feat: User-level policy and floor enforcement (EPIC-17 gap) #30

New issue

Closed

opened 2026-07-29 11:00:00 +02:00 by elegos · 0 comments

elegos commented

2026-07-29 11:00:00 +02:00

Owner

Issue

docs/lld/polman.md:160–161 documents two deferred features from EPIC-17:

User-level policy (~/.local/share/linux-hello/policy.sealed): currently only system policy (/etc/linux-hello/policy.sealed) is implemented. Users cannot override thresholds for their own services.
Floor enforcement: the daemon merges system and user policy layers without validating that user overrides do not breach system floors. A user setting min_score = 0 for sudo would currently take effect silently rather than being clamped to the system floor.

Impact

The layered policy model described in ARCHITECTURE.md §16 is not enforced. System administrators cannot set per-service floors that users cannot override.

Fix

Implement user policy file loading from ~/.local/share/linux-hello/policy.sealed (TPM-sealed, per-user).
Merge system + user layers in the daemon at policy read time.
Enforce floors: clamp any user min_score to the system floor for that service; silently ignore (log warning) rather than error.
Extend linux-hello-polman with --user flag to edit user-level policy.

## Issue `docs/lld/polman.md:160–161` documents two deferred features from EPIC-17: 1. **User-level policy** (`~/.local/share/linux-hello/policy.sealed`): currently only system policy (`/etc/linux-hello/policy.sealed`) is implemented. Users cannot override thresholds for their own services. 2. **Floor enforcement**: the daemon merges system and user policy layers without validating that user overrides do not breach system floors. A user setting `min_score = 0` for `sudo` would currently take effect silently rather than being clamped to the system floor. ## Impact The layered policy model described in ARCHITECTURE.md §16 is not enforced. System administrators cannot set per-service floors that users cannot override. ## Fix - Implement user policy file loading from `~/.local/share/linux-hello/policy.sealed` (TPM-sealed, per-user). - Merge system + user layers in the daemon at policy read time. - Enforce floors: clamp any user `min_score` to the system floor for that service; silently ignore (log warning) rather than error. - Extend `linux-hello-polman` with `--user` flag to edit user-level policy.

elegos added this to the Foundation project

2026-07-29 11:00:07 +02:00

elegos

2026-07-29 11:20:56 +02:00