ZacharyZhang-NY/omarchycn
4
5
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 5 Wiki Activity

Keep a trusted Firefox policies.json when repairing the directory

Browse Source 
A world-writable distribution dir failed the hardened check even when
policies.json was already root-owned, and setup then overwrote it.
This commit is contained in:
acrogenesis
2026-08-25 12:04:03 -06:00
parent b0e6611c70
commit 87dfa14c56
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
migrations/1787515927.sh
+5 -1
View File
@@ -20,5 +20,9 @@ fi
for dir in "${BROWSER_POLICY_FIREFOX_DIRS[@]}"; do for dir in "${BROWSER_POLICY_FIREFOX_DIRS[@]}"; do
[[ -d $dir ]] || continue [[ -d $dir ]] || continue
browser_policy_firefox_hardened "$dir" && continue browser_policy_firefox_hardened "$dir" && continue
browser_policy_setup_firefox_distribution "$dir" as_root install -d -m 0755 -o root -g root "$dir"
browser_policy_purge_dir "$dir"
if ! browser_policy_firefox_policy_file_ok "$dir/policies.json"; then
browser_policy_install_firefox_policies "$dir"
fi
done done
test/shell.d/browser-policy-dir-test.sh
+2
View File
@@ -251,6 +251,8 @@ grep -F 'browser_policy_grant_user' "${migrations[0]}" >/dev/null ||
fail "the policy-directory migration still grants the current user the group" fail "the policy-directory migration still grants the current user the group"
grep -F 'BROWSER_POLICY_FIREFOX_DIRS' "${migrations[0]}" >/dev/null || grep -F 'BROWSER_POLICY_FIREFOX_DIRS' "${migrations[0]}" >/dev/null ||
fail "the policy-directory migration covers Firefox and Zen" fail "the policy-directory migration covers Firefox and Zen"
grep -F 'browser_policy_firefox_policy_file_ok' "${migrations[0]}" >/dev/null ||
fail "the policy-directory migration keeps a trusted Firefox policies.json"
grep -F '/opt/zen-browser/distribution' "$ROOT/install/helpers/browser-policy.sh" >/dev/null || grep -F '/opt/zen-browser/distribution' "$ROOT/install/helpers/browser-policy.sh" >/dev/null ||
fail "the shared helper names the Zen distribution directory" fail "the shared helper names the Zen distribution directory"
pass "a migration locks existing policy directories" pass "a migration locks existing policy directories"