A listener will accept a stranger by default
Inbound default-accept is a different OS assumption from Root Lock’s outbound allowlist. How Root Lock Firewall addresses that hole.
Inbound default-accept is the other Unix inheritance
Root Lock allowlists per-program outbound. Root Lock Firewall is the host-path stateful filter for a closed appliance.
Root Lock Firewall | Prototype
Overview: A listening service on a Linux host accepts inbound connections unless a packet filter refuses them. Root Lock by HeartSuite does not provide that filter. It controls outbound destinations per program, at the kernel, using literal IP addresses. Root Lock Firewall is the inbound and host-path stateful filter for a closed HeartSuite appliance: observe real traffic, approve a finite allowlist, seal it. The two products address different layers and are designed to be used together on the appliance image.
In this section
- The security problem Root Lock Firewall solves — Why inbound default-accept is a different OS assumption from Root Lock’s outbound allowlist.
- Root Lock Firewall overview — Closed appliance, stateful inspection, observation through Firewall Lockdown, and what stays out of scope.
- Walkthrough — The intended Dashboard journey from first boot to a sealed ruleset.
- What Root Lock Firewall does and does not cover — Where the packet boundary holds, where it does not, and what to use alongside it.
Observe real traffic, approve a list, seal it
Host-shaped stateful filter on a closed appliance: observe real traffic, approve a finite allowlist for this box, then seal it. Root Lock is the OS under the filter, not the filter.
Where the packet boundary holds — and where it does not
Root Lock Firewall’s packet boundary, what it does not see on the host, and which tool to put beside it for those gaps.
Walkthrough: observe, approve, seal
From first boot to Firewall Lockdown: observe, approve, seal. The intended Dashboard path on a Root Lock Firewall appliance.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.