Hardened Universal Linux Invisibility and Onion System
Hulios is an eBPF-powered, transparent Tor VPN gateway for Linux. It secures outbound web postulation by redirecting TCP sockets and DNS queries done an embedded Arti (Tor client) lawsuit and a localized Hickory-based DNS resolver. By operating astatine the kernel socket level via cgroup hooks and argumentation routing, Hulios implements robust leak-resistant boundaries without modifying runtime resolv.conf configurations aliases relying connected outer firewall daemons.
Hulios implements a strict privilege-separated runtime model:
- Privilege Separation: The introduction constituent supervisor runs pinch big guidelines privileges to hook eBPF programs and build argumentation routing tables, past instantly spawns an unprivileged worker child.
- Sandbox Isolation: The worker process drops privileges to cipher and is isolated utilizing a restrictive seccomp strategy telephone filter.
- Fail-Secure Kill-Switch: Output postulation routing is locked utilizing kernel argumentation tables (table 100) and default blackholes. In the arena of a daemon clang aliases forced shutdown (SIGKILL), the blackholes stay active, blocking outgoing postulation to forestall IP leaks until a manual betterment is initiated.
- Raw Socket Blocker: An LSM eBPF hook blocks earthy AF_PACKET socket creation globally to forestall applications from bypassing modular IP routing rules.
- Linux Kernel: Version 5.10 aliases higher.
- Kernel Configs: CONFIG_BPF_SYSCALL, CONFIG_BPF_LSM, and CONFIG_CGROUPS_V2 must beryllium enabled.
- Build Dependencies: clang and libelf (required for compile-time eBPF compilation).
Tested and verified connected Arch Linux and Debian 13 (Bookworm).
⚙️ Build and Installation
Hulios is disposable connected the Arch User Repository arsenic hulios-git:
1. Install Build Dependencies
- Arch Linux: sudo pacman -S clang libelf zlib sqlite
- Debian/Ubuntu: sudo apt instal -y clang libelf-dev zlib1g-dev libsqlite3-dev
Ensure you person the Rust compiler installed (toolchain action and target requirements are automatically managed by rust-toolchain.toml):
The compiled binary will beryllium located astatine target/release/hulios.
All commands that interact pinch kernel interfaces aliases argumentation routing require elevated privileges:
Hulios automatically generates a default, self-documenting template record astatine /etc/hulios/config.toml connected its first tally if 1 is not already present. Open the generated record to customize variables (such arsenic preferred Tor exit nodes, DNS redirects, civilization SOCKS ports, aliases strict lockdown mode).
If you find Hulios useful and would for illustration to support its ongoing information improvement and research, donations are greatly appreciated:
- Bitcoin (BTC): bc1q0gllvd7fe2y48emjd4shf42ul3cl4pgda5zpqz
- USDT (TRON / TRC20): TQWUmTATa8sDntobTNGkLmbgmHVS9iWCRx
- USDC (Ethereum / ERC20): 0x16aFd1De7889071194A026D79393eb3CE659181e
Hulios securing the web carrier furniture (Layer 3) does not guarantee full anonymity.
- No Liability / Misuse: THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. THE DEVELOPER ASSUMES NO LIABILITY OR RESPONSIBILITY FOR ANY DATA LEAKS, PRIVACY COMPROMISES, LEGAL CONSEQUENCES, SYSTEM INSTABILITY, OR DAMAGES ARISING FROM THE USE, MISUSE, OR ILLEGAL APPLICATION OF HULIOS.
- Application Fingerprinting: Hulios does not portion application-level trackers, cookies, aliases browser fingerprinting configurations. For web browsing, it is highly recommended to usage the charismatic Tor Browser configured to way done the Hulios SOCKS interface.
- Host Compromise: Hulios cannot protect your strategy if an adversary obtains guidelines access, arsenic they tin unload eBPF programs and change routing tables.
- Tor Network Limitations: Your postulation is taxable to the information of the Tor network, including imaginable relationship attacks by entities controlling some introduction and exit nodes.
English (US) · 
Indonesian (ID) ·