Show HN：Bor——面向 Linux 桌面的开源策略管理工具
英文标题：🔶 Show HN: Bor – Open-source policy management for Linux desktops
Bor v0.8.0 发布，新增 Thunderbird、Microsoft Edge for Business 和 Firewalld 区域三类策略，扩展了对 Linux 终端浏览器、邮件客户端与防火墙配置的集中管理能力。该版本全面改造 Web UI，引入按操作细分的 RBAC、可路由的全页策略编辑器、服务端分页筛选，以及 WCAG 2.2 AA 无障碍改进。安全方面，Bor 加强了 mTLS 身份绑定、MFA/RBAC 路径、SSRF 防护、审计 CSV 导出防注入和 TLS 证书 SAN 自动更新。开发者需要将 Agent 升级至 v0.8.0 才能执行新增策略类型；依赖 `proto/policy/` 的外部工具也需要重新生成 protobuf 代码。
730 B
321.4 KB
201.9 KB
240.9 KB
204.6 KB
192.7 KB
190.5 KB
130.4 KB
309.7 KB
95.3 KB
430.3 KB
66.0 KB
中文
Bor v0.8.0 已发布。本次版本新增三种策略类型——Thunderbird、Microsoft Edge for Business 和 Firewalld 区域——同时带来 Web UI 的全面重构、更细粒度的 RBAC，以及专门的安全加固工作。完整更新日志见 GitHub 发布页面。
Thunderbird 策略类型
现在可以通过与 Firefox ESR 相同的机制，在已纳管桌面设备上管理 Mozilla Thunderbird。Agent 会写入 Thunderbird 所需的受管 policies.json 文件，该文件由所有已绑定策略合并生成；移除最后一项策略后，原始文件会被恢复。系统可识别 Flatpak 安装，并与 RPM/DEB 安装一同实施策略；受管文件还受到篡改监控器保护——检测到外部修改后会立即恢复。Web UI 提供完整的策略编辑器，包含完整的 Thunderbird 策略目录。
Microsoft Edge for Business 策略类型
对于在 Linux 上运行 Edge 的设备集群，Agent 会将 bor_managed.json 写入每个 Edge 受管策略目录；当最后一个绑定策略被移除时，也会从所有目录中清理该文件。Web UI 提供基于树形结构的编辑器，包含 Edge 策略目录、JSON 校验，以及启用前的设置预览。
Firewalld 区域策略类型
新的 Firewalld 策略类型可管理已纳管节点上的 firewalld 区域：服务、端口、端口转发、富规则、伪装、网络接口、来源地址以及区域目标。Agent 会将区域 XML 写入 /etc/firewalld/zones/，使用 firewall-cmd --check-config 验证配置，并重新加载 firewalld。与其他所有受管文件一样，区域文件也受到篡改保护。
Polkit：变量条件
Polkit 规则现在通过 action.lookup() 支持变量条件，因此规则可匹配操作变量——例如，仅允许对可移动驱动器进行挂载。同时还修复了一项问题：同一规则中的多个操作 ID 现在会正确使用 || 连接。
按操作划分的 RBAC
用户和角色管理现在由按操作划分的权限保护，而不再依赖单一的全局权限，因此可以更细粒度地委派管理职责。
Web UI 全面改造
PatternFly 6 界面经历了一轮完整的现代化改造，覆盖多个 UX 迭代周期。仪表板展示了全新设计：分组式侧边栏导航、统一左对齐的页面标题，以及可跳转至预筛选列表的统计卡片。例如，点击 Offline，即可进入已经筛选为离线节点的 Nodes 页面。
主要改进包括：
- URL 路由——每个页面均拥有真实 URL，支持浏览器前进/后退和深层链接；会话过期时会跳转至登录页；全局错误边界可防止页面因错误而白屏崩溃。
- 全页策略编辑器——策略编辑器现在是路由页面（
/policies/:id/edit），不再是层层嵌套的模态框。 - 策略安全防护——提供未保存更改保护、破坏性类型变更确认、Chrome/Edge 值的 JSON 校验、已发布策略的只读“配置”视图，以及树形编辑器中的设置预览。
- 可扩展列表——Nodes 和 Compliance 支持服务端分页、筛选和排序；所有列表页均支持搜索、排序和空状态展示。
- 破坏性操作保护——所有资源删除操作均采用“输入文字确认”对话框，并增加服务端防护，避免删除、禁用或降级最后一名 Super Admin。
- 无障碍功能（WCAG 2.2 AA）——策略编辑器具备可访问的树形角色、
aria-live状态消息，并通过 PatternFly 6 设计令牌确保焦点环、深色模式和高对比度的正确性；CI 中还增加了无障碍 lint 检查门槛。
策略编辑器现在是可路由的全宽页面，而不再是堆叠的模态框，可为每种策略类型背后的树形编辑器提供充足空间：
节点和合规列表支持服务端分页、筛选和排序，因此即使设备集群拥有数千个节点，仍能保持快速响应：
此外还有大量体验改进：可直接在列表视图中发布或取消发布策略；MFA 备用代码可复制或下载；登录表单新增密码显示切换和 Caps Lock 提示；侧边栏现已分组为 Fleet / Policy / System。
由 Proto 驱动的策略目录
Web UI 中显示的 Firefox、Thunderbird、Chrome 和 Edge 策略目录，现在由 protobuf 注解生成——服务器、Agent 和前端共享同一事实来源。
安全加固
本次发布包含专门的安全加固工作：
- Agent 身份现在严格绑定至 mTLS 客户端证书，服务器端的 MFA/RBAC 执行路径也得到加固。
- 旧版采用 SHA-256 加密的 TOTP 密钥会在首次读取时透明迁移至基于 HKDF 派生的加密方式。
- Ubuntu PPA 和 Fedora COPR 软件源导入辅助工具现可阻止基于重定向的 SSRF；仅会跟随白名单中的重定向目标。
- 审计日志 CSV 导出已增加对电子表格公式注入的防护。
- 自动生成的初始管理员密码不再输出到服务器日志中——避免其进入 journald 或集中式日志系统；现在会写入一个仅 root 可访问的文件。
- 当服务器 TLS 证书的 SAN 不再匹配配置的主机名时，证书将自动重新生成。
- 所有已公开的 Dependabot 告警均已解决，其中包括 react-router RSC CSRF 安全公告（GHSA-qwww-vcr4-c8h2）。
平台更新
前端已升级至 React 19.2 和 react-router 8.3，且 CI 现在会强制执行 TypeScript 类型检查。服务器和 Agent 依赖也已更新，包括 gRPC 1.82.1 和 golang.org/x/crypto 0.52.0。
升级说明
- 必须将 Agent 升级至 v0.8.0，才能执行新的 Thunderbird、Edge 和 Firewalld 策略类型；旧版 Agent 会忽略其无法识别的策略类型。
- protobuf 策略模式新增了
thunderbird.proto和firewalld.proto，并扩展了 polkit 和 edge 消息——请重新生成所有基于proto/policy/构建的外部工具。 - 前端开发现在要求 Node.js 22.22+。
下载
适用于 Debian/Ubuntu、RHEL/Fedora/SUSE、Alpine Linux 和 Arch Linux 的软件包已在 下载 页面提供，支持 x86_64、aarch64 和 ppc64le 架构。
English / 原文
Bor v0.8.0 is out. This release adds three new policy types — Thunderbird , Microsoft Edge for Business , and Firewalld zones — alongside a full web UI overhaul, finer-grained RBAC, and a dedicated security hardening pass. The complete changelog is on the GitHub release page.
Thunderbird policy type
Mozilla Thunderbird can now be managed on enrolled desktops with the same mechanism used for Firefox ESR. The agent writes the managed policies.json that Thunderbird expects, merged from all bound policies, and removing the last policy restores the original file. Flatpak installations are detected and enforced alongside RPM/DEB installations, and the managed file is protected by the tamper watcher — external edits are detected and immediately restored. The web UI ships a full policy editor with the complete Thunderbird policy catalogue.
Microsoft Edge for Business policy type
For fleets running Edge on Linux, the agent writes bor_managed.json into each Edge managed-policy directory and cleans it up from every directory when the last bound policy is removed. The web UI provides a tree-based editor with the Edge policy catalogue, JSON validation, and a setting preview before enabling.
Firewalld zone policy type
The new Firewalld policy type manages firewalld zones on enrolled nodes: services, ports, forward ports, rich rules, masquerade, interfaces, sources, and the zone target. The agent writes zone XML to /etc/firewalld/zones/, validates it with firewall-cmd --check-config, and reloads firewalld. Like all other managed files, the zone files are tamper-protected.
Polkit: variable conditions
Polkit rules now support variable conditions via action.lookup(), so a rule can match on action variables — for example allowing mounts only for removable drives. Also fixed: multiple action IDs in one rule are now correctly joined with ||.
Per-action RBAC
User and role administration is now guarded by per-action permissions instead of a single blanket permission, allowing finer-grained delegation of admin duties.
Web UI overhaul
A full modernization pass over the PatternFly 6 interface, spanning several UX sprints. The dashboard shows the new look — grouped sidebar navigation, a single left-aligned page title, and stat tiles that drill down to pre-filtered lists: click Offline and you land on the Nodes page already filtered to offline nodes.
The highlights:
- URL routing — every page has a real URL with working browser back/forward and deep links; expired sessions redirect to login; a global error boundary prevents white-screen crashes.
- Full-page policy editor — the policy editor is now a routed page (
/policies/:id/edit) instead of nested modals. - Policy safety rails — unsaved-changes guard, confirmation for destructive type changes, JSON validation for Chrome/Edge values, a read-only Configuration view for released policies, and setting previews in the tree editors.
- Scalable lists — server-side pagination, filtering, and sorting for Nodes and Compliance; search, sorting, and empty states across all list pages.
- Destructive-action protection — type-to-confirm dialogs for all resource deletes, plus server-side guards that prevent deleting, disabling, or demoting the last Super Admin.
- Accessibility (WCAG 2.2 AA) — accessible tree roles in the policy editors,
aria-livestatus messages, focus-ring and dark-mode/high-contrast correctness via PatternFly 6 design tokens, and an accessibility lint gate in CI.
The policy editor is now a routed, full-width page instead of stacked modals, with room for the tree-based editors behind each policy type:
Node and compliance lists are paginated, filtered, and sorted server-side, so fleets with thousands of nodes stay fast:
Plus many quality-of-life changes: policies can be released/unreleased directly from the list view, backup codes for MFA can be copied or downloaded, the login form gained a password reveal toggle and Caps Lock hint, and the sidebar is now grouped into Fleet / Policy / System.
Proto-driven policy catalogues
The Firefox, Thunderbird, Chrome, and Edge policy catalogues shown in the web UI are now generated from protobuf annotations — one source of truth shared by the server, agent, and frontend.
Security hardening
This release includes a dedicated hardening pass:
- Agent identity is now strictly bound to the mTLS client certificate, and MFA/RBAC enforcement paths were hardened on the server.
- Legacy SHA-256-encrypted TOTP secrets are transparently migrated to HKDF-derived encryption on first read.
- The Ubuntu PPA and Fedora COPR repository import helpers now block redirect-based SSRF; only allowlisted redirect targets are followed.
- Audit log CSV export is guarded against spreadsheet formula injection.
- The auto-generated initial admin password is no longer printed to the server log (where it would land in journald or centralized logging); it is written to a root-only file instead.
- The server TLS certificate is automatically regenerated when its SANs no longer match the configured hostnames.
- All open Dependabot alerts were resolved, including the react-router RSC CSRF advisory (GHSA-qwww-vcr4-c8h2).
Platform updates
The frontend moved to React 19.2 and react-router 8.3, with TypeScript typecheck now enforced in CI. Server and agent dependencies were bumped, including gRPC 1.82.1 and golang.org/x/crypto 0.52.0.
Upgrade notes
- Agents must be upgraded to v0.8.0 to enforce the new Thunderbird, Edge, and Firewalld policy types; older agents ignore policy types they do not understand.
- The protobuf policy schema gained
thunderbird.protoandfirewalld.protoand extends the polkit and edge messages — regenerate any external tooling built againstproto/policy/. - Frontend development now requires Node.js 22.22+.
Download
Packages for Debian/Ubuntu, RHEL/Fedora/SUSE, Alpine Linux, and Arch Linux across x86_64, aarch64, and ppc64le are available on the Download page.