From 43b91163f6033f3a562653e4c4217cb407eb72f0 Mon Sep 17 00:00:00 2001 From: Afonso Oliveira Date: Thu, 17 Sep 2026 20:33:59 +0100 Subject: [PATCH] Install cleanup traps before the entry revocation and bound the bus probe The protected entrypoints revoked the sudo timestamp before installing their cleanup traps, so a signal or failure during that first sudo -k exited without the cleanup path. Install the traps first. The shell restart probed the notification bus name with busctl's default 25 second timeout, so an unresponsive user bus could stall the restart by that much per probe. Bound each probe to one second. Co-Authored-By: Claude Fable 5.1 --- bin/omarchy-channel-set | 4 +++- bin/omarchy-refresh-pacman | 4 +++- bin/omarchy-restart-shell | 4 +++- bin/omarchy-update | 4 +++- bin/omarchy-update-stay-awake | 4 +++- 5 files changed, 15 insertions(+), 5 deletions(-) diff --git a/bin/omarchy-channel-set b/bin/omarchy-channel-set index a00c9d92..039d3292 100755 --- a/bin/omarchy-channel-set +++ b/bin/omarchy-channel-set @@ -15,8 +15,10 @@ set -euo pipefail omarchy_security_sanitize_bash_environment "$0" "$@" omarchy_security_require_source_root "$0" user_path=$PATH -omarchy_security_revoke_sudo_timestamp || exit 1 +# Traps first, so a signal or failure during the entry revocation still +# exits through the cleanup path. omarchy_security_install_sudo_cleanup_traps +omarchy_security_revoke_sudo_timestamp || exit 1 omarchy_security_enable_no_update_sudo usage() { echo "Usage: omarchy-channel-set [stable|rc|edge|dev]"; } diff --git a/bin/omarchy-refresh-pacman b/bin/omarchy-refresh-pacman index cd9eab11..7406e6ad 100755 --- a/bin/omarchy-refresh-pacman +++ b/bin/omarchy-refresh-pacman @@ -18,8 +18,10 @@ omarchy_security_require_source_root "$0" # caller's original path over the same way the updater receives it. user_path=${OMARCHY_UPDATE_USER_PATH:-$PATH} unset OMARCHY_UPDATE_USER_PATH -omarchy_security_revoke_sudo_timestamp || exit 1 +# Traps first, so a signal or failure during the entry revocation still +# exits through the cleanup path. omarchy_security_install_sudo_cleanup_traps +omarchy_security_revoke_sudo_timestamp || exit 1 omarchy_security_enable_no_update_sudo channel="${1:-stable}" diff --git a/bin/omarchy-restart-shell b/bin/omarchy-restart-shell index 4ca6ba29..8d3d6ce9 100755 --- a/bin/omarchy-restart-shell +++ b/bin/omarchy-restart-shell @@ -61,8 +61,10 @@ relock_session() { return 1 } +# A short timeout keeps an unresponsive user bus from stalling the restart; +# busctl would otherwise wait 25 seconds per probe. notifications_ready() { - [[ $(busctl --user call org.freedesktop.DBus /org/freedesktop/DBus \ + [[ $(busctl --user --timeout=1s call org.freedesktop.DBus /org/freedesktop/DBus \ org.freedesktop.DBus NameHasOwner s org.freedesktop.Notifications 2>/dev/null) == "b true" ]] } diff --git a/bin/omarchy-update b/bin/omarchy-update index 2d5ad474..9c6d21d7 100755 --- a/bin/omarchy-update +++ b/bin/omarchy-update @@ -20,8 +20,10 @@ omarchy_security_require_source_root "$0" # Preserve the caller's path only for the later unprivileged hook/mise phases. user_path=${OMARCHY_UPDATE_USER_PATH:-$PATH} unset OMARCHY_UPDATE_USER_PATH -omarchy_security_revoke_sudo_timestamp || exit 1 +# Traps first, so a signal or failure during the entry revocation still +# exits through the cleanup path. omarchy_security_install_sudo_cleanup_traps +omarchy_security_revoke_sudo_timestamp || exit 1 omarchy_security_enable_no_update_sudo update_stay_awake_stopped=0 diff --git a/bin/omarchy-update-stay-awake b/bin/omarchy-update-stay-awake index af941c4a..be27a2cc 100755 --- a/bin/omarchy-update-stay-awake +++ b/bin/omarchy-update-stay-awake @@ -15,8 +15,10 @@ omarchy_security_require_privileged_bash_startup || exit 126 set -e omarchy_security_sanitize_bash_environment "$0" "$@" omarchy_security_require_source_root "$0" -omarchy_security_revoke_sudo_timestamp || exit 1 +# Traps first, so a signal or failure during the entry revocation still +# exits through the cleanup path. omarchy_security_install_sudo_cleanup_traps +omarchy_security_revoke_sudo_timestamp || exit 1 omarchy_security_enable_no_update_sudo state_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}/omarchy-update-stay-awake"