Stop world-writable browser policy directories

Chromium managed policy is mandatory for every profile. World-writable dirs let any local uid plant policy, including force-installed extensions. Write goes through the omarchy-browser-policy group at 2775 so theme colour still works without other-write.
2026-08-25 12:04:02 -06:00
parent 9301092404
commit 95b791af16
14 changed files with 596 additions and 38 deletions
@@ -0,0 +1,3 @@
+source "$OMARCHY_PATH/install/helpers/browser-policy.sh"
+browser_policy_setup_group
+browser_policy_setup_dir /etc/chromium/policies/managed