Harden privileged cleanup review fixes

migrations/1787946619.sh

@@ -10,9 +10,17 @@ as_root() {
   fi
 }
 
+defer_privileged_repair() {
+  echo "Cannot remove the legacy privileged udev rule; omarchy-migrate will retry it later." >&2
+  if [[ -n ${OMARCHY_MIGRATION_DEFER_FILE:-} && -n ${OMARCHY_MIGRATION_DEFER_TOKEN:-} ]]; then
+    printf '%s\n' "$OMARCHY_MIGRATION_DEFER_TOKEN" >"$OMARCHY_MIGRATION_DEFER_FILE"
+  fi
+  exit 75
+}
+
 # Omarchy 3 generated these two rules with an unquoted heredoc, so the installing
-# user's $HOME was expanded and the file on disk names
-# /home/<user>/.local/share/omarchy/bin/<command>. udev runs RUN+= as root, and
+# user's $HOME was expanded and the file on disk names that absolute home path.
+# udev runs RUN+= as root, and
 # ~/.local/share/omarchy is a symlink that same unprivileged user owns: replacing
 # it with a tree of their own and provoking a power_supply event runs their code
 # as root. Quattro ships the rules as 99-omarchy-*.rules under /usr/bin, but the
@@ -32,7 +40,7 @@ as_root() {
 # path in a comment, and so does a legacy file already repointed at /usr/bin.
 rule_runs_from_home() {
   local file="$1" binary="$2"
-  local pattern="^(/home/[^/]+|/root)/\\.local/share/omarchy/bin/$binary\$"
+  local pattern="^/.+/\\.local/share/omarchy/bin/$binary\$"
   local line logical="" rest command word
   local -a words
 
@@ -68,7 +76,7 @@ rule_runs_from_home() {
       # argument. Compare whole words so no substring stands in for the path.
       read -ra words <<<"$command"
       for word in "${words[@]}"; do
-        if [[ $word =~ $pattern || $word == "$HOME/.local/share/omarchy/bin/$binary" ]]; then
+        if [[ $word =~ $pattern ]]; then
           return 0
         fi
       done
@@ -84,7 +92,9 @@ for legacy_rule in "99-power-profile.rules:omarchy-powerprofiles-set" "99-wifi-p
   rule_file="$rules_dir/${legacy_rule%%:*}"
 
   if [[ -f $rule_file ]] && rule_runs_from_home "$rule_file" "${legacy_rule##*:}"; then
-    as_root rm -f "$rule_file"
+    if ! as_root rm -f "$rule_file"; then
+      defer_privileged_repair
+    fi
     removed=1
   fi
 done

migrations/1788025225.sh

@@ -115,10 +115,10 @@ sudoers_hash_is_active() {
 # one line that is unmistakably this grant: its own self-cleanup. One
 # hand-written line anywhere in the file and it is not ours to delete.
 first_run_sudoers_is_generated() {
-  local spec_pattern='^[^[:space:]]+ ALL=\(ALL\) NOPASSWD: (.+)$'
+  local spec_pattern='^([^[:space:]]+) ALL=\(ALL\) NOPASSWD: (.+)$'
   local marker_pattern='^/bin/rm -f /home/[^/]+/\.local/state/omarchy/first-run\.mode$'
-  local line command
-  local seen_any=0 seen_marker=0
+  local line user command generated_user=""
+  local seen_any=0 seen_marker=0 seen_spec=0
 
   while IFS= read -r line; do
     seen_any=1
@@ -140,7 +140,13 @@ first_run_sudoers_is_generated() {
     if [[ ! $line =~ $spec_pattern ]]; then
       return 1
     fi
-    command=${BASH_REMATCH[1]}
+    user=${BASH_REMATCH[1]}
+    command=${BASH_REMATCH[2]}
+    if [[ -n $generated_user && $user != "$generated_user" ]]; then
+      return 1
+    fi
+    generated_user=$user
+    seen_spec=1
 
     case "$command" in
       "/usr/bin/systemctl" | "/usr/bin/ufw" | "/usr/bin/ufw-docker" | \
@@ -162,7 +168,7 @@ first_run_sudoers_is_generated() {
     return 1
   done < <(active_lines sudoers)
 
-  (( seen_any && seen_marker ))
+  (( seen_any && seen_marker && seen_spec ))
 }
 
 # bin/omarchy-install-tailscale (2025-08-22 to 2026-02-02) ran
@@ -202,7 +208,7 @@ tsui_sudoers_is_generated() {
 plymouth_unit_runs_from_home() {
   local binary="omarchy-plymouth-shutdown-sync"
   local exec_stop_pattern='^ExecStop[[:space:]]*=[[:space:]]*(.*)$'
-  local home_pattern="^(/home/[^/]+|/root)/\\.local/share/omarchy/bin/$binary\$"
+  local home_pattern="^/.+/\\.local/share/omarchy/bin/$binary\$"
   local line word
   local -a words
   local matched=1
@@ -229,7 +235,7 @@ plymouth_unit_runs_from_home() {
       word=${word:1}
     done
 
-    if [[ $word =~ $home_pattern || $word == "$HOME/.local/share/omarchy/bin/$binary" ]]; then
+    if [[ $word =~ $home_pattern ]]; then
       # Non-empty ExecStop= assignments append to the command list. Once a
       # vulnerable command is present it stays live until an empty assignment
       # explicitly resets the list; a later packaged command does not replace it.
@@ -249,6 +255,9 @@ tsui_sudoers="$sudoers_dir/tsui"
 
 defer_privileged_repair() {
   echo "Cannot complete the privileged installer-artifact repair; omarchy-migrate will retry it later." >&2
+  if [[ -n ${OMARCHY_MIGRATION_DEFER_FILE:-} && -n ${OMARCHY_MIGRATION_DEFER_TOKEN:-} ]]; then
+    printf '%s\n' "$OMARCHY_MIGRATION_DEFER_TOKEN" >"$OMARCHY_MIGRATION_DEFER_FILE"
+  fi
   exit 75
 }