lainOS/lainOS-layer-03

Fork 0

A systemd-free Gentoo-based Linux distribution built with OpenRC as PID 1, delivering native OpenRC service hardening (modeled on Kicksecure/Whonix systemd directives) and experimental traffic-analysis resistance, building upon the lainOS Layer 02 foundation.

Find a file

amnesia dae7243878 Update README.md		2026-08-10 18:35:47 +02:00
LICENSE	Initial commit	2026-08-10 18:13:20 +02:00
README.md	Update README.md	2026-08-10 18:35:47 +02:00

README.md

lainOS layer 03

A hardened, systemd-free Linux distribution built on Gentoo, with compile-time security policy enforcement, native OpenRC process isolation, and traffic-analysis resistance.

Overview
What's New in Layer 03
Architecture
Key Features
System Requirements
Building
Installation
Session Types
System Hardening
Network Configuration
lainos-utils
Troubleshooting
Project Structure
Contributing
License
Acknowledgments

Overview

lainOS Layer 03 is the next generation of the lainOS operating system. It preserves the hardened, privacy-first runtime of layer 02 while migrating the foundation from Arch Linux to Gentoo.

The result is a system where security policy is defined before compilation, not applied after installation. Compiler hardening, dependency selection, USE flag policy, and service architecture are all properties of the build system. Every official release is a pre-built SquashFS image produced by a deterministic pipeline ~ your installed system is identical to the one tested by the maintainer.

Like layer 02, layer 03 is systemd-free, OpenRC-native, AppArmor-enforced, and built for bare-metal daily use. Unlike layer 02, it requires no compatibility layer to achieve this ~ OpenRC is the native init system on Gentoo.

What's New in layer 03

Compile-Time Security

On layer 02, hardening was applied to pre-built binaries. On Layer 03, hardening is baked into the build itself:

Position Independent Executables (PIE) and Full RELRO on every binary
FORTIFY_SOURCE=3 and stack protection for buffer overflow detection
Control Flow Integrity (CFI) to restrict indirect function calls
Link-Time Optimization (LTO) to strip dead code paths

These are not post-install toggles. They are compiler defaults set in the Portage profile.

Native OpenRC Architecture

Layer 02 required Protocol 7 ~ a compatibility layer translating systemd assumptions into OpenRC. layer 03 eliminates this entirely:

No protocol7-core
No lainos-init, lainos-dbus-bridge, lainos-notifyd
No lainos-audio-init
No systemd ABI stubs, no elogind, no D-Bus facades

OpenRC is the native init system. Every service ships its own init script. The boot chain is simpler, faster, and fully legible.

OpenRC Process Isolation

Modern service containment (ProtectSystem=, PrivateTmp=, CapabilityBoundingSet=) is restored natively in OpenRC via bubblewrap integration:

rc_private_tmp="YES" ~ private /tmp per service
rc_protect_home="YES" ~ hidden /home and /root
rc_protect_system="STRICT" ~ read-only /usr and /boot
rc_capability_bounding_set="..." ~ minimal kernel capabilities

No fork of OpenRC. No Rust wrapper. No systemd code. Just declarative variables in /etc/conf.d/ that translate directly to kernel namespaces.

maybenot-tunnel Traffic Shaper

Defeats machine-learning-based Encrypted Traffic Analysis (ETA) by injecting dummy padding, manipulating burst intervals, and altering packet sizes downstream of your local egress. Works transparently across Tor circuits and VPN tunnels without application changes.

Toggle with maybenot-tunnel {enable|disable|status}.

Image-Based Deployment

Layer 02 installed packages on-target during Calamares execution. Layer 03 deploys a pre-built SquashFS image:

Every installation is bit-for-bit identical to the tested release
No package resolution during install
No configuration drift between systems
Recovery is unsquashfs, not rebuild

The SquashFS is the installation payload only. Once deployed to disk, the system is a fully writable Gentoo installation; users update normally via emerge, just like a traditional Gentoo system.

Architecture

Layer	Component	Role
Boot	GRUB ~ Dracut	UEFI/BIOS boot, initramfs with `dmsquash-live` and LUKS support
Init	`/sbin/openrc-init`	PID 1, explicit kernel cmdline
Live Session	`greetd` + `tuigreet`	TUI login manager on TTY1
Wayland	Sway + i3status-rs	Tiling compositor, autotiling, themed status bar
Installer	Calamares	Graphical system installer (autolaunches on liveuser login)
Isolation	`librc-sandbox` + `bwrap`	Namespace-based service containment

Boot Chain

BIOS/UEFI ~ GRUB ~ kernel + initramfs
  ~ Dracut: dmsquash-live mounts squashfs, execs /sbin/openrc-init
     ~ OpenRC sysinit: dbus, machine-id
        ~ OpenRC boot: cgroup-delegate, syslog-ng
           ~ OpenRC default: seatd, greetd, chrony, nftables, acpid, polkit
              ~ greetd ~ tuigreet ~ Sway session
                 ~ Sway ~ lainos-utils ~ user session

iwd is intentionally not in this default startup chain ~ WiFi stays off until you deliberately turn it on.

Key Features

System

systemd-free ~ OpenRC as PID 1 with no systemd binary present
Native OpenRC ~ no compatibility layer, no Protocol 7, no elogind
Live ISO ~ Fully bootable live environment with Calamares installer (autolaunches on login)
Dracut initramfs ~ Modern initramfs with live boot and LUKS/crypt support
BTRFS by default ~ with separate ext4 /boot for GRUB compatibility
Image-based install ~ pre-built SquashFS deployed to disk, not assembled during install

Compile-Time Hardening

PIE + Full RELRO ~ all binaries position-independent with protected GOT
FORTIFY_SOURCE=3 ~ automated buffer overflow detection
Stack protection ~ -fstack-protector-strong on all compiled code
CFI + LTO ~ control-flow integrity and dead-code elimination
USE flag minimization ~ unused features stripped at compile time per package

Desktop (Sway/Wayland)

Sway 1.12+ tiling compositor with custom keybindings
i3status-rs themed status bar
wofi application launcher
alacritty terminal emulator
mako notification daemon
swaybg static wallpaper
Autotiling automatic window tiling
Powerlevel10k zsh prompt
CoplandOS-GTK dark theme with StarLabs cursor
wlogout session/power menu
swaylock screen locker with wallpaper background
gnome-keyring secrets service backend for Electron apps
PipeWire audio, bundled by default

Service Isolation

Bubblewrap integration ~ declarative namespace isolation in OpenRC runscripts
Private tmpfs per service (rc_private_tmp)
Read-only system binds (rc_protect_system)
Capability bounding ~ stripped to minimum required (rc_capability_bounding_set)
Complements AppArmor ~ namespaces restrict what; AppArmor restricts where

System Hardening

AppArmor mandatory access control ~ per-daemon profiles for the full stack: DNS chain (dnsmasq, unbound, dnscrypt-proxy), networking (tor, iwd, dhcpcd), media (pipewire, wireplumber, mpv, vlc), crypto (gpg, keepassxc), browsers (librewolf, Tor Browser), and system utilities. Loaded at boot before services start.
hardened_malloc (GrapheneOS, light variant) ~ systemwide toggle; preloaded for eligible binaries
ram-wipe ~ RAM-extraction attack defense via dracut shutdown hook, plus continuous init_on_alloc/init_on_free poisoning
Kernel memory hardening ~ init_on_alloc=1, init_on_free=1, page_alloc.shuffle=1
Full ASLR ~ randomize_va_space=2
ptrace restricted ~ yama.ptrace_scope=1
kexec disabled ~ kexec_load_disabled=1
Unprivileged user namespaces disabled ~ unprivileged_userns_clone=0
Core dumps disabled
IPv6 disabled by default (prevents VPN leaks)
SYN flood protection, ICMP redirect rejection, reverse path filtering
Kernel pointer restriction (kptr_restrict=2)
dmesg restricted to root only
Magic SysRq disabled
CPU RNG not unconditionally trusted (random.trust_cpu=off)
Ephemeral machine-id ~ regenerated on every boot
Boot clock randomization ~ ±180 seconds before networking
WiFi off by default ~ iwd does not start automatically; toggle with wifi/wifi-autostart
iwd MAC randomization ~ new MAC every time iwd starts
Ethernet MAC randomization ~ available via eth0 toggle
Optional Tor-based time sync ~ sdwdate (opt-in)
Optional Tor pluggable transports ~ snowflake/obfs4 toggles
Tor stream isolation ~ default SocksPort isolates by destination; four dedicated circuits (tor1-tor4) for per-application isolation with automatic Electron app detection
private-mode ~ one command for sensitive-work sequence: forces network down, enables snowflake/sdwdate, switches dnsmasq to Tor DNSPort; reverses safely restoring previous DNS mode
nftables firewall ~ default-deny with established/related allowed
yescrypt password hashing
doas instead of sudo (minimal attack surface)
LUKS full disk encryption ~ opt-in at install, confirmed working
Signed release artifacts ~ detached signatures + SHA-256 checksums

Traffic Analysis Resistance

maybenot-tunnel ~ defeats ETA by injecting dummy padding and manipulating packet timing across all egress traffic. Toggle: maybenot-tunnel {enable|disable|status}

Networking

iwd for WiFi ~ off by default
dhcpcd + openresolv for wired DHCP
dnsmasq as centralized DNS mediator ~ blind forwarding resolver, no caching, three modes:
- Plaintext (default) ~ DHCP-provided resolver with fallbacks
- Encrypted ~ dnsmasq → unbound (DNSSEC validation, QNAME minimization, caching) → dnscrypt-proxy (wire encryption, anonymized relay routing). No single component sees both your IP and your query.
- Private ~ Tor DNSPort on 127.0.0.1:9059
chrony for NTP (default) or sdwdate (opt-in Tor-based alternative)
nftables for firewall management
No NetworkManager, no systemd-networkd, no systemd-resolved

System Requirements

Minimum

64-bit x86_64 processor
2 GB RAM
4 GB USB drive or free disk space
UEFI or BIOS boot support

Tested Hardware

QEMU/KVM with Virtio GPU
ThinkPad T480 (Libreboot) ~ designed for compatibility with UEFI and BIOS boot systems, includes LUKS FDE with BTRFS as the default filesystem type

Building

Prerequisites

Build Host: Gentoo Linux with OpenRC, or any Linux distribution capable of chroot operations.

Required packages (on Gentoo):

emerge -uv app-portage/ebuild app-portage/gentoolkit \
  sys-fs/squashfs-tools sys-boot/grub sys-kernel/dracut

Build Steps

Clone the repository:

git clone https://forgejo.lain.rocks/lainOS/lainos-iso-layer-03.git
cd lainos-iso-layer-03

Run the build script:

doas ./build-lainos.sh

The script will:

Download and extract a Gentoo Stage 3 (OpenRC variant)
Enter a chroot and sync the Portage tree
Inject the ::lainos overlay and profile
Emerge @world and app-lainos/lainos-desktop
Configure OpenRC services, AppArmor, and live environment settings
Generate a dracut initramfs with dmsquash-live
Compress the rootfs into a SquashFS image
Assemble the bootable ISO with GRUB

Hash the ISO:

lainos-hash-iso

The resulting ISO will be at /var/tmp/lainos-out/lainOS-layer-03-YYYY.MM.DD-x86_64.iso.

Overlay Repository

All custom packages are maintained in the ::lainos overlay. The overlay contains:

Package	Purpose
`lainos-utils`	Utility scripts (includes `lainos-dns`)
`lainos-ram-wipe`	RAM wipe on shutdown
`lainos-hardened-malloc`	GrapheneOS hardened_malloc wrapper
`lainos-keyring`	Project signing keys
`lainos-apparmor`	AppArmor profiles + OpenRC loader
`lainos-calamares-config`	Installer configuration
`lainos-calamares-dracut`	Calamares + dracut integration
`lainos-kernel-backup`	Kernel backup utility
`sdwdate`	Tor-based secure time sync (Whonix port)
`bootclockrandomization`	Boot-time clock jitter (Whonix port)
`maybenot-tunnel`	Traffic analysis resistance

Deploying packages to the overlay

cd ~/lainos-overlay
# Edit ebuild, bump version, generate Manifest
ebuild app-lainos/<package>/<package>-<version>.ebuild manifest
git add .
git commit -m "bump <package> to <version>"
git push

Installation

Live Boot

Write the ISO to a USB drive:

doas dd if=~/lainos-out/lainOS-layer-03-*.iso of=/dev/sdX bs=4M status=progress oflag=sync

Boot from USB and select lainOS Layer 03 from the bootloader.
At the tuigreet login screen, login as liveuser (no password required). Calamares launches automatically.

Installing to Disk

Calamares launches automatically on liveuser login.

Follow the installer wizard. To enable full disk encryption, select Encrypt system on the partition screen. LUKS unlock at boot is handled by dracut's crypt module.

Note on filesystem: BTRFS is the default. A separate 1GB ext4 /boot partition is created automatically for GRUB compatibility.

Post-Install Notes

WiFi: off by default ~ run wifi on (or wifi-autostart enable to restore auto-start at boot), then wscan
Privilege escalation: doas (not sudo)
Power menu: wlogout
Lid close: automatically locks screen with swaylock and suspends
Audio: PipeWire is bundled by default
Time sync: chrony (plaintext NTP) is the default; sdwdate (Tor-based) is installed but not enabled ~ toggle with lainos-sdwdate enable
Traffic shaping: maybenot-tunnel is available but not enabled by default ~ toggle with maybenot-tunnel enable
A short quick-start guide (lainos-quickstart-help) opens automatically the first time a new user opens a terminal; the full guide (lainos-help) is always available

Session Types

Sway (Wayland)

lainOS Layer 03 is currently a Wayland-only distribution(x11 can be added if desired). The desktop is Sway with i3status-rs.

Keybindings:

Key	Action
`Mod4+Return`	Open terminal (alacritty + tmux)
`Mod4+Space`	Open application launcher (wofi)
`Mod4+Shift+q`	Close focused window
`Mod4+1-9`	Switch to workspace
`Mod4+Shift+1-9`	Move window to workspace
`Mod4+h/j/k/l`	Focus left/down/up/right
`Mod4+Shift+h/j/k/l`	Move window left/down/up/right
`Mod4+w`	Open LibreWolf

Full keybinding list in lainos-help.

System Hardening

Kernel Parameters

GRUB_CMDLINE_LINUX:

random.trust_cpu=off init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1

sysctl Configuration

/etc/sysctl.d/99-lainos-hardening.conf:

# Network
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.rp_filter = 1

# Kernel
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.sysrq = 0
kernel.yama.ptrace_scope = 1
kernel.kexec_load_disabled = 1
kernel.unprivileged_userns_clone = 0
kernel.randomize_va_space = 2

# Filesystem
fs.suid_dumpable = 0
kernel.core_pattern = |/bin/false

Building software with sandboxed build requirements

Some software needs unprivileged user namespaces for its own build-time sandboxing. Temporarily enable it:

doas sysctl -w kernel.unprivileged_userns_clone=1
# build your software
doas sysctl -w kernel.unprivileged_userns_clone=0

Resets to the hardened default automatically on reboot.

AppArmor Mandatory Access Control

The lainos-apparmor package provides an OpenRC init script that loads profiles at boot before the daemons start. Profiles cover the full stack:

DNS chain: dnsmasq, unbound, dnscrypt-proxy
Networking: tor, iwd, dhcpcd, chronyd
Media: pipewire, wireplumber, mpv, vlc
Crypto/Secrets: gpg, gpg-agent, keepassxc
Browsers: librewolf, Tor Browser
System: ssh, sshd, nft, syslog-ng

Path-based MAC complements namespace isolation: if an attacker escapes the private mount namespace, AppArmor still blocks access to real user data and sensitive kernel interfaces.

Service Isolation

OpenRC runscripts use librc-sandbox to invoke bubblewrap with declarative security variables:

Variable	Effect
`rc_private_tmp="YES"`	Private `/tmp` per service
`rc_protect_home="YES"`	Hidden `/home` and `/root`
`rc_protect_system="STRICT"`	Read-only `/usr` and `/boot`
`rc_capability_bounding_set="..."`	Stripped kernel capabilities

Verified via direct /proc/<pid>/mounts inspection and adversarial testing.

hardened_malloc

GrapheneOS hardened_malloc (light variant) is preloaded via LD_PRELOAD wrappers for:

alacritty, gnome-keyring-daemon, keepassxc, kleopatra, mpv, tor

Incompatible applications: librewolf, torbrowser-launcher, signal, thunar. Launched through tor1-tor4 automatically strips LD_PRELOAD for detected Electron apps.

Full Disk Encryption

LUKS encryption is supported and confirmed working via Calamares (opt-in at install time). Unlock at boot is handled by dracut's crypt module.

Network Configuration

DNS

All applications resolve through 127.0.0.1:53 (dnsmasq). The operating system controls resolver policy; applications require no configuration changes.

Modes:

Plaintext (default) ~ DHCP-provided resolver with fallbacks to 1.1.1.1/9.9.9.9
Encrypted ~ dnsmasq → unbound (DNSSEC, caching) → dnscrypt-proxy (encrypted transport, anonymized relay). No single component sees both your IP and your query.
Private ~ Tor DNSPort on 127.0.0.1:9059 (private-mode on)

Mode transitions are explicit and stateful; private-mode remembers and restores your previous mode on exit.

lainos-dns plaintext    # Plaintext fallbacks
lainos-dns encrypted    # Encrypted: unbound + dnscrypt-proxy
lainos-dns private      # Tor DNSPort, via private-mode
lainos-dns status       # Show current mode and full chain status

WiFi (iwd)

Off by default. Turn on and connect using lainos-utils:

wifi on
wscan

Or manually:

doas rc-service iwd start
iwctl
[iwd]# station wlan0 scan
[iwd]# station wlan0 get-networks
[iwd]# station wlan0 connect SSID

MAC randomization happens automatically every time iwd starts.

Wired (dhcpcd)

Automatic on boot via dhcpcd in the default runlevel. Toggle the interface and randomize its MAC with eth0 {on|off|status}.

lainos-utils

A set of utility scripts included with lainOS Layer 03:

Script	Command	Purpose
wscan	`wscan`	iwd scan and connect with numbered menu
wifi	`wifi {on\|off\|status}`	Full WiFi radio on/off
wifi-autostart	`wifi-autostart {enable\|disable\|status}`	Auto-start iwd at boot
eth0	`eth0 {on\|off\|status}`	Wired interface + MAC randomization
wg-vpn	`wg1`/`wg1d` ~ `wg4`/`wg4d`	WireGuard VPN tunnel up/down
torctl	`torctl`	Start/stop Tor routing
snowflake	`snowflake {enable\|disable\|status}`	Toggle Snowflake bridge
obfs4	`obfs4 {enable\|disable\|status}`	Toggle obfs4 bridge
lainos-sdwdate	`lainos-sdwdate {enable\|disable\|status}`	Toggle chrony/sdwdate
tor-tunnel	`tor1`/`tor2`/`tor3`/`tor4`	Dedicated isolated Tor circuits
private-mode	`private-mode {on\|off\|status}`	Sensitive-work sequence
ram-wipe	`ram-wipe {enable\|disable\|status}`	Toggle shutdown RAM wipe
kloak	`kloak`	Keystroke anonymization
lainos-dns	`lainos-dns {plaintext\|encrypted\|private\|status}`	DNS mode toggle
maybenot-tunnel	`maybenot-tunnel {enable\|disable\|status}`	Traffic analysis resistance
lainos-hardened-malloc	`lainos-hardened-malloc {enable\|disable\|status}`	Toggle system-wide
lainos-help	`lainos-help`	Open user guide
lainos-privacy-help	`lainos-privacy-help`	Privacy guide for sensitive sessions
lainos-quickstart-help	`lainos-quickstart-help`	Quick-start checklist

Troubleshooting

Build Logs

Build output is logged to /var/tmp/lainos-build.log on the build host.

Daemon Logs

Services log to /var/log/daemon.log:

doas tail -f /var/log/daemon.log

Verifying Security Posture

doas lainos-security-status              # read-only status dashboard

WiFi Soft-Blocked After Boot

On Libreboot systems with thinkpad_acpi, wifi may be soft-blocked on boot. Handled automatically via rfkill-unblock in the boot runlevel. If manual intervention is needed:

doas rfkill unblock all
doas rc-service iwd restart

Electron App Keyring Mismatch

If an Electron app reports a keyring backend mismatch, it was launched with different XDG_CURRENT_DESKTOP values. Always launch consistently, or reset the app's local profile.

Project Structure

lainos-layer03/
├── build-lainos.sh              # Main build script
├── overlay/                     # ::lainos Portage overlay
│   ├── app-lainos/             # Custom packages
│   ├── profiles/lainos/        # Portage profile
│   └── metadata/
├── iso-profile/                 # ISO assembly config
│   ├── grub.cfg
│   └── ...
├── scripts/                     # Helper scripts
└── docs/                        # Specifications and manuals

Contributing

lainOS is developed by Grayson Giles and the lainOS community.

Website: https://lainos.net

Reporting Issues

Please include:

ISO version/date
Hardware/VM configuration
rc-status output
Relevant logs from /var/log/daemon.log or dmesg

License

lainOS Layer 03 is released under the GNU General Public License v3.0.

Individual components (Sway, OpenRC, Calamares, etc.) retain their respective licenses.

Acknowledgments

Gentoo Linux ~ The foundation everything is built on
OpenRC ~ Reliable, predictable init system
GrapheneOS ~ hardened_malloc
Sway/wlroots ~ Modern Wayland compositor ecosystem
Calamares ~ User-friendly system installer
Kicksecure/Whonix ~ sdwdate, bootclockrandomization, ram-wipe, and security architecture inspiration
maybenot ~ Traffic analysis resistance framework

Last updated: 2026-08-09 Status: In Development

README.md

lainOS layer 03

Table of Contents

Overview

What's New in layer 03

Compile-Time Security

Native OpenRC Architecture

OpenRC Process Isolation

maybenot-tunnel Traffic Shaper

Image-Based Deployment

Architecture

Boot Chain

Key Features

System

Compile-Time Hardening

Desktop (Sway/Wayland)

Service Isolation

System Hardening

Traffic Analysis Resistance

Networking

System Requirements

Minimum

Recommended

Tested Hardware

Building

Prerequisites

Build Steps

Overlay Repository

Deploying packages to the overlay

Installation

Live Boot

Installing to Disk

Post-Install Notes

Session Types

Sway (Wayland)

System Hardening

Kernel Parameters

sysctl Configuration

Building software with sandboxed build requirements

AppArmor Mandatory Access Control

Service Isolation

hardened_malloc

Full Disk Encryption

Network Configuration

DNS

WiFi (iwd)

Wired (dhcpcd)

lainos-utils

Troubleshooting

Build Logs

Daemon Logs

Verifying Security Posture

WiFi Soft-Blocked After Boot

Electron App Keyring Mismatch

Project Structure

Contributing

Reporting Issues

License

Acknowledgments