Show HN: Bor – Open-source policy management for Linux desktops

Aug 02, 2026 04:06 PM - 3 hours ago 1

Bor v0.8.0 is out. This merchandise adds 3 caller argumentation types — Thunderbird, Microsoft Edge for Business, and Firewalld zones — alongside a afloat web UI overhaul, finer-grained RBAC, and a dedicated information hardening pass. The complete changelog is connected the GitHub merchandise page.

The Policies database successful v0.8.0 — Thunderbird, Edge, and Firewalld subordinate Firefox, Chrome, Package, and dconf

Thunderbird argumentation type

Mozilla Thunderbird tin now beryllium managed connected enrolled desktops pinch the aforesaid system utilized for Firefox ESR. The supplier writes the managed policies.json that Thunderbird expects, merged from each bound policies, and removing the past argumentation restores the original file. Flatpak installations are detected and enforced alongside RPM/DEB installations, and the managed record is protected by the tamper watcher — outer edits are detected and instantly restored. The web UI ships a afloat argumentation editor pinch the complete Thunderbird argumentation catalogue.

Thunderbird argumentation successful the character editor — privacy, security, add-ons, and more

Microsoft Edge for Business argumentation type

For fleets moving Edge connected Linux, the supplier writes bor_managed.json into each Edge managed-policy directory and cleans it up from each directory erstwhile the past bound argumentation is removed. The web UI provides a tree-based editor pinch the Edge argumentation catalogue, JSON validation, and a mounting preview earlier enabling.

Microsoft Edge argumentation — a released stalls baseline successful the read-only Configuration view

Firewalld area argumentation type

The caller Firewalld argumentation type manages firewalld zones connected enrolled nodes: services, ports, guardant ports, rich | rules, masquerade, interfaces, sources, and the area target. The supplier writes area XML to /etc/firewalld/zones/, validates it pinch firewall-cmd --check-config, and reloads firewalld. Like each different managed files, the area files are tamper-protected.

Firewalld area argumentation — target zone, allowed services, and ports

Polkit: adaptable conditions

Polkit rules now support adaptable conditions via action.lookup(), truthful a norm tin lucifer connected action variables — for illustration allowing mounts only for removable drives. Also fixed: aggregate action IDs successful 1 norm are now correctly joined pinch ||.

Polkit norm pinch an action.lookup() adaptable information — drive_removable == true

Per-action RBAC

User and domiciled management is now guarded by per-action permissions alternatively of a azygous broad permission, allowing finer-grained delegation of admin duties.

Web UI overhaul

A afloat modernization walk complete the PatternFly 6 interface, spanning respective UX sprints. The dashboard shows the caller look — grouped sidebar navigation, a azygous left-aligned page title, and stat tiles that drill down to pre-filtered lists: click Offline and you onshore connected the Nodes page already filtered to offline nodes.

The redesigned dashboard pinch drill-down stat tiles and grouped sidebar navigation

The highlights:

URL routing — each page has a existent URL pinch moving browser back/forward and heavy links; expired sessions redirect to login; a world correction bound prevents white-screen crashes.
Full-page argumentation editor — the argumentation editor is now a routed page (/policies/:id/edit) alternatively of nested modals.
Policy information rails — unsaved-changes guard, confirmation for destructive type changes, JSON validation for Chrome/Edge values, a read-only Configuration position for released policies, and mounting previews successful the character editors.
Scalable lists — server-side pagination, filtering, and sorting for Nodes and Compliance; search, sorting, and quiet states crossed each database pages.
Destructive-action protection — type-to-confirm dialogs for each assets deletes, positive server-side guards that forestall deleting, disabling, aliases demoting the past Super Admin.
Accessibility (WCAG 2.2 AA) — accessible character roles successful the argumentation editors, aria-live position messages, focus-ring and dark-mode/high-contrast correctness via PatternFly 6 creation tokens, and an accessibility lint gross successful CI.

The argumentation editor is now a routed, full-width page alternatively of stacked modals, pinch room for the tree-based editors down each argumentation type:

The full-page argumentation editor

Node and compliance lists are paginated, filtered, and sorted server-side, truthful fleets pinch thousands of nodes enactment fast:

The Nodes database pinch server-side pagination and searchable select dropdowns

Plus galore quality-of-life changes: policies tin beryllium released/unreleased straight from the database view, backup codes for MFA tin beryllium copied aliases downloaded, the login shape gained a password uncover toggle and Caps Lock hint, and the sidebar is now grouped into Fleet / Policy / System.

The password measurement of the redesigned two-step login — uncover toggle and unrecorded Caps Lock warning

Proto-driven argumentation catalogues

The Firefox, Thunderbird, Chrome, and Edge argumentation catalogues shown successful the web UI are now generated from protobuf annotations — 1 root of truth shared by the server, agent, and frontend.

Security hardening

This merchandise includes a dedicated hardening pass:

Agent personality is now strictly bound to the mTLS customer certificate, and MFA/RBAC enforcement paths were hardened connected the server.
Legacy SHA-256-encrypted TOTP secrets are transparently migrated to HKDF-derived encryption connected first read.
The Ubuntu PPA and Fedora COPR repository import helpers now artifact redirect-based SSRF; only allowlisted redirect targets are followed.
Audit log CSV export is guarded against spreadsheet look injection.
The auto-generated first admin password is nary longer printed to the server log (where it would onshore successful journald aliases centralized logging); it is written to a root-only record instead.
The server TLS certificate is automatically regenerated erstwhile its SANs nary longer lucifer the configured hostnames.
All unfastened Dependabot alerts were resolved, including the react-router RSC CSRF advisory (GHSA-qwww-vcr4-c8h2).

Audit logs — each login, argumentation change, and admin action, exportable arsenic injection-safe CSV aliases JSON

Platform updates

The frontend moved to React 19.2 and react-router 8.3, pinch TypeScript typecheck now enforced successful CI. Server and supplier limitations were bumped, including gRPC 1.82.1 and golang.org/x/crypto 0.52.0.

Upgrade notes

Agents must beryllium upgraded to v0.8.0 to enforce the caller Thunderbird, Edge, and Firewalld argumentation types; older agents disregard argumentation types they do not understand.
The protobuf argumentation schema gained thunderbird.proto and firewalld.proto and extends the polkit and separator messages — regenerate immoderate outer tooling built against proto/policy/.
Frontend improvement now requires Node.js 22.22+.

Download

Packages for Debian/Ubuntu, RHEL/Fedora/SUSE, Alpine Linux, and Arch Linux crossed x86_64, aarch64, and ppc64le are disposable connected the Download page.