← Back to news

Show HN: Bor – Open-source policy management for Linux desktops

Original article
getbor.dev|135 points|19 comments|by eniac111|Aug 2, 2026

Show HN: Bor – Open-source policy management for Linux desktops

Release Announcement: Bor v0.8.0 is officially available as of August 2, 2026. Authored by Blagovest Petrov (@vute.tech)

The v0.8.0 update introduces a significant expansion of policy capabilities, a comprehensive redesign of the web interface, refined Role-Based Access Control (RBAC), and a rigorous security hardening phase.

🛠️ New Policy Type Implementations

Bor now extends its management reach to three additional critical areas of the Linux desktop:

1. Mozilla Thunderbird

Management for Thunderbird now mirrors the existing Firefox ESR workflow.

  • Mechanism: The agent generates a merged policies.json file.
  • Persistence: Removing the final bound policy restores the original file.
  • Coverage: Supports RPM, DEB, and Flatpak installations.
  • Integrity: A tamper watcher monitors the file; any external modifications are instantly reverted.
  • UI: A dedicated editor featuring the full Thunderbird policy catalogue is now available.

2. Microsoft Edge for Business

For organizations utilizing Edge on Linux:

  • Implementation: The agent manages bor_managed.json within the Edge policy directories.
  • Cleanup: Files are purged once all associated policies are removed.
  • UI Features: Includes a tree-based editor, strict JSON validation, and a preview mode to verify settings before deployment.

3. Firewalld Zones

Administrators can now orchestrate firewalld zones across enrolled nodes.

  • Scope: Manage ports, services, rich rules, interfaces, sources, masquerading, forward ports, and zone targets.
  • Workflow:
    1. Agent writes XML to /etc/firewalld/zones/.
    2. Validation via firewall-cmd --check-config.
    3. Triggering a firewalld reload.
  • Protection: Zone files are subject to the same tamper-protection as other managed assets.

🔐 Access Control & Polkit Enhancements

Polkit Variable Conditions

Polkit rules have been upgraded to support variable conditions using action.lookup(). This allows for highly specific rules, such as:

  • Allowing mount operations only if the target is a removable drive.

Additionally, a bug was resolved where multiple action IDs in a single rule were not being joined correctly with the || (OR) operator.

Granular RBAC

Blanket permissions →\rightarrow Per-action permissions. User and role administration is no longer a "single switch." Admin duties can now be delegated with much finer precision based on specific actions.

🎨 Web UI Modernization

The interface has undergone a total overhaul based on PatternFly 6, focusing on UX and scalability.

Navigation & Layout

  • Dashboard: Features a grouped sidebar and left-aligned titles.
  • Smart Tiles: Stat tiles now act as shortcuts. Example: Clicking the "Offline" tile redirects you to the Nodes page with the "Offline" filter already applied.
  • Routing: Every page now possesses a unique URL, enabling deep linking and native browser back/forward functionality.

The Policy Editor

The editor has evolved from nested modals into a dedicated routed page: /policies/:id/edit.

FeatureDescription
Safety RailsGuards against unsaved changes and warns before destructive type changes.
ValidationReal-time JSON validation for Edge/Chrome values.
Read-Only ModeA "Configuration" view for policies that have already been released.
ScalabilityServer-side pagination, sorting, and filtering for Nodes and Compliance lists.

Accessibility & Safety

  • WCAG 2.2 AA Compliance: Implementation of aria-live messages, accessible tree roles, and high-contrast/dark-mode support via design tokens.
  • Destructive Protection: "Type-to-confirm" dialogs for deletions.
  • Super Admin Guard: Server-side logic prevents the deletion or demotion of the final Super Admin.

⚙️ Technical Architecture & Security

Proto-driven Catalogues

To ensure a "single source of truth," the catalogues for Chrome, Edge, Firefox, and Thunderbird are now generated via protobuf annotations.

Security Hardening Pass

This release prioritizes the reduction of the attack surface:

  • Identity: Agent identity is now strictly tied to the mTLS client certificate.
  • Encryption Migration: Legacy SHA-256 TOTP secrets are migrated to HKDF-derived encryption: Secretold→HKDFSecretnew\text{Secret}_{\text{old}} \xrightarrow{\text{HKDF}} \text{Secret}_{\text{new}}
  • SSRF Prevention: PPA and COPR repository helpers now block redirect-based SSRF, allowing only allowlisted targets.
  • Injection Guard: CSV exports for audit logs are now sanitized against spreadsheet formula injection.
  • Secret Management: The initial admin password is no longer leaked to journald or central logs; it is written to a root-only file.
  • TLS Automation: Server certificates are automatically regenerated if SANs mismatch configured hostnames.
  • Dependency Fixes: Resolved all Dependabot alerts, including the react-router CSRF advisory (GHSA-qwww-vcr4-c8h2).

Platform Stack Updates

  • Frontend: React 19.2, react-router 8.3, and mandatory TypeScript checks in CI.
  • Backend: gRPC 1.82.1 and golang.org/x/crypto 0.52.0.

🚀 Upgrade & Deployment

Upgrade Checklist

  • Update Agents to v0.8.0 (Required for Thunderbird, Edge, and Firewalld support).
  • Regenerate external tooling if using proto/policy/ (due to thunderbird.proto and firewalld.proto additions).

Available Packages

Bor Logo

Packages are available on the official Download page for the following:

Distributions:

  • Debian / Ubuntu
  • RHEL / Fedora / SUSE
  • Alpine Linux
  • Arch Linux

Architectures: x86_64, aarch64, and ppc64le.