Bor v0.8.0 release notes / what's new

Bor v0.8.0 is an open-source policy management system for Linux desktops that expands its management capabilities, modernizes its administrative interface, and strengthens its security posture. This release focuses on increasing the application coverage of managed policies and improving the operational efficiency of the fleet administrator.

New Policy Types

Bor v0.8.0 adds support for three new policy types, allowing administrators to enforce settings across a fleet of Linux desktops.

Thunderbird

Mozilla Thunderbird can now be managed using the same mechanism as Firefox ESR. The Bor agent writes a managed policies.json file, which is a merge of all bound policies. If the last policy is removed, the original file is restored. This enforcement is compatible with both Flatpak and RPM/DEB installations. To prevent unauthorized changes, the agent uses a tamper watcher to detect and immediately restore the managed file if external edits are made.

Microsoft Edge for Business

For fleets utilizing Microsoft Edge on Linux, Bor now supports the creation of bor_managed.json files in each Edge managed-policy directory. The web UI provides a tree-based editor with the full Edge policy catalogue, JSON validation, and a preview of settings before they are enabled.

Firewalld Zones

Bor now manages firewalld zones on enrolled nodes, including services, ports, forward ports, rich rules, masquerade, interfaces, sources, and zone targets. The agent writes zone XML to /etc/firewalld/zones/, validates the configuration using firewall-cmd --check-config, and reloads firewalld. These zone files are also protected by the tamper watcher.

Web UI Overhaul

The administrative interface has been redesigned using PatternFly 6 to improve usability and accessibility (WCAG 2.2 AA).

Improved Navigation and UX

  • Routed Pages: Every page now has a unique URL, enabling browser back/forward navigation and deep linking. A global error boundary prevents white-screen crashes.
  • Full-Page Policy Editor: The policy editor has moved from nested modals to a dedicated routed page (/policies/:id/edit), providing more space for tree-based editors.
  • Scalable Lists: Node and compliance lists now utilize server-side pagination, filtering, and sorting to maintain performance for fleets with thousands of nodes.
  • Safety Rails: The UI now includes unsaved-changes guards, confirmation dialogs for destructive actions (such as deleting resources), and JSON validation for Chrome/Edge values.
  • Dashboard Enhancements: The dashboard now features grouped sidebar navigation and stat tiles that allow administrators to drill down into pre-filtered lists (e.g., clicking "Offline" takes the user directly to the filtered Nodes page).

Quality of Life Improvements

  • Two-Step Login: The login form now includes a password reveal toggle and a live Caps Lock warning.
  • MFA Management: Backup codes for multi-factor authentication (MFA) can now be copied or downloaded.
  • Policy Management: Policies can be released or unreleased directly from the list view.

Security Hardening

Bor v0.8.0 includes a dedicated security pass to protect the server and the agents.

  • Identity and Access: Agent identity is now strictly bound to mTLS client certificates. MFA and RBAC enforcement paths on the server have been hardened.
  • Encryption Updates: Legacy SHA-256-encrypted TOTP secrets are transparently migrated to HKDF-derived encryption upon the first read.
  • Infrastructure Protection: The Ubuntu PPA and Fedora COPR repository import helpers now block redirect-based SSRF by only following allowlisted redirect targets.
  • Audit Logs: Audit log CSV exports are now guarded against spreadsheet formula injection.
  • Credential Management: The initial admin password is no longer printed to the server log (journald); instead, it is written to a root-only file.
  • TLS Management: The server TLS certificate is automatically regenerated when its Subject Alternative Names (SANs) no longer match the configured hostnames.
  • Dependency Updates: All open Dependabot alerts were resolved, including the react-router RSC CSRF advisory (GHSA-qwww-vcr4-c8h2).

Technical Implementation and Platform Updates

Proto-driven Catalogues

To maintain a single source of truth, the policy catalogues for Firefox, Thunderbird, Chrome, and Edge are now generated from protobuf annotations. This shared schema is used by the server, agent, and frontend.

Polkit Variable Conditions

Polkit rules now support variable conditions via action.lookup(), allowing rules to match on action variables (e.g., allowing mounts only for removable drives). Additionally, multiple action IDs in one rule are now correctly joined with ||.

Platform Stack

  • Frontend: React 19.2 and react-router 8.3.
  • Backend/Agent: gRPC 1.82.1 and golang.org/x/crypto 0.52.0.
  • Development: Node.js 22.22+ is now required for frontend development.

Upgrade Notes

Administrators must upgrade agents to v0.8.0 to support the new Thunderbird, Edge, and Firewalld policy types. Older agents will ignore policy types they do not recognize. The protobuf policy schema has been extended with thunderbird.proto and firewalld.proto and updates to polkit and edge messages; any external tooling built against proto/policy/ must be regenerated.

Community Insights

Users on Hacker News discussed the potential applications and alternatives to Bor. Some administrators managing non-profit laptops are seeking support for Linux Mint's Cinnamon desktop environment and the idée of executing custom scripts.

Other technical queries focused on the policy enforcement model, specifically how the agent handles configuration drift and conflicting policies across sources. One user noted the effectiveness of the inotify drift-catch mechanism for reverting changes before a user notices.

"Nice work on the mTLS/gRPC push design — the inotify drift-catch on parent dirs is a clean answer to the 'revert happens before the user notices' problem, and I like that the audit trail is server-side."

Additional suggestions for the project include support for SCAP (Security Content Automation Protocol) to enforce DISA STIGs, and potential integration with fleet governance tools like Wazuh.

Sources