Require root-owned Firefox policies before skipping repair

The hardened gate only looked at the distribution directory. A regular
policies.json planted under the old 777 mode would then be left in place
if the directory later looked 755/root.

install/helpers/browser-policy.sh

@@ -145,13 +145,27 @@ browser_policy_write_color() {
   return 1
 }
 
+browser_policy_firefox_policy_file_ok() {
+  local file=$1
+  local mode
+  local group_write
+  local other_write
+
+  [[ -f $file && ! -L $file ]] || return 1
+  [[ $(stat -c '%U' "$file") == "root" ]] || return 1
+  mode=$(stat -c '%a' "$file")
+  group_write=$((8#${mode: -2:1}))
+  other_write=$((8#${mode: -1}))
+  (( (group_write & 2) == 0 && (other_write & 2) == 0 ))
+}
+
 browser_policy_firefox_hardened() {
   local dir=$1
 
   [[ -d $dir ]] || return 1
   [[ $(stat -c '%a' "$dir") == "755" ]] || return 1
   [[ $(stat -c '%U' "$dir") == "root" ]] || return 1
-  [[ -f $dir/policies.json && ! -L $dir/policies.json ]] || return 1
+  browser_policy_firefox_policy_file_ok "$dir/policies.json"
 }
 
 browser_policy_install_firefox_policies() {

test/shell.d/browser-policy-dir-test.sh

@@ -168,6 +168,18 @@ fi
 BROWSER_POLICY_GROUP=omarchy-browser-policy
 pass "a hardened directory must be root-owned"
 
+fx_policy=$test_tmp/policies.json
+printf '%s\n' '{"policies":{}}' >"$fx_policy"
+chmod 644 "$fx_policy"
+if browser_policy_firefox_policy_file_ok "$fx_policy"; then
+  fail "a user-owned policies.json is not treated as hardened"
+fi
+ln -sf "$fx_policy" "$test_tmp/policies-link.json"
+if browser_policy_firefox_policy_file_ok "$test_tmp/policies-link.json"; then
+  fail "a policies.json symlink is not treated as hardened"
+fi
+pass "Firefox policy files must be root-owned regular files without group or other write"
+
 dist=$test_tmp/distribution
 mkdir -p "$dist"
 printf 'original\n' >"$test_tmp/firefox-pwn"