Introduction and Overview

Root Lock by HeartSuite | Humans in Command

Overview: Every attack does three things: run a program, access files, make a network connection. Root Lock by HeartSuite checks each program at the kernel, including a program running as root. What the allowlist check covers names the starts and file changes that still succeed.

In Lockdown, Root Lock blocks a program start that presents no allowlist entry, a file read or write on the open path that the entry does not grant, and an outbound connection the entry does not grant. By design, remote root has no intended path to change the sealed allowlist while the machine is running. Unsealing means booting the maintenance kernel from a physical or serial console. sshd is stopped when Lockdown seals, unless you chose to leave it running before the seal, and SSH cannot lift the seal. After the unseal, SSH is how you work in Setup Mode. Lockdown covers activation. Circumvention and recovery covers residual risk.

In this section

• Root Lock Overview — Core features, how it protects against malware, and the setup checklist.
• The Setup Journey — Initial setup, then the Dashboard checklist from installation to Lockdown, Cloud Path and Local Path, and how the Dashboard guides you.
• System Requirements — Compatible systems, kernel versions, and prerequisites.
• Deployment Scenarios — Environments and workloads where Root Lock fits best, plus notes on incompatible stacks.
• How Root Lock Compares — What Root Lock replaces, what it complements, and how it can be circumvented.
• Security as Economics — Which scanner findings can wait for the standard change window, and what that does to attacker cost.

For detailed installation steps, see Installation. Getting Started covers Cloud Path and Local Path. On a single host they converge at the Dashboard after initial setup. Both paths install one machine at a time; to apply allowlist policy across many hosts from Ansible, Terraform, or GitOps, see Central Policy.