[EPIC-17] Policy manager (linux-hello-polman) #17

New issue

Closed

opened 2026-07-26 23:18:28 +02:00 by elegos · 0 comments

elegos commented

2026-07-26 23:18:28 +02:00

Owner

Secure policy editor: TPM-sealed policies, kernel keyring, per-user isolation.

Scope

Policy files TPM-sealed, never plaintext on disk
Editing via linux-hello-polman (visudo-style)
memfd_create + mlock + PR_SET_DUMPABLE for plaintext buffer
Decryption key in Linux kernel keyring (add_key), not process memory
Decryption via kernel AF_ALG crypto API
Policy layering: system floor + user override
Auth requirement: any enrolled factor (user policy), floor PIN score=40 (system policy)
CLI: built-in editor (no $EDITOR — prevents swap file leaks)
GUI: policy editor panel in linux-hello-enroll
ResealForCurrentKernel D-Bus method
Re-enrollment in PCR mismatch: per-user only, does not affect other users

Secure policy editor: TPM-sealed policies, kernel keyring, per-user isolation. ## Scope - Policy files TPM-sealed, never plaintext on disk - Editing via linux-hello-polman (visudo-style) - memfd_create + mlock + PR_SET_DUMPABLE for plaintext buffer - Decryption key in Linux kernel keyring (add_key), not process memory - Decryption via kernel AF_ALG crypto API - Policy layering: system floor + user override - Auth requirement: any enrolled factor (user policy), floor PIN score=40 (system policy) - CLI: built-in editor (no $EDITOR — prevents swap file leaks) - GUI: policy editor panel in linux-hello-enroll - ResealForCurrentKernel D-Bus method - Re-enrollment in PCR mismatch: per-user only, does not affect other users

elegos added this to the EPIC-17 milestone

2026-07-26 23:18:28 +02:00

elegos added the

area: security

epic

labels

2026-07-26 23:18:28 +02:00

elegos added this to the Foundation project

2026-07-26 23:21:30 +02:00

elegos closed this issue

2026-07-28 12:22:49 +02:00