From dff33f16e3fc2e9b7641c42fdce645f9b573730f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?= Date: Tue, 6 Oct 2026 02:23:31 -0400 Subject: [PATCH] Keep the host's region out of the sudo boundary sandboxes --- test/shell.d/channel-sudo-boundary-test.sh | 1 - test/shell.d/fixtures/sudo-boundary-test.sh | 3 +++ test/shell.d/update-hook-security-test.sh | 1 - 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/test/shell.d/channel-sudo-boundary-test.sh b/test/shell.d/channel-sudo-boundary-test.sh index 29554e4b..f98934c2 100755 --- a/test/shell.d/channel-sudo-boundary-test.sh +++ b/test/shell.d/channel-sudo-boundary-test.sh @@ -6,7 +6,6 @@ source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh" source "$SHELL_TEST_DIR/fixtures/sudo-boundary-test.sh" copy_boundary_file bin/omarchy-channel-set copy_boundary_file bin/omarchy-refresh-pacman -copy_boundary_file bin/omarchy-region copy_boundary_file bin/omarchy-update export OMARCHY_UPDATE_LOGGED=1 diff --git a/test/shell.d/fixtures/sudo-boundary-test.sh b/test/shell.d/fixtures/sudo-boundary-test.sh index 1fb123d0..c6c05d9d 100644 --- a/test/shell.d/fixtures/sudo-boundary-test.sh +++ b/test/shell.d/fixtures/sudo-boundary-test.sh @@ -32,6 +32,9 @@ PY copy_boundary_file bin/omarchy-security-functions copy_boundary_file bin/omarchy-update-pacman copy_boundary_file default/omarchy/sudo-no-update/sudo +# The host's own region must not leak into the sandbox. +printf '#!/bin/bash\necho Global\n' >"$SUDO_TEST_ROOT/bin/omarchy-region" +chmod +x "$SUDO_TEST_ROOT/bin/omarchy-region" cat >"$SUDO_TEST_ROOT/mock/sudo" <<'STUB' #!/bin/bash diff --git a/test/shell.d/update-hook-security-test.sh b/test/shell.d/update-hook-security-test.sh index 3233c925..af7ec70a 100755 --- a/test/shell.d/update-hook-security-test.sh +++ b/test/shell.d/update-hook-security-test.sh @@ -6,7 +6,6 @@ source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh" source "$SHELL_TEST_DIR/fixtures/sudo-boundary-test.sh" copy_boundary_file bin/omarchy-update copy_boundary_file bin/omarchy-refresh-pacman -copy_boundary_file bin/omarchy-region # Replace the step symlink, preserving the real fixture dispatcher. rm "$SUDO_TEST_ROOT/bin/omarchy-update-aur-pkgs" copy_boundary_file bin/omarchy-update-aur-pkgs