ZacharyZhang-NY/omarchycn
4
5
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 5 Wiki Activity

Require root-owned Firefox policies before skipping repair

Browse Source 
The hardened gate only looked at the distribution directory. A regular
policies.json planted under the old 777 mode would then be left in place
if the directory later looked 755/root.
This commit is contained in:
acrogenesis
2026-08-25 12:04:02 -06:00
parent 95b791af16
commit b0e6611c70
2 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install/helpers/browser-policy.sh
+15 -1
View File
@@ -145,13 +145,27 @@ browser_policy_write_color() {
return 1
}
browser_policy_firefox_policy_file_ok() {
local file=$1
local mode
local group_write
local other_write
[[ -f $file && ! -L $file ]] || return 1
[[ $(stat -c '%U' "$file") == "root" ]] || return 1
mode=$(stat -c '%a' "$file")
group_write=$((8#${mode: -2:1}))
other_write=$((8#${mode: -1}))
(( (group_write & 2) == 0 && (other_write & 2) == 0 ))
}
browser_policy_firefox_hardened() {
local dir=$1
[[ -d $dir ]] || return 1
[[ $(stat -c '%a' "$dir") == "755" ]] || return 1
[[ $(stat -c '%U' "$dir") == "root" ]] || return 1
[[ -f $dir/policies.json && ! -L $dir/policies.json ]] || return 1
browser_policy_firefox_policy_file_ok "$dir/policies.json"
}
browser_policy_install_firefox_policies() {