amnesia
released this
2026-07-15 23:11:42 +02:00
| 11 commits to main since this release
lainos-utils-2.0-32 ~ 2026-07-15
Added
tor-tunnel ~ new binary providing tor1/tor2/tor3/tor4:
four dedicated, isolated Tor circuits, matching the wg-vpn/wg1-wg4
WireGuard tunnel model exactly (tor-tunnel installed once, symlinked
as tor1-tor4, dispatching on its own invoked name the same way
wg-vpn does). torrc now defines SocksPort 9050 (default,
IsolateDestAddr IsolateDestPort added) plus four additional
isolated ports (9052-9055), each paired with its own
torsocks-torN.conf. One command works identically across every
application type:
- Plain CLI tools and GTK apps (curl, Gajim, Dino) ~ routed via
torsocks.
- Electron/Chromium apps (Signal, Element) ~ auto-detected (via
app.asar/resources bundle detection, following exec targets
inside wrapper scripts, or an Electron/x.y.z binary marker) and
routed instead via Chromium's own --proxy-server flag, since
torsocks's LD_PRELOAD interception never reaches Electron's
sandboxed renderer-process networking.
- Detected Electron apps also get
LD_PRELOAD stripped automatically
(alacritty's forced hardened_malloc wrapper otherwise gets inherited
and crashes some Electron apps -- confirmed with Signal, which
aborted with fatal allocator error: invalid uninitialized allocator usage until this was added) and XDG_CURRENT_DESKTOP overridden to
GNOME (Chromium's keyring/safeStorage backend detection doesn't
recognize sway, incorrectly reporting "no supported keyring
backend" even when gnome-keyring-daemon's Secret Service is
genuinely available -- confirmed and fixed with Element).
- Firefox-based browsers (LibreWolf) are a confirmed, documented
exception -- torsocks is unreliable for Firefox's multi-process
networking; native proxy configuration is the correct approach
instead, documented in the user guide.
ram-wipe ~ new toggle command for the shutdown-time RAM wipe
(ram-wipe enable|disable|status), controlling the wiperam=skip
kernel cmdline flag via GRUB. Continuous protection (init_on_alloc=1/
init_on_free=1) is unaffected by this toggle -- it's always on. The
actual dracut module this toggles lives in the separate
lainos-ram-wipe package, ported from Kicksecure/Whonix's ram-wipe.
Not yet visually confirmed working -- correctly installed and
baked into the initramfs, multiple reboots completed cleanly with it
active, but the actual on-screen shutdown message could not be
confirmed visible on Sway/wlroots hardware during testing (see the
user guide for details).- LESME's connect instructions updated to
tor1 profanity -a ...,
isolating it from any other Tor traffic by default.
Verified
- Exit-IP comparison (
curl through 9050 vs. 9052) confirmed genuinely
different circuits/exit relays between ports -- isolation is real, not
just correctly configured.
- Live-tested against Signal, Element, Gajim, Dino, and LESME/Profanity;
all four confirmed working end-to-end.
Fixed
SocksPort bug caught during testing: adding an isolated SocksPort
line without also explicitly listing the default port removes the
default entirely (Tor only opens the implicit default when no
SocksPort lines are present at all) -- silently breaking any existing
default-port usage. Both the default and all isolated ports are now
listed explicitly in torrc.
Downloads