Drop privileges when seeding Dell haptic config (#497)

The root-run package hook changed ownership of paths below a
user-controlled home directory. A config symlink could redirect chown to
an arbitrary root-owned file during installation or upgrade.

Run the config writer as the target desktop user and remove the privileged
ownership changes. This also prevents the missing-config path from writing
through a user-controlled pathname as root. Add regression coverage and
bump the package release.

Reported-by: piratemoo (Esther) <22439214+piratemoo@users.noreply.github.com>
Link: https://github.com/piratemoo/Arbitrary-File-Ownership-Change-via-Symlink-LPE

pkgbuilds/dell-xps-touchpad-haptics/PKGBUILD

@@ -2,7 +2,7 @@
 
 pkgname=dell-xps-touchpad-haptics
 pkgver=1.0.0
-pkgrel=3
+pkgrel=4
 pkgdesc="Synaptics haptic touchpad presets for Dell XPS on Omarchy"
 arch=('x86_64')
 url="https://github.com/omacom-io/omarchy-pkgs"

pkgbuilds/dell-xps-touchpad-haptics/dell-xps-touchpad-haptics.install

@@ -3,6 +3,7 @@ _default_level="high"
 _env_path="/etc/dell-xps-touchpad-haptics.env"
 _legacy_env_path="/etc/omarchy-dell-haptic-touchpad.env"
 _legacy_override_dir="/etc/systemd/system/dell-xps-haptic-touchpad.service.d"
+_runuser_path="/usr/bin/runuser"
 
 _existing_home() {
   local line value
@@ -124,18 +125,13 @@ _ensure_user_config() {
   local config_dir="$home/.config/omarchy"
   local config_path="$config_dir/dell-haptic.conf"
 
-  if [[ ! -f $config_path ]] && ! env HOME="$home" USER="$user" LOGNAME="$user" \
+  if [[ ! -f $config_path ]] && ! "$_runuser_path" --user "$user" -- \
+    /usr/bin/env HOME="$home" USER="$user" LOGNAME="$user" \
     /usr/bin/dell-xps-touchpad-haptics set "$_default_level"; then
     echo ":: Failed to create ${config_path} for user '$user'." >&2
     return 1
   fi
 
-  if [[ -f $config_path ]]; then
-    chown "$user:$user" "$home/.config" 2>/dev/null || true
-    chown "$user:$user" "$config_dir" 2>/dev/null || true
-    chown "$user:$user" "$config_path" 2>/dev/null || true
-  fi
-
   return 0
 }