lainos-utils

A comprehensive suite of command-line utilities for network management, privacy enforcement, and system hardening on LainOS Layer 03.

Networking & Privacy

WiFi & Ethernet

• wifi {on|off|status}: Toggle the WiFi radio and iwd service.
• wscan: Interactive WiFi scanner and connector. Automatically randomizes your MAC address and prompts for passphrases.
• wifi-autoconnect {enable|disable|status}: Control whether wscan leaves AutoConnect enabled for networks after you connect to them.
• wifi-autostart {enable|disable|status}: Toggle whether the WiFi network stack starts automatically at boot.
• eth0 {on|off|status}: Bring the wired ethernet interface up or down, with automatic MAC randomization on startup.

DNS & Time Sync

• lainos-dns {plaintext|encrypted|private|status}: Switch the system DNS resolver seamlessly between DHCP fallbacks, DNS-over-TLS (dnscrypt/unbound), or Tor's DNSPort. Applications never need to be reconfigured.
• lainos-sdwdate {enable|disable|status}: Toggle between standard plaintext NTP (chrony) and Tor-based, fingerprint-resistant time synchronization (sdwdate).

Tor & Stream Isolation

• torctl {s|st|r|stat}: Quick wrapper to start, stop, restart, or check the Tor OpenRC service.
• snowflake {enable|disable|status}: Add and toggle Snowflake pluggable transport bridges in /etc/tor/torrc to bypass censorship.
• obfs4 {enable|disable|status}: Add and toggle obfs4 pluggable transport bridges.
• tor1, tor2, tor3, tor4: Run any application on a dedicated, permanently isolated Tor circuit. Automatically detects Electron/Chromium apps (like Signal or Element) and routes them via native proxy flags instead of torsocks.

VPN

• wg1 through wg4: Bring up WireGuard tunnels configured in /etc/wireguard/.
• wg1d through wg4d: Bring down the corresponding WireGuard tunnels.

Security & Hardening

• lainos-hardened-malloc {enable|disable|status}: Toggle the system-wide injection of GrapheneOS's hardened_malloc memory allocator via /etc/environment.
• ram-wipe {enable|disable|status}: Toggle the dracut shutdown hook that wipes reclaimable RAM to defend against cold-boot and RAM-extraction attacks.
• lainos-kloak: Launch kloak to anonymize keystroke timing patterns and prevent typing biometrics fingerprinting.
• usb-automount {enable|disable|status}: Toggle auto-mounting for ext-family USB drives. Disabled by default to prevent "Evil Maid" physical access attacks.
• bluetooth {setup|on|off|status}: Install bluez, manage the service, and hardware-block (rfkill) the Bluetooth radio to prevent MAC tracking.

Secure Communications

• lainos-secure-messaging: Interactive setup wizard for the LainOS Ephemeral Secure Messaging Environment (LESME). Generates random-identity GPG keys, configures pass for encrypted credential storage, and pre-configures the Profanity XMPP client with OMEMO encryption for use over isolated Tor circuits.

System & Hardware Utilities

• brightness <0-15>: Set the screen backlight brightness (0 = screen off, 15 = maximum).
• lainos-kernel-update: Fetches the latest gentoo-sources, applies the currently running kernel's .config, builds, installs, backs up the old kernel, and updates GRUB.
• lainos-kernel-config {interactive|amd-secure|intel-secure|nvidia-secure|libre-secure|build|status}: A secure, interactive tool to minimize your kernel attack surface and eliminate proprietary hardware blobs. Boot the live ISO with the generic kernel (supports all hardware), then run this tool to customize the kernel for your specific hardware before installing with Calamares:
  • amd-secure: Optimizes for AMD CPU/GPU, explicitly disabling Intel MEI, PXP, and NVIDIA Nouveau.
  • intel-secure: Optimizes for Intel CPU/GPU, while still stripping out the Intel Management Engine (MEI) and Protected Xe Path (PXP) DRM enclaves.
  • nvidia-secure: Enables the open-source Nouveau driver for NVIDIA GPUs, disables AMDGPU and Intel i915, and strips out Intel MEI/PXP. Note: Modern NVIDIA cards may require firmware blobs for full clock speeds.
  • libre-secure: The ultimate blob-free profile. Enables only open-source drivers (AMDGPU, Atheros ath9k), disables all Intel/AMD management engines, and completely disables Bluetooth to prevent firmware blob loading.
  • interactive: Drops you safely into make menuconfig with your current .config preserved.
  • build: Safely runs make oldconfig, compiles the kernel and modules, installs them, and updates GRUB.
  • status: Displays the current enabled/disabled state of key security-critical kernel drivers.

Built-in Documentation

LainOS includes comprehensive terminal-based guides rendered beautifully via glow:

• lainos-help: Opens the complete LainOS Layer 03 User Guide.
• lainos-privacy-help: Opens the Operational Privacy Guide detailing the exact sequence required for sensitive work sessions.
• lainos-quickstart-help: Opens the quick-start guide for first-time users.
• openrc-help: Opens the OpenRC cheat sheet for users transitioning from systemd.