--- title: Show HN: Bor – Open-source policy management for Linux... description: Bor v0.8.0 introduces three new policy types for managing Thunderbird, Microsoft Edge for Business, and Firewalld zones on enrolled Linux desktops. The release... canonical: https://daily.dev/posts/show-hn-bor-open-source-policy-management-for-linux-desktops-ej9dxc2tj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Show HN: Bor – Open-source policy management for Linux desktops | daily.dev og:description: Bor v0.8.0 introduces three new policy types for managing Thunderbird, Microsoft Edge for Business, and Firewalld zones on enrolled Linux desktops. The release... og:url: https://daily.dev/posts/show-hn-bor-open-source-policy-management-for-linux-desktops-ej9dxc2tj og:image: https://api.daily.dev/og/posts/Ej9dxc2Tj.png og:image:alt: Show HN: Bor – Open-source policy management for Linux desktops og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Show HN: Bor – Open-source policy management for Linux desktops **[Hacker News](https://daily.dev/sources/hn)** · 5 min read · 10 upvotes · 0 comments ## Summary Bor v0.8.0 introduces three new policy types for managing Thunderbird, Microsoft Edge for Business, and Firewalld zones on enrolled Linux desktops. The release also delivers a full web UI overhaul built on PatternFly 6 with URL routing, server-side pagination, WCAG 2.2 AA accessibility, and a full-page policy editor. RBAC is now per-action rather than a single blanket permission. A dedicated security hardening pass addresses mTLS identity binding, TOTP secret migration to HKDF encryption, SSRF blocking in repo import helpers, formula injection protection in CSV exports, and removal of auto-generated admin passwords from server logs. The frontend moved to React 19.2 and react-router 8.3, and policy catalogues are now generated from protobuf annotations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 25 comments across hackernews (as of 2026-08-02). **TL;DR:** The community is broadly enthusiastic about Bor as a Linux MDM/policy tool, praising its push-based gRPC/mTLS design and inotify drift-correction, while raising practical questions about LDAP-only auth, custom script support, and how it compares to existing tools like Ansible, Samba, and sssd. **Sentiment:** 60% positive · 30% mixed · 10% skeptical **The case for** - The push-based gRPC/mTLS design with real-time policy propagation and no inbound port requirements is seen as a clean, secure architecture. - inotify-based drift detection and millisecond revert with server-side audit trail is highlighted as an elegant solution to policy enforcement. - Avoiding SSH key sprawl and not requiring SSH on managed endpoints is viewed as a security advantage for workstation fleets. - The deliberate exclusion of arbitrary script execution is appreciated as a principled security boundary that aids compliance. **The pushback** - LDAP-only authentication (no OAuth/SAML/OIDC) limits usefulness for organizations already using modern SSO providers like Authentik. - Non-domain, single-user laptops have no lightweight enrollment path without LDAP/Kerberos. - Documentation quality, including ad-hoc ASCII diagrams, needs significant improvement. - Existing tools like Ansible, Pyinfra, Samba GPOs, and sssd already cover overlapping ground, raising questions about differentiation. **By community** - hackernews (positive): Commenters are genuinely interested and ask detailed technical questions, with the author providing thorough answers; criticism is constructive rather than dismissive. **Hottest debate:** Whether deliberately blocking custom/arbitrary script execution is the right trade-off versus the flexibility that sysadmins managing diverse Linux environments need. **Open questions** - Will OAuth/SAML/OIDC SSO support (e.g., Authentik) be added, and on what timeline? - Is there a lightweight enrollment path for non-domain, non-LDAP personal machines? - How does Bor differentiate itself enough from Ansible/Puppet/Samba GPOs to justify adoption? - Could SCAP/DISA STIG enforcement be supported in the future? **Highlights** > Delivery is push, not pull. Each agent holds a persistent gRPC stream to the server (mTLS). Policy changes are broadcast over that stream the moment they're released — agents apply them in real time. If the connection drops, the agent reconnects with backoff and sends its last-known revision; the server replays exactly what it missed (or a full snapshot). So there's no "check every N minutes" anywhere in the design. Most user changes never stick in the first place. Where the desktop stack has a native lockdown mechanism, Bor uses it: dconf keys are written together with a dconf locks file, so a locked setting simply can't be changed from GNOME's UI; KDE settings are written with the Kiosk [$i] immutability marker, which KDE itself enforces; and everything else (Firefox/Chrome/Edge policies.json, polkit rules, firewalld zones) lives in root-owned files under /etc that an unprivileged user can't touch. Those applications treat managed policy as non-overridable by design. Root-level drift is caught by inotify, not a timer. For every file it manages, the agent watches the parent directory via inotify (parent dir, so atomically-renamed replacements are caught too). If anything external modifies or deletes a managed file — a curious admin with sudo, a config-management tool, a package postinstall script — the watcher fires immediately and the agent rewrites the file from its cached policy state and re-reports compliance to the server. In practice the revert happens within milliseconds of the write, and the tamper event is visible server-side, so drift isn't just corrected — it's auditable. (The agent suppresses events from its own writes, so it doesn't fight itself.) > — [eniac111 on hackernews](https://news.ycombinator.com/item?id=49143523) > The general documentation is something that definitely needs a lot of improvement, but it's currently under active development. Policies are delivered over a persistent gRPC stream, secured with mTLS, where each node gets it's own cert from Bor's built-in CA at enrollment - so there's no SSH key sprawl and no credentials on the server that could log into machines. Since agents connect outbound to the server, it works through NAT and firewalls without opening any inbound ports on desktops, and policy changes propagate in seconds over the already-open stream. SHH-push would have meant maintaining an inventory of searchable hosts and a server that can shell into the whole fleet - a much bigger attach surface for less capability. > — [eniac111 on hackernews](https://news.ycombinator.com/item?id=49144862) > - Samba already supports policies for Linux, but it's not a "finished product", not actively maintained and it does not have Bor's tamper protection of the managed files. - IaC tools like Ansible/Puppet are good alternatives, but coding the whole configuration is not comfortable for some system administrations. Especially those with Windows Server AD background. Also, setting up strict policies avoids running of arbitrary code on the target systems, which is good for enterprise compliance certification. - It's not a domain controller because there are no user entities, only nodes. Bor works together with Windows AD/ Samba or FreeIPA. It supports LDAP and Kerberos authentication. Domain-joined machines could automatically enroll without setting the temporary token, issued from the UI. > — [eniac111 on hackernews](https://news.ycombinator.com/item?id=49143650) > Nice work on the mTLS/gRPC push design — the inotify drift-catch on parent dirs is a clean answer to the "revert happens before the user notices" problem, and I like that the audit trail is server-side. Question on the policy model: how do you handle conflicting policies across sources — say a package postinstall rewrites a managed file while a newer policy is mid-sync from the server, or two policy types touch the same file? Does the agent queue and reconcile revisions, or last-write-wins? Also curious: with LDAP-only auth, how do non-domain single-user laptops fit in? I manage a few personal machines that I'd love to centralize but they aren't LDAP-joined — is there a lightweight path, or is the temp-token enrollment strictly for domain boxes? > — [teddzfr on hackernews · 1 comments](https://news.ycombinator.com/item?id=49143984) > Unfortunately, only LDAP is currently supported. There is no implementation of Enterprise SSO like Oauth/SAML. It's planned for the future, but not in priority for now. I have never tested Cinnamon, but it should work in theory, because it stores most of it's settings in dconf. Custom scripts: deliberately not, so far. Once a management agent runs arbitrary scripts as root, it stops being a policy system and becomes remote-code-execution-as-a-service — the security review, the audit story, and the "what exactly is enforced on this machine?" It may be implemented in the future, but with a ENV variable/config property from the application configuration. The same goes for configuration management systems like Ansible. Thank you for the interest! I'm interested in developing a community around the software. > — [eniac111 on hackernews](https://news.ycombinator.com/item?id=49143586) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49142569) · 34 points · 25 comments ## Similar posts on daily.dev - [New Release: Tor Browser 15.0](https://daily.dev/posts/new-release-tor-browser-15-0-ft1ya9dym) · Hacker News · 0 upvotes · 0 comments - [Announcing Kyverno release 1.18\!](https://daily.dev/posts/announcing-kyverno-release-1-18--xuu8sqzjt) · CNCF · 7 upvotes · 0 comments - [ABP Platform 10.5 RC Has Been Released](https://daily.dev/posts/abp-platform-10-5-rc-has-been-released-idpkhl1n5) · We Are .NET · 0 upvotes · 0 comments - [Full Sandbox egress firewall now available on Hobby plan](https://daily.dev/posts/full-sandbox-egress-firewall-now-available-on-hobby-plan-mclpbbq2p) · Vercel · 0 upvotes · 0 comments - [Announcing OpenBao v2.6\! – Open Source Security Foundation](https://daily.dev/posts/announcing-openbao-v2-6-open-source-security-foundation-2a9rrvhey) · OpenSSF · 1 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang) [View this post on daily.dev](https://daily.dev/posts/show-hn-bor-open-source-policy-management-for-linux-desktops-ej9dxc2tj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Show HN: Bor – Open-source policy management for Linux desktops","url":"https://daily.dev/posts/show-hn-bor-open-source-policy-management-for-linux-desktops-ej9dxc2tj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/show-hn-bor-open-source-policy-management-for-linux-desktops-ej9dxc2tj"},"datePublished":"2026-08-02T11:09:03.444Z","dateModified":"2026-08-03T00:17:29.586Z","description":"Bor v0.8.0 introduces three new policy types for managing Thunderbird, Microsoft Edge for Business, and Firewalld zones on enrolled Linux desktops. The release...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6205ad92138d6d40bc9e80c79b3b1861?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6205ad92138d6d40bc9e80c79b3b1861?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/show-hn-bor-open-source-policy-management-for-linux-desktops-ej9dxc2tj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":10},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Show HN: Bor – Open-source policy management for Linux desktops"}]} ```