Show HN: Bor – Open-source policy management for Linux desktops

What landed well is the project’s tight scope. The design avoids SSH fanout and avoids arbitrary script execution on clients. That is not just taste. It is the core security claim. Machines connect outbound, so there is no need to expose inbound SSH on laptops or keep server-side credentials that can log into the whole fleet. The agent enforces policies by using native lockdown features where possible, like dconf locks and KDE immutability flags, and by writing root-owned files under /etc for apps that already treat managed policy as non-overridable. Drift correction is event-driven rather than timer-based. The agent watches managed files with inotify and rewrites them immediately if a sudo user, package postinstall, or another tool changes them. That makes Bor look more like a policy appliance than another automation runner. The practical limits are also clear. Bor is not trying to replace Active Directory, Samba, or FreeIPA. It sits beside them and currently only supports LDAP and Kerberos, with temporary enrollment tokens for non-domain devices. Several people said they already solve similar problems with Ansible or Pyinfra, and that remains the obvious comparison. The case for Bor is that many admins want strict, auditable enforcement without writing code or giving a management plane arbitrary root execution. The weak spots today are breadth and ecosystem fit. Enterprise SSO is not there yet, desktop coverage is still uneven, and some obvious compliance integrations like SCAP are only wish-list items.