From 0801356155c0ea58583f9297da1cbe3dda51a52a Mon Sep 17 00:00:00 2001
From: Emir Beganovic <beganovic.emir@gmail.com>
Date: Sat, 10 Oct 2026 02:52:51 +0200
Subject: [PATCH] Test the startup check from a subshell, with a decoy -p, and
 rejecting in a PID namespace

The rejection inside the new PID namespace ran without privileged mode, so
it never reached the caller lookup, and nothing would have caught a check
that accepted -p anywhere in the arguments.
---
 test/shell.d/security-bash-startup-test.sh | 28 +++++++++++-----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/test/shell.d/security-bash-startup-test.sh b/test/shell.d/security-bash-startup-test.sh
index 8ca8a324..f9c9d924 100755
--- a/test/shell.d/security-bash-startup-test.sh
+++ b/test/shell.d/security-bash-startup-test.sh
@@ -7,24 +7,24 @@ source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
 test_tmp=$(mktemp -d)
 trap 'rm -rf "$test_tmp"' EXIT
 
-cat >"$test_tmp/entrypoint" <<SH
-#!/bin/bash -p
-source "$ROOT/bin/omarchy-security-functions"
-omarchy_security_require_privileged_bash_startup
-SH
+check=omarchy_security_require_privileged_bash_startup
+printf '#!/bin/bash -p\nsource "%s"\n%s && ( %s )\n' "$ROOT/bin/omarchy-security-functions" "$check" "$check" >"$test_tmp/entrypoint"
+# Privileged mode turned on after startup: the mode is set, the proof is not.
+printf 'set -p\nsource "%s"\n%s\n' "$ROOT/bin/omarchy-security-functions" "$check" >"$test_tmp/late"
 chmod +x "$test_tmp/entrypoint"
 
-"$test_tmp/entrypoint" || fail "a script started as bash -p passes the startup check"
-( "$test_tmp/entrypoint" ) || fail "the startup check passes from a subshell"
-pass "a script started as bash -p passes the startup check"
+"$test_tmp/entrypoint" || fail "a script started as bash -p passes the startup check, from a subshell too"
+pass "a script started as bash -p passes the startup check, from a subshell too"
 
-if /usr/bin/bash -c "set -p; source '$ROOT/bin/omarchy-security-functions'; omarchy_security_require_privileged_bash_startup"; then
-  fail "bash that only turned -p on later is rejected"
-fi
+for arguments in "" "-p"; do
+  if /usr/bin/bash "$test_tmp/late" $arguments; then
+    fail "bash that only turned -p on later is rejected" "arguments: $arguments"
+  fi
+done
 if /usr/bin/bash "$test_tmp/entrypoint"; then
   fail "a script not started with -p is rejected"
 fi
-pass "bash not started with -p is rejected"
+pass "bash not started with -p is rejected, whatever its other arguments"
 
 # arch-chroot runs the installer in a new PID namespace under the outer /proc,
 # so the caller's own PID is not the number /proc knows it by.
@@ -32,8 +32,8 @@ in_new_pid_namespace=(unshare --user --map-root-user --fork --pid)
 if "${in_new_pid_namespace[@]}" /usr/bin/true 2>/dev/null; then
   "${in_new_pid_namespace[@]}" /usr/bin/bash -c "for i in {1..50}; do /usr/bin/true; done; '$test_tmp/entrypoint'; exit" </dev/null ||
     fail "the startup check passes in a new PID namespace under the outer /proc"
-  if "${in_new_pid_namespace[@]}" /usr/bin/bash -c "/usr/bin/bash '$test_tmp/entrypoint'; exit" </dev/null; then
-    fail "a script not started with -p is rejected in a new PID namespace"
+  if "${in_new_pid_namespace[@]}" /usr/bin/bash -c "for i in {1..50}; do /usr/bin/true; done; /usr/bin/bash '$test_tmp/late' -p; exit" </dev/null; then
+    fail "bash that only turned -p on later is rejected in a new PID namespace"
   fi
   pass "the startup check sees its caller in a new PID namespace, as under arch-chroot"
 else