Require approval for new Thunderbolt accessories

bin/omarchy-provision-owner

@@ -1040,6 +1040,9 @@ run_provisioning() {
     usb_authorization_provision_owner "$username"
   fi
 
+  log_step "enrolling the owner's Thunderbolt accessories"
+  /usr/bin/omarchy-thunderbolt-authorization-admin owner
+
   log_step "cleaning up provisioning state"
   cleanup_oem_state
   log_step "first-boot setup complete"

bin/omarchy-remove-security-thunderbolt-authorization

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# omarchy:summary=Restore Bolt's default authorization behavior
+
+set -euo pipefail
+
+gum confirm "Restore Bolt's previous policy? New accessories may be authorized automatically when IOMMU protection is active." || exit 0
+sudo /usr/bin/omarchy-thunderbolt-authorization-admin disable
+systemctl --user disable --now omarchy-thunderbolt-authorization.service
+echo "Previous Bolt policy restored. Saved Omarchy trust is retained for re-enabling."

bin/omarchy-remove-security-thunderbolt-boot

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# omarchy:summary=Restore saved Thunderbolt firmware boot permissions
+
+set -euo pipefail
+
+gum confirm "Restore the previous Thunderbolt firmware boot allowlists? Device approval will remain enabled." || exit 0
+sudo /usr/bin/omarchy-thunderbolt-authorization-admin boot-disable
+echo "Previous firmware boot permissions restored and verified."

bin/omarchy-security-functions

@@ -0,0 +1,137 @@
+#!/bin/bash
+
+# omarchy:hidden=true
+# omarchy:summary=Provide internal helpers for command-scoped sudo authentication
+
+if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
+  echo "omarchy-security-functions is an internal function library." >&2
+  exit 64
+fi
+
+omarchy_security_require_privileged_bash_startup() {
+  [[ $- == *p* ]] || return 1
+  /usr/bin/env -i /usr/bin/bash -p -c '
+    mapfile -d "" -t argv <"/proc/$1/cmdline" || exit 1
+    executable=$(/usr/bin/readlink -e -- "/proc/$1/exe") || exit 1
+    [[ $executable == "/usr/bin/bash" &&
+      ( ${argv[0]:-} == "/bin/bash" || ${argv[0]:-} == "/usr/bin/bash" ) &&
+      ${argv[1]:-} == "-p" ]]
+  ' omarchy-bash-startup "$$"
+}
+
+omarchy_security_sanitize_bash_environment() {
+  local script=$1
+  shift
+  local entry name environment_fd environment_pid
+  local -a unsets=()
+
+  # Read the raw environment: privileged Bash ignores exported functions, but
+  # leaves their records for ordinary child interpreters to import later.
+  exec {environment_fd}< <(/usr/bin/env -0)
+  environment_pid=$!
+  while IFS= read -r -d '' entry <&"$environment_fd"; do
+    name=${entry%%=*}
+    case "$name" in
+      BASH_ENV|ENV|SHELLOPTS|BASHOPTS|PS4|CDPATH|GLOBIGNORE|BASH_FUNC_*%%)
+        unsets+=(-u "$name")
+        ;;
+    esac
+  done
+  exec {environment_fd}<&-
+  wait "$environment_pid" || return 1
+  if (( ${#unsets[@]} > 0 )); then
+    exec /usr/bin/env "${unsets[@]}" /usr/bin/bash -p -- "$script" "$@"
+  fi
+}
+
+omarchy_security_require_source_root() {
+  local command_source command_name=${1##*/}
+  command_source=$(/usr/bin/readlink -e -- "$1") || return 1
+
+  # A runtime root selects the code used by this invocation. Accept the
+  # canonical checkout containing the entrypoint or the package's bin links.
+  if [[ ${OMARCHY_PATH:-} != /* || $(/usr/bin/realpath -e -- "$OMARCHY_PATH") != "$OMARCHY_PATH" ]] ||
+    ! { [[ $command_source == "$OMARCHY_PATH/bin/$command_name" ]] ||
+      [[ $OMARCHY_PATH == "/usr/share/omarchy" && $command_source == "/usr/bin/$command_name" ]]; }; then
+    echo "OMARCHY_PATH does not match this Omarchy command." >&2
+    return 1
+  fi
+}
+
+omarchy_security_sudo_supports_no_update() {
+  local help
+  help=$(LC_ALL=C /usr/bin/sudo -h 2>&1) || return 1
+  /usr/bin/grep -Eq '^usage: sudo .*\[[^]]*N[^]]*\]' <<< "$help"
+}
+
+omarchy_security_revoke_sudo_timestamp() {
+  /usr/bin/sudo -k
+}
+
+omarchy_security_exit_with_revoked_sudo() {
+  local status=$1
+  local message=${2:-Could not invalidate cached sudo authorization.}
+
+  trap - EXIT HUP INT TERM
+  if ! omarchy_security_revoke_sudo_timestamp; then
+    echo "$message" >&2
+    (( status != 0 )) || status=1
+  fi
+  exit "$status"
+}
+
+omarchy_security_install_signal_exit_traps() {
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+}
+
+omarchy_security_install_sudo_cleanup_traps() {
+  OMARCHY_SECURITY_SUDO_CLEANUP_MESSAGE=${1:-Could not invalidate cached sudo authorization.}
+  trap omarchy_security_run_sudo_cleanup_trap EXIT
+  omarchy_security_install_signal_exit_traps
+}
+
+omarchy_security_enable_no_update_sudo() {
+  local wrapper_dir="$OMARCHY_PATH/default/omarchy/sudo-no-update"
+  if ! omarchy_security_sudo_supports_no_update; then
+    echo "This sudo does not support --no-update; refusing mixed-trust work." >&2
+    return 1
+  fi
+  if [[ ! -f $wrapper_dir/sudo || ! -x $wrapper_dir/sudo ]]; then
+    echo "The command-scoped sudo wrapper is missing." >&2
+    return 1
+  fi
+  PATH="$wrapper_dir:$OMARCHY_PATH/bin:/usr/bin:/usr/sbin:/bin:/sbin"
+  OMARCHY_SUDO_NO_UPDATE=1
+  export PATH OMARCHY_SUDO_NO_UPDATE
+}
+
+omarchy_security_run_sudo_cleanup_trap() {
+  local status=$?
+
+  omarchy_security_exit_with_revoked_sudo "$status" \
+    "${OMARCHY_SECURITY_SUDO_CLEANUP_MESSAGE:-Could not invalidate cached sudo authorization.}"
+}
+
+omarchy_security_assert_root_directory() {
+  local path=$1 expected_mode=$2 canonical owner actual_mode
+
+  [[ $path == /* && -d $path && ! -L $path ]] || return 1
+  canonical=$(/usr/bin/realpath -e -- "$path") || return 1
+  [[ $canonical == "$path" ]] || return 1
+  read -r owner actual_mode < <(/usr/bin/stat -Lc '%u %a' -- "$path") || return 1
+  [[ $owner == "0" && $actual_mode == "$expected_mode" ]]
+}
+
+omarchy_security_prepare_private_root_directory() {
+  local path=$1 parent=$2
+
+  omarchy_security_assert_root_directory "$parent" 755 || return 1
+  if [[ -e $path || -L $path ]]; then
+    omarchy_security_assert_root_directory "$path" 700
+  else
+    /usr/bin/install -d -o root -g root -m 0700 -- "$path" || return 1
+    omarchy_security_assert_root_directory "$path" 700
+  fi
+}

bin/omarchy-setup-security-thunderbolt-authorization

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# omarchy:summary=Require approval for new Thunderbolt PCIe accessories
+# omarchy:args=[--quiet|status|recover]
+
+set -euo pipefail
+source "$OMARCHY_PATH/install/helpers/thunderbolt-policy.sh"
+source "$OMARCHY_PATH/install/helpers/thunderbolt-review.sh"
+
+if [[ ${1:-} == "status" ]]; then
+  tb_status
+elif [[ ${1:-} == "recover" && $# == 1 ]]; then
+  sudo /usr/bin/omarchy-thunderbolt-authorization-admin recover
+elif [[ $# == 0 || ( $# == 1 && $1 == "--quiet" ) ]]; then
+  if [[ ${1:-} != "--quiet" ]]; then
+    if [[ -f $TB_PENDING ]]; then tb_status; fi
+    echo "First setup, including a deferred setup, trusts connected accessories. Re-enabling a completed setup preserves saved trust."
+    gum confirm "Require approval for new Thunderbolt accessories?" || exit 0
+  fi
+  # System units and rules are shipped by omarchy-settings.
+  sudo install -Dm644 "$OMARCHY_PATH/default/polkit/org.omarchy.thunderbolt.policy" /usr/share/polkit-1/actions/org.omarchy.thunderbolt.policy
+  sudo systemctl daemon-reload
+  action=enable
+  if [[ ${1:-} == "--quiet" ]]; then
+    action=migrate
+  fi
+  sudo /usr/bin/omarchy-thunderbolt-authorization-admin "$action"
+  systemctl --user daemon-reload
+  systemctl --user enable --now omarchy-thunderbolt-authorization.service
+  if [[ -f /etc/omarchy/thunderbolt-authorization.enabled ]]; then
+    for ((attempt=0; attempt<10; attempt++)); do
+      if tb_public_snapshot >/dev/null 2>&1; then break; fi
+      sleep 1
+    done
+    tb_status
+  elif [[ -f $TB_PENDING ]]; then
+    tb_status
+  fi
+else
+  echo "Usage: omarchy-setup-security-thunderbolt-authorization [--quiet|status|recover]" >&2
+  exit 1
+fi

bin/omarchy-setup-security-thunderbolt-boot

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# omarchy:summary=Clear supported Thunderbolt firmware boot allowlists
+# omarchy:args=[recover]
+
+set -euo pipefail
+
+if [[ ${1:-} == "recover" && $# == 1 ]]; then
+  sudo /usr/bin/omarchy-thunderbolt-authorization-admin boot-recover
+elif [[ $# == 0 ]]; then
+  gum style --bold "Thunderbolt at Boot"
+  echo "This trusts connected accessories for use after Linux starts, then clears the firmware boot allowlist."
+  echo "Trusted Thunderbolt keyboards, storage, and network adapters may be unavailable at disk unlock."
+  echo "You must be able to unlock and recover without Thunderbolt accessories."
+  echo "All controllers must be connected and support a boot allowlist in user or secure mode."
+  echo "Older snapshots or another operating system may restore firmware boot permissions."
+  gum confirm "Clear firmware boot access with these recovery limits?" || exit 0
+  sudo /usr/bin/omarchy-thunderbolt-authorization-admin boot-enable
+  echo "Firmware boot allowlists cleared and verified. Current connections were not disconnected."
+else
+  echo "Usage: omarchy-setup-security-thunderbolt-boot [recover]" >&2
+  exit 1
+fi

bin/omarchy-system-factory-reset

@@ -320,6 +320,12 @@ scrub_factory_accounts() {
 sanitize_factory_baseline() {
   local factory="$1"
   btrfs property set -ts "$factory" ro false
+  if [[ -d $factory/var/lib/omarchy/thunderbolt-authorization || -f $factory/etc/omarchy/thunderbolt-authorization.enabled || -f $factory/etc/omarchy/thunderbolt-authorization.pending ]]; then
+    if ! /usr/bin/omarchy-thunderbolt-authorization-admin reset-root "$factory"; then
+      btrfs property set -ts "$factory" ro true
+      fail "could not reset Thunderbolt authorization in the factory baseline"
+    fi
+  fi
 
   if ! scrub_factory_accounts "$factory"; then
     btrfs property set -ts "$factory" ro true
@@ -368,6 +374,13 @@ stage_full_reset() {
   scrub_factory_accounts "$next" ||
     fail "could not remove account credentials from the factory system (see $LOG_FILE)"
 
+  # Leave the new owner's input available before interactive enrollment. Clear
+  # inherited accessory identities in both roots; never change the live daemon.
+  if [[ -d $next/var/lib/omarchy/thunderbolt-authorization || -f $next/etc/omarchy/thunderbolt-authorization.enabled || -f $next/etc/omarchy/thunderbolt-authorization.pending ]]; then
+    /usr/bin/omarchy-thunderbolt-authorization-admin reset-root "$next" ||
+      fail "could not reset Thunderbolt authorization in the staged root"
+  fi
+
   # @factory itself survives the wipe as the baseline for future resets. If it
   # came from a normal install it still holds the seller's account and
   # /etc/shadow, which the new wheel user could mount and read — and a second

bin/omarchy-thunderbolt-authorization-admin

@@ -0,0 +1,17 @@
+#!/bin/bash -p
+
+# omarchy:summary=Manage system Thunderbolt authorization settings
+# omarchy:hidden=true
+
+# This root entrypoint uses installed code and rejects unsafe Bash startup.
+if [[ $- != *p* ]]; then exit 126; fi
+source /usr/bin/omarchy-security-functions || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
+omarchy_security_sanitize_bash_environment "$0" "$@"
+set -euo pipefail
+(( EUID == 0 )) || exit 126
+export PATH=/usr/bin:/bin LC_ALL=C
+unset DBUS_SYSTEM_BUS_ADDRESS DBUS_SESSION_BUS_ADDRESS
+source /usr/share/omarchy/install/helpers/thunderbolt-policy.sh
+source /usr/share/omarchy/install/helpers/thunderbolt-setup.sh
+tb_admin "$@"

bin/omarchy-thunderbolt-authorization-approve

@@ -0,0 +1,25 @@
+#!/bin/bash -p
+
+# omarchy:summary=Approve one verified Thunderbolt connection
+# omarchy:hidden=true
+
+# pkexec permits this exact program for an active local wheel user. Suppress
+# startup injection before reading input; it cannot dispatch general root work.
+if [[ $- != *p* ]]; then exit 126; fi
+source /usr/bin/omarchy-security-functions || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
+omarchy_security_sanitize_bash_environment "$0" "$@"
+set -euo pipefail
+(( EUID == 0 )) || exit 126
+export PATH=/usr/bin:/bin LC_ALL=C
+unset DBUS_SYSTEM_BUS_ADDRESS DBUS_SESSION_BUS_ADDRESS
+source /usr/share/omarchy/install/helpers/thunderbolt-policy.sh
+
+[[ $# == 2 && ( $1 == "true" || $1 == "false" ) ]] || exit 64
+(( ${#2} <= 16384 )) || exit 64
+jq -e 'type == "object"' <<< "$2" >/dev/null
+exec 9> "$TB_LOCK"
+flock -x 9
+result=$(tb_approve "$2" "$1" true)
+tb_json_write "$TB_RUNTIME/snapshot.json" 644 <<< "$result"
+printf '%s\n' "$result"

bin/omarchy-thunderbolt-authorization-boot-enabled

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# omarchy:hidden=true
+# omarchy:summary=Check whether Thunderbolt firmware boot access is restricted
+
+set -euo pipefail
+source "$OMARCHY_PATH/install/helpers/thunderbolt-policy.sh"
+tb_public_snapshot | jq -e .boot_protection >/dev/null

bin/omarchy-thunderbolt-authorization-daemon

@@ -0,0 +1,16 @@
+#!/bin/bash -p
+
+# omarchy:summary=Restore trusted Thunderbolt devices and publish their status
+# omarchy:hidden=true
+
+# Keep root startup independent of a caller's environment or checkout.
+if [[ $- != *p* ]]; then exit 126; fi
+source /usr/bin/omarchy-security-functions || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
+omarchy_security_sanitize_bash_environment "$0" "$@"
+set -euo pipefail
+(( EUID == 0 )) || exit 126
+export PATH=/usr/bin:/bin LC_ALL=C
+unset DBUS_SYSTEM_BUS_ADDRESS DBUS_SESSION_BUS_ADDRESS
+source /usr/share/omarchy/install/helpers/thunderbolt-policy.sh
+tb_daemon

bin/omarchy-thunderbolt-authorization-review

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# omarchy:hidden=true
+# omarchy:summary=Handle Thunderbolt device approval review
+
+set -euo pipefail
+source "$OMARCHY_PATH/install/helpers/thunderbolt-policy.sh"
+source "$OMARCHY_PATH/install/helpers/thunderbolt-review.sh"
+[[ $# == 1 ]] || exit 64
+tb_review "$1"

bin/omarchy-thunderbolt-authorization-watch

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# omarchy:hidden=true
+# omarchy:summary=Handle Thunderbolt device approval watch
+
+set -euo pipefail
+source "$OMARCHY_PATH/install/helpers/thunderbolt-policy.sh"
+source "$OMARCHY_PATH/install/helpers/thunderbolt-review.sh"
+tb_watch