Introducing µlock

hugo@whynothugo.nl (Hugo Osvaldo Barrera) — Sat, 06 Jun 2026 14:05:59 +0200

Last weekend I sat down and set into code a project that has been living in my head rent-free for some time: µlock (a.k.a: ulock).

ulock is a minimal Wayland screen-locker, designed to work without relying on any setuid binary on Linux. This is done by relying on the tcb password shadowing scheme. The gist of this scheme is: each user’s shadow entry is stored in /etc/tcb/$USER/shadow instead of /etc/shadow, and each user has permissions to read their own encrypted password’s hash (and to edit it, depending on the administrator’s policy). I works in environments where setuid binaries are disabled entirely (but is not limited to those).

Ulock on WhyNotHugo (雨果)

Introducing µlock