GoKawiilHulios
Hardened Universal Linux Invisibility and Onion System
Hulios is an eBPF-powered, transparent Tor VPN gateway for Linux. It secures outbound network traffic by redirecting TCP sockets and DNS queries through an embedded Arti (Tor client) instance and a localized Hickory-based DNS resolver. By operating at the kernel socket level via cgroup hooks and policy routing, Hulios implements robust leak-resistant boundaries without modifying runtime resolv.conf configurations or relying on external firewall daemons.
🔒 Security Architecture
Hulios implements a strict privilege-separated runtime model:
Privilege Separation: The entry point supervisor runs with host root privileges to hook eBPF programs and build policy routing tables, then immediately spawns an unprivileged worker child.
The entry point supervisor runs with host root privileges to hook eBPF programs and build policy routing tables, then immediately spawns an unprivileged worker child. Sandbox Isolation: The worker process drops privileges to nobody and is isolated using a restrictive seccomp system call filter.
The worker process drops privileges to and is isolated using a restrictive system call filter. Fail-Secure Kill-Switch: Output traffic routing is locked using kernel policy tables ( table 100 ) and default blackholes. In the event of a daemon crash or forced shutdown ( SIGKILL ), the blackholes remain active, blocking outgoing traffic to prevent IP leaks until a manual recovery is initiated.
Output traffic routing is locked using kernel policy tables ( ) and default blackholes. In the event of a daemon crash or forced shutdown ( ), the blackholes remain active, blocking outgoing traffic to prevent IP leaks until a manual recovery is initiated. Raw Socket Blocker: An LSM eBPF hook blocks raw AF_PACKET socket creation globally to prevent applications from bypassing standard IP routing rules.
📋 Requirements
... continue reading