Drop privileges when seeding Dell haptic config (#497)

The root-run package hook changed ownership of paths below a
user-controlled home directory. A config symlink could redirect chown to
an arbitrary root-owned file during installation or upgrade.

Run the config writer as the target desktop user and remove the privileged
ownership changes. This also prevents the missing-config path from writing
through a user-controlled pathname as root. Add regression coverage and
bump the package release.

Reported-by: piratemoo (Esther) <22439214+piratemoo@users.noreply.github.com>
Link: https://github.com/piratemoo/Arbitrary-File-Ownership-Change-via-Symlink-LPE
This commit is contained in:
Basti authored and GitHub committed 2026-09-18 15:24:41 +02:00
1 parent 5cccebaa17
commit b422d37fa2
4 files changed
+58 -8

No files matched your search

+1
View File
@@ -45,6 +45,7 @@ jobs:
./bin/sync-rebuilds --self-test
./bin/omarchy-pkgs self-test
./bin/omarchy-release self-test
./tests/dell-xps-touchpad-haptics-install.sh
./tests/partial-release.sh
./tests/published-build-plan.sh
'