LainOS Layer 02 / Protocol 7 ~ Master Reference Document

Date: 2026-07-04 Build Host: LainOS Layer 02 baremetal (lain@navi, Intel i7-8650U, Libreboot/BIOS, ThinkPad T480) Status: Feature complete. Security hardened. Signed repositories. Beta ~ pending RC after next systemd-libs update cycle.

---

Protocol 7 is not in a position to own your whole system. Systemd, by contrast, is.

Project Overview

LainOS Layer 02 is a custom Arch Linux-based distribution built around Protocol 7 ~ a systemd-free init architecture using OpenRC as PID 1 with a custom C daemon compatibility layer. It is a pure Arch Linux derivative ~ every package comes from official Arch repos or LainOS's own self-hosted, signed repositories. No third-party distribution repositories are used.

Philosophy: Sovereign computing, minimal trust, transparent architecture. Aesthetic and technical identity rooted in Serial Experiments Lain.

Community: r/LainOSdevelopers, Matrix, Discord, XMPP, IRC (#LainOS on libera.chat), lainos.net

---

Hardware

Machine	Role	Specs
Layer 02 baremetal	Build host + daily driver	Intel i7-8650U, Libreboot/BIOS, ThinkPad T480, NVMe
Layer 02 KVM	Test environment	QEMU/KVM on Layer 02 baremetal

T480 fan control: thinkpad_acpi requires force_load=1 under Libreboot. Side effect: wifi soft-blocked on boot, fixed by /etc/local.d/rfkill-unblock.start. Fan and thermal sensors work after module load.

---

Architecture ~ Protocol 7

Core Concept

• OpenRC as PID 1 (/sbin/init symlink to openrc-init)
• Real systemd-libs for ABI compatibility (not mock/stub ~ real package, permanent design)
• Real eudev as udev implementation (not systemd-udev)
• Custom C daemons filling behavioral gaps left by removing systemd
• doas instead of sudo
• dracut for initramfs (not mkinitcpio)
• greetd + tuigreet as display manager
• sway as Wayland compositor (Wayland only ~ no X11)
• Calamares as graphical installer

Protocol 7 Core Daemons (/usr/libexec/lainos/)

Daemon	Purpose	Security
lainos-dbus-bridge	Implements org.freedesktop.login1 D-Bus facade	Drops to nobody, seccomp-hardened, fuzz tested (dfuzzer + AddressSanitizer ~ Exit status 0)
lainos-ghost-units	Creates /run/systemd/* ghost directories	One-shot, exits immediately
lainos-notifyd	sd_notify socket sink	Drops to nobody, seccomp-hardened, rate-limited, fuzz tested (libFuzzer + ASan/UBSan, 2M execs, 0 crashes)
lainos-audio-init	Spawns PipeWire stack	Runs as user, not root
lainos-init	Session initializer (XDG_RUNTIME_DIR, Wayland)	Compositor whitelist enforced

protocol7-core version: 5.5.3-19 Comparison: systemd is ~1.28 million LOC

---

Security

Protocol 7 Has a Smaller Attack Surface Than systemd

• A few thousand lines vs ~1.28 million LOC in systemd
• All daemons drop to nobody within seconds of startup ~ systemd-logind runs as root for the lifetime of the system
• No network-facing components ~ systemd-resolved has had real remote code execution CVEs
• Single-user architecture ~ eliminates entire classes of multi-user attack surface
• Damage ceiling: even if exploited, worst case is a crashed desktop session that doesn't interrupt running apps

Fuzz Testing

The two Protocol 7 components that parse untrusted external bytes have both been fuzz tested:

lainos-dbus-bridge (org.freedesktop.login1 D-Bus interface):

• dfuzzer 2.6 ~ full interface ~ Exit status: 0, all methods and properties PASS
• AddressSanitizer instrumented build ~ Exit status: 0, no memory errors detected
• A systematic pointer type bug was found and fixed in 5.5.3-12. Seven methods and properties were affected. All fixed.

lainos-notifyd (sd_notify UNIX socket sink):

• libFuzzer (clang-18, ASan+UBSan) targeting the message-parsing path ~ 2,000,000 executions, coverage plateaued, zero crashes, zero leaks

Signed Package Repositories

Both protocol_7_repo and lainos_repo use SigLevel = Required. All packages and databases are signed with the LainOS maintainer PGP key (456F268D14C9ECCE1A77355803E8F5B63BAC3998). lainos-keyring ships the public key. No CI/CD infrastructure ~ entire build chain runs on maintainer-controlled hardware.

System Hardening

• Kernel params: init_on_alloc=1, init_on_free=1, page_alloc.shuffle=1, random.trust_cpu=off
• sysctl: ptrace restricted, kexec disabled, unprivileged userns disabled, full ASLR, core dumps disabled
• hardened_malloc: GrapheneOS light variant preloaded for alacritty, element, gnome-keyring-daemon, keepassxc, kleopatra, mpv, tor
• LUKS FDE: Supported via Calamares, dracut crypt + crypt-lib modules, confirmed working baremetal
• Privacy: Ephemeral machine-id, iwd MAC randomization, IPv6 disabled, nftables default-deny
• Build flags: All Protocol 7 binaries compiled with -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2

---

Repository Structure

Forgejo (self-hosted at forgejo.lain.rocks, username: amnesia)

/home/lain/Forgejo/
~~ lainos-iso-layer-02/lainos-iso-layer-02/protocol7-profile/   ISO build profile
~~ lainos-calamares-config-layer-02/etc/calamares/              Calamares config
~~ protocol-7-core/
~  ~~ protocol-7-core-openrc/protocol7-core-v5.5.3-19/          OpenRC variant (main)
~  ~~ protocol7-core-runit/                                      Runit variant
~~ lainos-openrc/
~  ~~ openrc/                                                    openrc PKGBUILD + patches
~  ~~ lainos-openrc-packages/
~     ~~ acpid-openrc/, chrony-openrc/, dhcpcd-openrc/
~     ~~ greetd-openrc/, iwd-openrc/, nftables-openrc/
~     ~~ seatd-openrc/, syslog-ng-openrc/, tor-openrc/
~~ lainos-utils/                                                 lainos-utils source
~~ lainos-keyring/                                               lainos-keyring source

GitLab (package hosting)

/home/lain/Gitlab/
~~ protocol_7_repo/x86_64/   Main package repo (signed, SigLevel = Required)
~~ lainos_repo/x86_64/       Secondary repo (signed, SigLevel = Required)

protocol_7_repo URL: https://gitlab.com/lainos/protocol_7_repo/-/raw/main/x86_64/ lainos_repo URL: https://gitlab.com/lainos/lainos_repo/-/raw/main/x86_64/

Deploy script: bash lainos-repo-push from within each repo's x86_64 directory ~ signs all packages and database, removes symlinks, renames .tar.gz, commits and pushes.

---

ISO Build Profile

Location: ~/Forgejo/lainos-iso-layer-02/lainos-iso-layer-02/protocol7-profile/ ISO output: ~/lainos-out/ ISO naming: lainOS-layer-02-YYYY.MM.DD-x86_64.iso

Build command:

doas mkarchiso -v -w ~/lainos-work -o ~/lainos-out \
  ~/Forgejo/lainos-iso-layer-02/lainos-iso-layer-02/protocol7-profile

Hash ISOs after build:

lainos-hash-iso

Key Profile Files

pacman.conf (ISO profile):

[protocol_7_repo]
SigLevel = Required
Server = https://gitlab.com/lainos/protocol_7_repo/-/raw/main/x86_64/
[lainos_repo]
SigLevel = Required
Server = https://gitlab.com/lainos/lainos_repo/-/raw/main/x86_64/
[core]
Include = /etc/pacman.d/mirrorlist

99-protocol7.conf (dracut):

add_dracutmodules+=" dmsquash-live rootfs-block fs-lib kernel-modules crypt crypt-lib "
omit_dracutmodules+=" systemd systemd-initrd systemd-udev ... i18n "
force_drivers+=" sr_mod cdrom ata_generic nvme_core nvme_auth nvme_keyring nvme btrfs "
hostonly="no"
hostonly_cmdline="no"
use_systemd="no"

Calamares dracut.conf:

kernel: linux
initramfsName: "/boot/initramfs-linux.img"
options: [ "--no-hostonly", "--no-compress", "--no-uefi" ]

Default runlevel contents:

acpid, chrony, greetd, iwd, lainos-dbus-bridge,
local, netmount, nftables, polkit, seatd

Note: agetty.tty1 excluded via NoExtract ~ greetd owns tty1. lainos-notifyd lives in sysinit (not default) ~ its own depend() requires it start before seatd.

---

System pacman.conf (installed system)

[options]
NoExtract = etc/runlevels/default/agetty.tty1
NoExtract = usr/share/wayland-sessions/sway.desktop
NoExtract = etc/greetd/config.toml
NoExtract = etc/passwd
NoExtract = etc/shadow
NoExtract = etc/group
NoExtract = etc/resolv.conf
NoExtract = etc/pam.d/login
NoExtract = etc/systemd/*
NoExtract = usr/lib/systemd/*
NoExtract = usr/share/systemd/*
NoExtract = usr/share/libalpm/hooks/dbus-reload.hook
NoExtract = etc/machine-id
NoExtract = usr/share/applications/calamares.desktop
Architecture = auto
Color
CheckSpace
VerbosePkgLists
ParallelDownloads = 10
SigLevel          = Required DatabaseOptional
LocalFileSigLevel = Optional
IgnorePkg   = systemd-sysvcompat systemd-resolvconf systemd-ukify systemd-boot systemd-homed systemd-journal-remote dbus-broker mkinitcpio-openswap
NoUpgrade   = usr/bin/lainos-*
NoUpgrade   = usr/lib/lainos/*
[protocol_7_repo]
SigLevel = Required
Server = https://gitlab.com/lainos/protocol_7_repo/-/raw/main/x86_64/
[lainos_repo]
SigLevel = Required
Server = https://gitlab.com/lainos/lainos_repo/-/raw/main/x86_64/
[core]
Include = /etc/pacman.d/mirrorlist
[extra]
Include = /etc/pacman.d/mirrorlist
[multilib]
Include = /etc/pacman.d/mirrorlist

---

Calamares Installer

Key Config Files

Location: ~/Forgejo/lainos-calamares-config-layer-02/etc/calamares/

shellprocess-final.conf key operations:

• rc-update add for all services (lainos-ghost-units and cgroup-delegate in boot, lainos-notifyd in sysinit, others in default)
• rc-update del etmpfiles-dev sysinit, rc-update del etmpfiles-setup boot, rc-update del esysusers boot
• ln -sf openrc-init /sbin/init
• pacman-key --populate lainos
• usermod -a -G tor,video,audio,wheel,storage,network,seat ${USER}
• chsh -s /bin/zsh ${USER}
• printf 'permit persist :wheel\npermit nopass :wheel cmd tee\npermit nopass :wheel cmd openrc-shutdown\npermit nopass :wheel cmd lainos-suspend\n' > /etc/doas.conf
• cp /etc/greetd/config.toml.lainos-default /etc/greetd/config.toml
• pacman -Rn --noconfirm lainos-calamares-config-layer-02 lainos-calamares-dracut mkinitcpio-openswap

partition.conf key settings:

• defaultFileSystemType: "btrfs" ~ BTRFS is default
• partitionLayout: includes separate 1G ext4 /boot ~ required for GRUB + BTRFS compatibility

Calamares Session Log

doas grep -n "" /root/.cache/calamares/session.log | sed -n 'START,ENDp'

---

Boot Chain

BIOS/UEFI ~ GRUB ~ dracut initramfs (eudev coldplug, LUKS unlock if FDE)
~ OpenRC (PID 1)
~ sysinit: dbus, lainos-notifyd, lainos-machine-id
~ boot: cgroup-delegate, lainos-ghost-units, syslog-ng
~ default: seatd, lainos-dbus-bridge, iwd, acpid, greetd, polkit, chrony, nftables
~ greetd/tuigreet (tty1)
~ Sway session ~ lainos-init ~ lainos-audio-init ~ PipeWire + apps

---

Key Established Rules

1. doas not sudo on Layer 02 everywhere
2. Signed packages: run bash lainos-repo-push from within each repo after adding packages
3. options: not dracut_args: in Calamares dracut.conf
4. initramfsName: "/boot/initramfs-linux.img" required
5. --no-uefi required in Calamares dracut options
6. All 4 NVMe modules in force_drivers: nvme_core nvme_auth nvme_keyring nvme
7. doas pacman -Scc before ISO rebuild when packages change
8. Never ${VAR} in shellprocess ~ use standalone scripts
9. Both pacman.conf files in profile root and airootfs must be kept in sync
10. cgroup-delegate and lainos-ghost-units belong in boot runlevel, not sysinit
11. lainos-notifyd belongs in sysinit (its own depend() requires "before seatd"); seatd belongs in default
12. etmpfiles-dev/setup and esysusers must be removed from runlevels (no matching binaries on Protocol 7)
13. lainos-repo-push script lives in each repo's x86_64 directory ~ run with bash lainos-repo-push

---

Multi-Init Protocol 7 Core Variants

The C daemon binaries are init-agnostic. Only service definition files change per init.

OpenRC (current/default)

• Services: /etc/init.d/<service> (.initd files)
• Enable: rc-update add <service> <runlevel>
• Stop: rc-service <service> stop

Runit variant (protocol7-core-runit)

Location: /home/lain/Forgejo/protocol-7-core/protocol7-core-runit/

• Services: /etc/sv/<service>/run
• Enable: ln -sf /etc/sv/<service> /var/service/<service>

---

Font/Theme Configuration

Font: Love LetterTW 11 GTK Theme: CoplandOS-GTK Cursor Theme: StarLabs (size 24) Icon Theme: Adwaita

Configuration locations in skel:

• ~/.gtkrc-2.0
• ~/.config/gtk-3.0/settings.ini
• ~/.config/gtk-4.0/settings.ini
• ~/.config/alacritty/alacritty.toml
• ~/.config/dconf/user (binary dconf database)
• ~/.config/nwg-look/config
• ~/.config/swaylock/config (wallpaper background)
• ~/.config/wlogout/layout (OpenRC-compatible actions)

Session script (/usr/local/bin/lainos-session-sway) writes font/theme to ~/.config/glib-2.0/settings/keyfile on every Sway launch via GSETTINGS_BACKEND=keyfile.

---

Key Commands Reference

# Build ISO
doas mkarchiso -v -w ~/lainos-work -o ~/lainos-out \
  ~/Forgejo/lainos-iso-layer-02/lainos-iso-layer-02/protocol7-profile

# Hash ISO after build
lainos-hash-iso

# Deploy package to protocol_7_repo
cp <package>.pkg.tar.zst ~/Gitlab/protocol_7_repo/x86_64/
cd ~/Gitlab/protocol_7_repo/x86_64/
bash lainos-repo-push

# Deploy package to lainos_repo
cp <package>.pkg.tar.zst ~/Gitlab/lainos_repo/x86_64/
cd ~/Gitlab/lainos_repo/x86_64/
bash lainos-repo-push

# Clear package cache before ISO rebuild
doas pacman -Scc

# Calamares session log
doas grep -n "" /root/.cache/calamares/session.log | sed -n 'START,ENDp'

# Inspect initramfs
doas lsinitrd /mnt/boot/initramfs-linux.img | grep -E "nvme|udev|eudev"

# Monitor temps during build
watch -n2 "sensors | grep -E 'Package|Core'"

# Restart lainos-dbus-bridge
doas rc-service lainos-dbus-bridge restart

# Check repo signature verification
doas pacman -Sy

---

Open Items

Item	Priority	Status
Lynis security audit	Low	Queued, not started
nftables default-deny rewrite	Low	VM-generated rules, deferred
AppArmor / MAC profiles	Low	High maintenance cost, deferred
Alacritty [[font.fallbacks]] not supported	Low	Version too old; fontconfig workaround available
Valgrind memory leak testing	Low	Blocked by stripped ld.so on Arch; ASAN used instead
lainos-audio-init end-to-end login test	Medium	Wired into lainos-init 5.5.3-16; not yet confirmed on a real login cycle
tcp_timestamps sysctl	Low	Recommended change to 0 for anti-fingerprinting consistency; not yet applied

---

Release History

ISO Date	Key Changes
2026.07.04	protocol7-core 5.5.3-19 ~ lainos-net-init removed (confirmed orphaned), lainos-notifyd v4.7 fuzz tested + hardened, lainos-audio-init wired into session init, boot-order and runlevel fixes
2026.07.03	protocol7-core 5.5.3-12 ~ dfuzzer + ASAN audit, dbus-bridge hardened
2026.07.02	BTRFS default, Calamares autolaunch, wg-vpn, protocol7-core systemd=1:999
2026.07.01	LUKS FDE, hardened_malloc, kernel hardening, gnome-keyring, boot log cleanup
2026.06.28	dconf binary in skel (font fix)
2026.06.27	Upstream openrc with lainOS branding, multi-init p7-core variants
2026.06.26	Artix repos eliminated, pure Arch derivative
2026.06.25	UEFI baremetal confirmed, BTRFS in force_drivers
2026.06.24	NVMe modules in force_drivers, --no-uefi fix, first baremetal boot