port of Kicksecure's bootclockrandomization.

    • Installed and enabled by default ~ fully passive, no user decision or network dependency required.
    • Verified via a real reboot on baremetal (T480): fires correctly before networking, subsequently corrected to real time by the active time-sync service.

    snowflake-pt-client (new)

    Tor's official Snowflake pluggable transport client, packaged from upstream source. A dependency of lainos-snowflake.

    python-sdnotify (new)

    Small MIT-licensed Python implementation of the systemd sd_notify protocol, packaged from upstream source since it isn't available in Arch's official repos. A dependency of sdwdate.

    Bug Fixes

    • makepkg/doas: PACMAN_AUTH=(doas) is now shipped in the ISO's default /etc/makepkg.conf.
    • Tor control-port cookie access: DataDirectoryGroupReadable 1 (required alongside CookieAuthFileGroupReadable 1 for group-based access to Tor's control cookie, used by both nyx and sdwdate) confirmed present in the ISO's shipped torrc.

    Documentation

    • User guide fully updated: new "Pluggable Transports ~ Bridges," "Time Sync ~ sdwdate," and "Privacy Guide for Sensitive Work" sections; WiFi section updated with wifi-toggle/wifi-autostart; stale notes about LESME auto-configuring obfs4 removed.
    • New dedicated Privacy Guide for Sensitive Work, covering the correct sequencing of WiFi controls, sdwdate, bridges, and torbrowser-launcher for a single sensitive session.

    Known issues
    • Some Nvidia cards have trouble with Sway.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.09-rc3 deb3df495b

    2026.07.09-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-10 07:08:38 +02:00 | 30 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with 'lainos-help' in the terminal.)

    lainOS layer 02 ~ RC3 Changelog

    Third release candidate to fix issues in second release candidate

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    • Relocated lainos-layer02-userguide.md from /usr/share/lainos into the lainos-utils package itself, so it can be updated in repo as features are added.

    lainos-utils

    • Added lainos-hardened-malloc ~ toggle script for system-wide hardened_malloc (enable/disable/status via LD_PRELOAD in /etc/environment).
    • Added lainos-help ~ opens the lainOS layer 02 user guide with glow -p.

    Known issues
    • Some Nvidia cards have trouble with Sway.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads
  • 2026.07.08-rc3 6e795c7c96

    2026.07.08-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-09 02:57:13 +02:00 | 32 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with 'lainos-help' in the terminal.)

    lainOS layer 02 ~ RC3 Changelog

    Third release candidate to fix issues in second release candidate

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    protocol7-core-Security Analysis(new valgrind section~zero mem leaks detected)

    Fixes were verified on baremetal and in KVM.

    lainos-utils

    • Added lainos-hardened-malloc ~ toggle script for system-wide hardened_malloc (enable/disable/status via LD_PRELOAD in /etc/environment).
    • Added lainos-help ~ opens the lainOS layer 02 user guide with glow -p.

    Critical Fixes

    • Kernel 7.1.3 initramfs regeneration regression fixed. Verified on baremetal 35eudev-coldplug dracut module now explicitly includes kmod/modprobe in the initramfs (previously relied on incidental staging that broke under kernel 7.1.3, causing i915/WiFi kernel modules to fail to load on the machine). Confirmed working via KVM guest kernel upgrade test (7.1.2 → 7.1.3), all modules loading correctly.

    Logging

    • syslog-ng now fully configured in /etc/syslog-ng.conf. Previously only daemon.log and everything.log were active; /var/log/messages itself was never written despite the config's stated purpose. Now enabled: messages, auth.log, cron.log, debug.log, errors.log, iptables.log, kernel.log, mail.log, messages.log, syslog.log, plus emergency-level broadcast to console.
    • Fixed Error resolving group; group='log' ~ the log group referenced by syslog-ng's config was never created on install. groupadd -r log added to shellprocess-final.

    KVM / Networking

    • Fixed KVM guest networking (DHCP worked, but guests could not reach the network). Root cause: the base nftables.conf forward chain had policy drop with zero rules, silently discarding all forwarded traffic before it ever reached libvirt's own NAT/forward rules.
    • New lainos-kvm-enable-firewall script, shipped with the lainos-kvm package. Adds the necessary virbr0 forward-accept rules to nftables.conf. This is opt-in (not applied automatically at install) to preserve the default-drop security posture for systems not using KVM. Run manually after installing lainos-kvm.

    Minor Fixes

    • tor system user shell corrected from /usr/bin/nologin (does not exist on this system) to /usr/bin/false.
    • libvirt-qemu system user shell corrected the same way, in lainos-kvm.install.

    Known issues
    • Some Nvidia cards have trouble with Sway (Follow Nvidia instructions above^^).

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads