ZacharyZhang-NY/omarchycn
3
4
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 5 Wiki Activity

Harden browser policy parent directories and validate theme RGB

Browse Source 
install -d follows a planted ancestor symlink, and a writable parent can rename the managed leaf aside. chromium.theme is user-installed, so only a 0-255 RGB triple becomes a colour.
This commit is contained in:
acrogenesis
2026-08-25 12:10:08 -06:00
parent 87dfa14c56
commit bebe19bc70
5 changed files with 161 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/shell.d/default-apps-test.sh
+4
View File
@@ -210,6 +210,10 @@ cmp -s "$ROOT/config/chromium-flags.conf" "$test_home/.config/chromium-flags.con
fail "Chromium browser installer copies the default flags"
grep -Fxq 'sudo:groupadd --system --force omarchy-browser-policy' "$setup_log" ||
fail "Chromium browser installer creates the browser-policy group"
grep -Fxq 'sudo:install -d -m 0755 -o root -g root /etc/chromium' "$setup_log" ||
fail "Chromium browser installer creates a root-owned Chromium policy parent"
grep -Fxq 'sudo:install -d -m 0755 -o root -g root /etc/chromium/policies' "$setup_log" ||
fail "Chromium browser installer creates a root-owned Chromium policies parent"
grep -Fxq 'sudo:install -d -m 2775 -o root -g omarchy-browser-policy /etc/chromium/policies/managed' "$setup_log" ||
fail "Chromium browser installer creates a group-writable managed policy directory"
grep -Fxq 'sudo:find /etc/chromium/policies/managed -mindepth 1 -maxdepth 1 ! -user root -exec rm -rf -- {} +' "$setup_log" ||