How OpenLogi Handles Security: Local-First Permission Management and OS Integration

OpenLogi processes all data locally without external transmission, implementing a dedicated permission abstraction layer that queries macOS and Linux privacy controls before accessing sensitive hardware like cameras, Bluetooth, and input devices.

OpenLogi is an open-source Rust automation framework designed with a privacy-first architecture. Unlike cloud-dependent automation tools, it handles security considerations through a local-only processing model and granular permission enforcement. The codebase isolates privilege management in the dedicated openlogi-permissions crate to ensure least-privilege access to operating system resources.

Local-First Security Architecture

OpenLogi operates entirely on local infrastructure without transmitting user data to external services. This architectural decision eliminates network-based attack vectors and ensures sensitive automation data never leaves the host machine.

The framework implements the principle of least privilege by querying the operating system for exact permissions before accessing protected resources. Rather than requesting broad system access, OpenLogi checks specific capabilities—Accessibility, InputMonitoring, Bluetooth, and Camera—through isolated platform-specific implementations.

The Permission Abstraction Layer

The security model centers on the openlogi-permissions crate, which defines a unified interface for privilege management across platforms.

Core Types and Statuses

In crates/openlogi-permissions/src/lib.rs, the crate exposes a Permission enum representing privacy-protected capabilities:

• Accessibility – UI automation control
• InputMonitoring – HID event capture
• Bluetooth – Wireless device management
• Camera – Visual input access

Each permission query returns a PermissionStatus variant indicating whether access is Granted, Denied, or Unknown. This tri-state approach allows the application to distinguish between explicit denials and unrequested permissions that may require user prompting.

Platform-Specific Implementations

macOS checks reside in crates/openlogi-permissions/src/macos.rs, which utilizes system APIs such as IOHIDAccessType for input monitoring validation. The implementation queries Bluetooth access status through private framework bindings and delegates camera authorization to openlogi_camera::CameraAuthorization.

Linux implementations in crates/openlogi-permissions/src/linux.rs inspect /dev device node permissions and translate Linux-specific errors like ErrorKind::PermissionDenied into the standardized PermissionStatus enum. This approach maps filesystem permissions to logical capability grants without requiring elevated privileges during the check itself.

Runtime Enforcement and Agent Guards

The background openlogi-agent enforces permission boundaries before executing privileged operations. Located in crates/openlogi-agent/src/main.rs, the agent validates permission statuses before reading HID events, accessing Bluetooth adapters, or capturing camera frames.

When a required permission returns Denied, the agent skips the operation and propagates the status to the UI layer. For Unknown statuses, the system can trigger user prompts without crashing or attempting unauthorized access.

User Transparency and System Integration

OpenLogi provides visibility into permission states through the desktop interface defined in crates/openlogi-desktop/src/windows/settings/permissions.rs. This settings page displays real-time permission statuses and invokes openlogi_permissions::open_pane(permission) when users click "Open Settings," directing them to the appropriate system preference pane (e.g., Privacy_Accessibility on macOS).

Practical Implementation Examples

Query permission status before accessing sensitive hardware:

use openlogi_permissions::{self as permissions, PermissionStatus};

// Check input monitoring authorization
let status = permissions::input_monitoring();
match status {
    PermissionStatus::Granted => println!("Input monitoring active"),
    PermissionStatus::Denied => eprintln!("Permission denied in System Preferences"),
    PermissionStatus::Unknown => {
        // Prompt user to grant access
        permissions::open_pane(openlogi_permissions::Permission::InputMonitoring);
    }
}

Guard camera capture behind permission checks:

use openlogi_permissions::PermissionStatus;

match permissions::camera() {
    PermissionStatus::Granted => start_camera_capture(),
    PermissionStatus::Denied => {
        eprintln!("Camera permission denied – aborting capture");
        // Operation skipped, no panic or escalation
    }
    PermissionStatus::Unknown => {
        eprintln!("Camera status unknown – opening system preferences");
        permissions::open_pane(openlogi_permissions::Permission::Camera);
    }
}

Summary

• OpenLogi implements a local-only security model that never transmits user data externally according to the source code architecture.
• The openlogi-permissions crate abstracts platform-specific privacy checks into a unified Permission enum with PermissionStatus returns.
• macOS validates access via IOHIDAccessType and camera authorization frameworks in crates/openlogi-permissions/src/macos.rs.
• Linux inspects /dev filesystem permissions in crates/openlogi-permissions/src/linux.rs to determine hardware access rights.
• The openlogi-agent enforces least privilege by checking permissions before executing sensitive I/O operations in crates/openlogi-agent/src/main.rs.
• Users manage permissions through transparent UI controls in crates/openlogi-desktop/src/windows/settings/permissions.rs that integrate directly with system preference panes.

Frequently Asked Questions

Does OpenLogi send any data to external servers?

No. According to the OpenLogi source code, the application runs entirely locally and never transmits user data to external services. All automation logic, permission checks, and hardware access occur within the host machine's process boundary, eliminating network-based exfiltration vectors.

How does OpenLogi handle denied permissions on macOS?

When the openlogi-agent detects a PermissionStatus::Denied return from crates/openlogi-permissions/src/macos.rs, it skips the privileged operation rather than crashing or attempting unauthorized access. The UI layer in crates/openlogi-desktop/src/windows/settings/permissions.rs reflects this denial, allowing users to navigate to System Preferences via open_pane() to modify the setting.

What permission types does OpenLogi require?

The framework defines four primary permission categories in the Permission enum: Accessibility (for UI automation), InputMonitoring (for HID event capture), Bluetooth (for wireless device management), and Camera (for visual input). Each maps to platform-specific privacy controls on macOS and device file permissions on Linux.

How does the Linux implementation check permissions without elevated privileges?

The linux.rs implementation inspects filesystem permissions on /dev device nodes and handles standard library errors like ErrorKind::PermissionDenied. This read-only inspection determines access rights without requiring sudo or capability escalation during the check phase, as implemented in crates/openlogi-permissions/src/linux.rs.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}