Mehmet INCE and Claude Opus 5
c6d676f23c
Pin trusted PATH in privileged DNS helper (backport of #8172 )
...
Backport of the DNS PATH pin (PR #8172 by @mdisec, merged to quattro as
4637735a ) onto the v4-0-1 release branch.
omarchy dev link prepends a user-writable checkout's bin/ to sudo's secure_path
so privileged Omarchy commands resolve to the development versions, and that
reaches the subprocesses they launch too. This branch carries the same
passwordless grant -- etc/sudoers.d/omarchy-dns lets wheel run
/usr/bin/omarchy-dns Cloudflare, Google and DHCP without a password -- so the
packaged script ran as root while resolving bare helpers (dirname, install,
tee, rm, nmcli, systemctl, awk) through the caller's secure_path. Write access
to a dev checkout became arbitrary root execution, with no password prompt in
the way.
Pin PATH to trusted system directories once EUID is 0. The restriction lands
only after elevation, so the unprivileged wrapper phase keeps the caller's PATH
and can still find sudo or pkexec; every helper the privileged half uses is a
system utility, so it needs nothing from the checkout.
Clean cherry-pick: both files are byte-identical to quattro, so merging v4-0-1
into quattro resolves without a conflict. Verified by mutation: with the pin
removed, test/shell.d/dns-sudoers-test.sh fails at the poisoned-helper case;
restored, all four of its cases pass. test/shell (189 files) and test/cli pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
2026-08-25 09:44:35 +02:00
..
2026-08-11 11:07:14 +02:00
2026-08-10 14:10:31 +02:00
2026-08-23 19:56:59 -04:00
2026-08-13 12:13:41 +02:00
2026-08-09 13:27:38 +02:00
2026-08-13 13:47:44 +02:00
2026-08-07 23:49:43 +02:00
2026-08-07 15:46:10 +02:00
2026-08-07 15:46:10 +02:00
2026-08-12 18:46:17 +02:00
2026-08-07 15:46:10 +02:00
2026-08-13 19:30:56 +02:00
2026-05-25 14:47:08 +02:00
2026-06-22 19:57:05 +02:00
2026-08-12 16:49:15 +02:00
2026-08-23 19:11:58 +02:00
2026-07-08 11:49:56 -07:00
2026-08-12 16:49:15 +02:00
2026-08-12 16:49:15 +02:00
2026-07-20 16:37:33 -07:00
2026-05-25 14:18:39 +02:00
2026-06-24 13:31:17 +02:00
2026-08-23 19:56:59 -04:00
2026-08-10 20:27:40 +02:00
2026-08-13 10:35:22 +02:00
2026-07-28 21:28:31 -07:00
2026-08-10 22:49:44 +02:00
2026-08-01 15:35:34 -05:00
2026-08-07 23:58:51 +02:00
2026-08-12 16:49:15 +02:00
2026-07-23 17:05:29 -07:00
2026-08-13 22:37:29 +02:00
2026-08-13 22:37:29 +02:00
2026-08-23 19:56:59 -04:00
2026-08-23 19:11:58 +02:00
2026-08-03 16:29:14 -05:00
2026-08-12 16:58:46 +02:00
2026-08-12 18:37:40 +02:00
2026-08-14 08:59:14 +02:00
2026-08-13 21:26:08 +02:00
2026-08-23 19:11:58 +02:00
2026-08-04 12:16:54 -05:00
2026-08-08 14:58:29 +02:00
2026-08-11 11:04:50 -04:00
2026-08-11 11:04:50 -04:00
2026-08-25 09:44:35 +02:00
2026-08-25 09:02:57 +02:00
2026-07-16 21:53:15 -07:00
2026-07-18 18:21:39 -07:00
2026-05-27 10:41:12 +02:00
2026-07-11 11:42:55 -07:00
2026-05-29 15:25:21 +02:00
2026-08-23 19:56:59 -04:00
2026-06-04 18:38:25 -04:00
2026-08-09 21:54:21 +02:00
2026-07-19 17:36:34 -07:00
2026-08-25 09:13:35 +02:00
2026-08-09 13:57:36 +02:00
2026-08-07 23:59:50 +02:00
2026-08-13 12:25:25 +02:00
2026-08-12 14:01:58 +02:00
2026-08-13 12:37:43 +02:00
2026-08-11 18:34:07 +02:00
2026-08-13 12:22:58 +02:00
2026-08-11 13:20:23 +02:00
2026-08-11 13:03:20 +02:00
2026-08-13 20:28:43 +02:00
2026-07-29 14:49:55 -04:00
2026-08-11 13:26:24 +02:00
2026-08-11 11:29:35 +02:00
2026-07-16 21:19:28 -07:00
2026-05-29 15:59:13 +02:00
2026-07-23 21:03:43 -07:00
2026-07-21 15:25:49 -07:00
2026-06-22 17:32:56 +02:00
2026-08-12 16:49:15 +02:00
2026-06-23 16:22:27 +02:00
2026-08-12 16:57:57 +02:00
2026-07-22 16:10:45 -07:00
2026-07-29 17:15:27 -04:00
2026-08-12 16:42:37 +02:00
2026-06-28 20:46:23 -04:00
2026-07-25 12:35:17 -07:00
2026-08-11 23:35:40 -07:00
2026-08-10 05:58:56 -07:00
2026-07-26 19:19:33 -07:00
2026-08-13 21:04:47 +02:00
2026-08-12 16:49:15 +02:00
2026-08-12 16:49:15 +02:00
2026-08-11 11:29:35 +02:00
2026-06-04 18:38:25 -04:00
2026-08-12 16:49:15 +02:00
2026-06-25 06:55:11 -04:00
2026-08-23 19:11:58 +02:00
2026-08-13 09:58:15 +02:00
2026-08-23 19:11:58 +02:00
2026-08-23 19:11:58 +02:00
2026-08-23 19:56:59 -04:00
2026-06-12 13:49:46 -04:00
2026-07-20 11:07:44 -07:00
2026-08-23 19:11:58 +02:00
2026-08-11 13:26:24 +02:00
2026-08-11 18:25:44 +02:00
2026-08-05 08:30:12 -05:00
2026-08-11 14:16:32 -07:00
2026-07-23 20:37:25 -07:00
2026-06-21 12:31:06 +02:00
2026-07-31 17:18:42 -04:00
2026-08-07 12:50:04 +02:00
2026-08-23 19:11:58 +02:00
2026-07-21 15:26:20 -07:00
2026-08-23 19:56:59 -04:00
2026-08-23 19:56:59 -04:00
2026-07-18 21:49:47 -07:00
2026-08-13 10:48:18 +02:00
2026-08-13 10:48:18 +02:00
2026-07-24 16:48:14 -07:00
2026-06-24 13:40:16 +02:00
2026-07-18 12:31:03 -07:00
2026-08-25 09:13:35 +02:00
2026-08-01 13:13:39 -05:00
2026-07-29 22:39:55 -04:00
2026-08-12 16:49:15 +02:00
2026-07-29 18:11:32 -04:00
2026-07-29 21:34:47 -04:00
2026-08-23 19:12:29 +02:00
2026-08-12 16:49:15 +02:00
2026-07-23 13:51:07 -07:00
2026-06-29 10:49:43 -05:00
2026-08-01 15:36:34 -05:00
2026-07-19 09:33:23 -07:00
2026-08-14 12:24:47 +02:00
2026-08-24 19:54:01 +02:00
2026-06-22 18:30:16 +02:00
2026-05-25 14:18:39 +02:00
2026-08-11 11:29:35 +02:00
2026-07-23 15:04:22 -07:00
2026-08-12 16:49:15 +02:00
2026-08-13 12:23:48 +02:00
2026-08-12 16:49:15 +02:00
2026-08-10 03:21:08 -07:00
2026-07-27 15:32:56 -07:00
2026-07-19 17:36:34 -07:00
2026-08-01 15:38:55 -05:00
2026-08-10 03:31:17 -07:00
2026-07-29 23:21:45 -04:00
2026-08-10 14:14:57 -07:00
2026-07-26 19:19:33 -07:00
2026-08-07 18:44:37 +02:00
2026-08-09 19:15:21 +02:00
2026-08-25 09:02:57 +02:00
2026-08-24 19:54:01 +02:00
2026-08-25 09:02:57 +02:00
2026-08-24 15:37:29 +02:00
2026-08-13 11:46:45 +02:00
2026-07-22 17:31:14 -07:00
2026-08-01 15:38:55 -05:00
2026-08-07 23:43:49 +02:00
2026-08-25 09:39:50 +02:00
2026-08-01 15:44:07 -05:00
2026-05-29 14:28:03 +02:00
2026-08-25 09:13:35 +02:00
2026-08-23 19:12:29 +02:00
2026-08-11 12:31:52 +02:00
2026-08-03 16:52:02 -05:00
2026-08-09 04:29:26 -07:00
2026-08-12 16:49:15 +02:00
2026-08-14 08:23:45 +02:00
2026-07-27 15:50:28 -07:00
2026-07-23 15:28:32 -07:00
2026-07-23 15:28:32 -07:00
2026-08-12 11:56:02 +02:00
2026-07-27 15:50:28 -07:00
2026-08-12 11:56:02 +02:00
2026-06-04 18:38:25 -04:00
2026-08-14 00:15:07 -07:00
2026-06-04 18:38:25 -04:00
2026-08-12 11:56:02 +02:00
2026-08-14 09:08:34 +02:00
2026-07-29 20:04:49 -07:00
2026-08-11 22:47:39 +02:00
2026-07-17 07:59:20 -07:00
2026-07-29 09:15:53 -07:00
2026-08-23 19:56:59 -04:00
2026-08-13 19:33:22 +02:00
2026-08-05 17:43:14 +02:00
2026-08-01 12:53:30 -07:00
2026-08-07 12:50:04 +02:00
2026-08-24 19:54:01 +02:00
2026-07-29 19:26:26 -07:00
2026-07-26 14:37:22 -07:00