Architecture
Two processes with different privilege levels:
- Engine (oathkeeper_srv.exe) — C++20, runs as a scheduled task with highest privileges. Handles all enforcement.
- UI (Oathkeeper.exe) — C# WPF, requires Administrator privileges. Provides the user interface.
Why a Scheduled Task
Windows Services run in Session 0 with no access to the interactive desktop. Oathkeeper needs EnumWindows and SetWindowsHookEx(WH_KEYBOARD_LL), both of which require an interactive user session. A scheduled task with /sc onlogon /rl HIGHEST satisfies both requirements.
Named Pipe Security
The IPC pipe at \\.\pipe\OathkeeperPipe uses a restrictive DACL:
- SYSTEM — Full access
- Administrators — Full access
Everyone is explicitly denied. Only elevated processes and SYSTEM can communicate with the engine.
Bypass Mechanism
Two emergency bypass methods, both SHA-256 protected:
- Keyboard Bypass — 10-character code typed via keyboard. The last 10 chars are continuously hashed and compared. Only the hash is stored.
- Console Bypass — Sent over IPC as a SHA-256 hash. On match, all punishments stop and state is reset.
Both hashes are configurable via bypass_config.json. Defaults are placeholders.
Time Tamper Protection
System time is checked against the pledge expiry every 30 seconds. Tolerance is 1 day past expiry. If manipulation is detected, screen freeze and hardware beep are force-enabled immediately.
SafeBoot Persistence
The engine registers under both SafeBoot configurations: HKLM\...\SafeBoot\Minimal\OathkeeperEngine and HKLM\...\SafeBoot\Network\OathkeeperEngine, ensuring enforcement continues even in Safe Mode.
Credential Storage
Email credentials are encrypted with Windows DPAPI (CryptProtectData, CRYPTPROTECT_UI_FORBIDDEN). Encryption is machine-specific and tied to the user's Windows login.
State File Protection
State files in C:\ProgramData\Oathkeeper\ are protected by filesystem ACLs (SYSTEM and Administrators only). All runtime files are excluded from version control via .gitignore.