privacy(archsetup): add WiFi MAC address randomization

1 files changed, 14 insertions, 0 deletions

diff --git a/archsetup b/archsetup
index d713ce6..e3f8d2a 100755
--- a/archsetup
+++ b/archsetup
@@ -617,6 +617,20 @@ essential_services() {
     action="enabling NetworkManager" && display "task" "$action"
     systemctl enable NetworkManager.service >> "$logfile" 2>&1 || error "error" "$action" "$?"
 
+    action="configuring MAC address randomization" && display "task" "$action"
+    mkdir -p /etc/NetworkManager/conf.d
+    cat << 'EOF' > /etc/NetworkManager/conf.d/wifi-privacy.conf
+[device-mac-randomization]
+# Randomize MAC during WiFi scans
+wifi.scan-rand-mac-address=yes
+
+[connection-mac-randomization]
+# Random MAC for each WiFi connection (prevents tracking)
+wifi.cloned-mac-address=random
+# Stable MAC for ethernet (avoids issues with MAC-based DHCP reservations)
+ethernet.cloned-mac-address=stable
+EOF
+
     # Power
 
     display "subtitle" "Power"