Root Lock by HeartSuite Documentation

Root Lock by HeartSuite | Humans in Command

Overview: Every attack does three things: run a program, access files, make a network connection. Root Lock by HeartSuite enforces default-deny on all three at the kernel, per program, including as root.

In Lockdown, anything not on the allowlist is blocked before it can act. An attacker who already has remote root cannot edit the sealed allowlist while the machine is running. To leave Lockdown, pick Maintenance: unseal and return to Root Lock in GRUB from a physical or serial console; that boot runs HS_unlock.sh, which is what lifts the seal — sshd does not. Relocking from the maintenance kernel is a reboot, because the GRUB default stays Root Lock. sshd is stopped when Lockdown seals, unless you chose to leave it running before the seal. After the unseal, SSH is how you work in Setup Mode. Lockdown covers activation. Circumvention and recovery covers residual risk.

On a single host, Root Lock supports two setup paths. Cloud Path and Local Path both arrive at the Dashboard after initial setup.

Cloud Path and Local Path install one machine at a time, and Ansible, Terraform, and GitOps apply allowlist policy after that install — see Central Policy.

Root Lock fits production servers, regulated workstations, build and CI infrastructure, and AI agent sandboxes. Shared-kernel containers (Docker, containerd, Kubernetes, CRI-O, Podman) and rootless containers are not a fit by design: under Lockdown, Root Lock refuses the new mounts a runtime makes. A shared-kernel container guest is not a fit by design, because Root Lock must boot its own kernel. Local eBPF tooling is not a fit by design: the BPF syscall is off, so there is no eBPF program to load. Build and run OCI images on another host. See Deployment Scenarios.

Introduction and concepts

• Introduction and Overview — Overview, setup process, Dashboard guidance, and requirements.
• Deployment Scenarios — Where Root Lock fits best, and where it doesn’t.
• How Root Lock Compares — What Root Lock replaces (Falco, AppArmor, gVisor, EDR on the enforcement dimension), what it complements (SIEM, NDR, VA), and how it can be circumvented.
• Allowlisting Programs — How to approve programs and their file and network permissions using the review queues.
• Lockdown — Setup Mode and Lockdown.

Get started

Start with Quick Start — it covers Cloud Path and Local Path and links each step in order: prerequisites, download, install, verify, and allowlist.

The pages below are the individual steps, linked from Quick Start:

• Obtaining and Installing Root Lock — Download and setup steps (Local Path).
• Verifying Installation — Confirm initial setup is complete in the Dashboard.

Use and manage

• Network and Remote Access — Configure network permissions.
• Script Launchers — Secure interpreted script execution.
• Alert Settings — Set up push notifications for blocks and state changes.
• SIEM and Fleet Integration — Connect to Splunk, Elastic, PagerDuty, and other tools at fleet scale (syslog, webhook, status JSON).
• Central Policy Management and External Control — Drive allowlist policy from Ansible, Terraform, ServiceNow, GitOps, and custom automation.
• Maintenance — Protecting during maintenance, file backup and versioning, cache adjustment, kmod file-access narrowing, updating Root Lock, and reprovisioning locked fleets from an updated image.
• Scanner deadlines — Which scanner findings can wait for the standard change window your policy already names.

Troubleshoot and reference

• Troubleshooting and Logs — Common issues and solutions.
• FAQs — Answers to frequent questions.
• Kernel Security Transparency — CVE status and Not Affected rationale for the Root Lock kernel.
• Kernel Hardening — Objective measurements, procurement guidance, and the Enterprise Adoption Guide for regulated environments.
• Appendices — List of included tools.

Subscription and support

• Subscription — Activate your subscription for Lockdown.
• For updates or help, email support@heartsecsuite.com or visit heartsecsuite.com.

Ready to get started?

Already have a subscription? Follow the Quick Start — the Dashboard guides you from there.

Evaluating? Cloud instances and the Local Path package are available at heartsecsuite.com.

Also in this documentation

• HeartSuite Firewall — Prototype. Inbound and host-path filter for a closed HeartSuite appliance.
• HeartSuite Joint File System (HJFS) — Prototype. Per-program file isolation on a standard unmodified kernel.
• HeartSuite Exec — Prototype. HJFS UI for program install, update, and version selection.

About this Documentation: Covers Root Lock v1.6.4.