Drop privileges when seeding Dell haptic config (#497)
The root-run package hook changed ownership of paths below a user-controlled home directory. A config symlink could redirect chown to an arbitrary root-owned file during installation or upgrade. Run the config writer as the target desktop user and remove the privileged ownership changes. This also prevents the missing-config path from writing through a user-controlled pathname as root. Add regression coverage and bump the package release. Reported-by: piratemoo (Esther) <22439214+piratemoo@users.noreply.github.com> Link: https://github.com/piratemoo/Arbitrary-File-Ownership-Change-via-Symlink-LPE
This commit is contained in:
1 parent
5cccebaa17
commit
b422d37fa2
4 files changed
+58
-8
No files matched your search
@@ -45,6 +45,7 @@ jobs:
|
||||
./bin/sync-rebuilds --self-test
|
||||
./bin/omarchy-pkgs self-test
|
||||
./bin/omarchy-release self-test
|
||||
./tests/dell-xps-touchpad-haptics-install.sh
|
||||
./tests/partial-release.sh
|
||||
./tests/published-build-plan.sh
|
||||
'
|
||||
Reference in new issue
Block a user