Bor v0.8.0, an open-source policy management system for Linux desktops, has been released with three new policy types and a comprehensive web interface redesign.
The release introduces Thunderbird policy management alongside Microsoft Edge for Business and Firewalld zones. According to the release notes, the Thunderbird policy type writes managed policies.json files that can be merged from all bound policies, with the original file restored when the last policy is removed. Flatpak and RPM/DEB installations are both detected and enforced, and external edits are detected and immediately restored by a tamper watcher. The web UI includes a full policy editor with the complete Thunderbird policy catalogue.
For Microsoft Edge on Linux, the agent writes bor_managed.json into each Edge managed-policy directory and removes it when the last bound policy is deleted. The web UI provides a tree-based editor with JSON validation and setting previews.
The Firewalld zone policy type manages zones on enrolled nodes, including services, ports, forward ports, rich rules, masquerade, interfaces, sources, and zone targets. The agent writes zone XML to /etc/firewalld/zones/, validates it with firewall-cmd, and reloads firewalld. Zone files are tamper-protected like other managed files.
The web UI underwent a full modernization pass using PatternFly 6, featuring URL routing with working back/forward navigation, a full-page policy editor at /policies/:id/edit instead of nested modals, and server-side pagination for scalable lists. New safety features include unsaved-changes guards, confirmation dialogs for destructive type changes, and read-only configuration views for released policies. The interface also includes type-to-confirm dialogs for all resource deletes and accessibility improvements meeting WCAG 2.2 AA standards.
Additional changes include per-action role-based access control (RBAC) allowing finer-grained delegation of admin duties, and Polkit rule support for variable conditions via action.lookup(). The release incorporates a dedicated security hardening pass, including strict agent identity binding to mTLS certificates, migration of SHA-256-encrypted TOTP secrets to HKDF-derived encryption, SSRF protection in repository import helpers, and protection against spreadsheet formula injection in audit log CSV exports. The server TLS certificate now automatically regenerates when SANs no longer match configured hostnames.
The frontend was updated to React 19.2 and react-router 8.3, with TypeScript typecheck enforcement in CI. Agents must be upgraded to v0.8.0 to enforce the new policy types, and external tooling built against the protobuf schema requires regeneration.
Key facts
- Bor v0.8.0 adds three new policy types: Thunderbird, Microsoft Edge for Business, and Firewalld zones
- The web UI received a complete modernization with URL routing, full-page policy editor, and server-side pagination
- New per-action RBAC allows finer-grained delegation of admin duties instead of blanket permissions
- Security hardening includes strict mTLS binding, TOTP secret migration, and SSRF protection in repository helpers
- Frontend updated to React 19.2 and react-router 8.3 with TypeScript enforcement
- All Dependabot alerts resolved, including react-router RSC CSRF advisory