3 Commits

Include renames

Author	SHA1	Message	Date
acrogenesis	87dfa14c56	Keep a trusted Firefox policies.json when repairing the directory ... A world-writable distribution dir failed the hardened check even when policies.json was already root-owned, and setup then overwrote it.	2026-08-25 12:04:03 -06:00
acrogenesis	b0e6611c70	Require root-owned Firefox policies before skipping repair ... The hardened gate only looked at the distribution directory. A regular policies.json planted under the old 777 mode would then be left in place if the directory later looked 755/root.	2026-08-25 12:04:02 -06:00
acrogenesis	95b791af16	Stop world-writable browser policy directories ... Chromium managed policy is mandatory for every profile. World-writable dirs let any local uid plant policy, including force-installed extensions. Write goes through the omarchy-browser-policy group at 2775 so theme colour still works without other-write.	2026-08-25 12:04:02 -06:00