Merge pull request #10425 from acrogenesis/security/root-owned-sleep-hooks

Harden ownership of installed sleep hooks

(cherry picked from commit c82a0837b0)
(cherry picked from commit 3b5f4446f6022ad056fc06d320d157075841cde7)

test/shell.d/unowned-system-paths-test.sh

@@ -132,3 +132,47 @@ if problems:
 PYTHON
 
 pass "no Omarchy script writes a path under /usr that no package owns"
+
+for script in bin/omarchy-hibernation-setup bin/omarchy-toggle-hybrid-gpu; do
+  grep -F '"${destination%/*}/.${destination##*/}.omarchy.XXXXXX"' "$ROOT/$script" >/dev/null ||
+    fail "$script reserves a hidden sibling for the privileged replacement"
+  grep -F 'sudo /usr/bin/install -m "$mode" -o root -g root -T "$source" "$stage"' "$ROOT/$script" >/dev/null ||
+    fail "$script prepares privileged files with final root ownership and mode"
+  grep -F 'sudo /usr/bin/mv -Tf -- "$stage" "$destination"' "$ROOT/$script" >/dev/null ||
+    fail "$script atomically replaces the privileged destination"
+  if grep -F 'sudo /usr/bin/chmod "$mode" "$destination"' "$ROOT/$script" >/dev/null; then
+    fail "$script changes mode after publishing the privileged destination"
+  fi
+done
+
+grep -F '  /usr/lib/systemd/system-sleep/keyboard-backlight 0755' "$ROOT/bin/omarchy-hibernation-setup" >/dev/null ||
+  fail "hibernation setup installs keyboard-backlight as a root-owned executable"
+
+hook_install_line=$(rg -n '^if ! install_root_file .*keyboard-backlight' "$ROOT/bin/omarchy-hibernation-setup" | cut -d: -f1)
+resume_marker_line=$(rg -n '^echo "HOOKS\+=\(resume\)"' "$ROOT/bin/omarchy-hibernation-setup" | cut -d: -f1)
+[[ -n $hook_install_line && -n $resume_marker_line ]] ||
+  fail "hibernation setup keeps recognizable hook-install and resume-marker steps"
+(( hook_install_line < resume_marker_line )) ||
+  fail "hibernation setup marks completion before a failed hook install can be retried"
+
+grep -F '  /usr/lib/systemd/system-sleep/force-igpu 0755' "$ROOT/bin/omarchy-toggle-hybrid-gpu" >/dev/null ||
+  fail "hybrid GPU setup installs force-igpu as a root-owned executable"
+grep -F '  /etc/systemd/system/supergfxd.service.d/delay-start.conf 0644' "$ROOT/bin/omarchy-toggle-hybrid-gpu" >/dev/null ||
+  fail "hybrid GPU setup installs its root service drop-in as root-owned configuration"
+
+delay_install_line=$(rg -n '^    if ! install_root_file .*delay-start\.conf' "$ROOT/bin/omarchy-toggle-hybrid-gpu" | cut -d: -f1)
+force_install_line=$(rg -n '^    if ! install_root_file .*force-igpu' "$ROOT/bin/omarchy-toggle-hybrid-gpu" | cut -d: -f1)
+config_switch_line=$(rg -n '^    sudo sed -i \\' "$ROOT/bin/omarchy-toggle-hybrid-gpu" | tail -1 | cut -d: -f1)
+[[ -n $delay_install_line && -n $force_install_line && -n $config_switch_line ]] ||
+  fail "hybrid GPU setup keeps recognizable support-file and config-switch steps"
+(( delay_install_line < config_switch_line && force_install_line < config_switch_line )) ||
+  fail "hybrid GPU setup switches config before every required file is installed"
+
+grep -Fq '/usr/bin/grep -Eq' "$ROOT/default/systemd/system-sleep/force-igpu" ||
+  fail "force-igpu does not guard execution with the configured GPU mode"
+
+if rg -n 'cp -p.*(system-sleep|supergfxd\.service\.d)' "$ROOT/bin/omarchy-hibernation-setup" "$ROOT/bin/omarchy-toggle-hybrid-gpu"; then
+  fail "privileged sleep and hybrid GPU files are never copied with source ownership"
+fi
+
+pass "system-sleep hooks and the hybrid GPU drop-in enforce root ownership"