acrogenesis
95b791af16
Chromium managed policy is mandatory for every profile. World-writable dirs let any local uid plant policy, including force-installed extensions. Write goes through the omarchy-browser-policy group at 2775 so theme colour still works without other-write.
25 lines
637 B
Bash
25 lines
637 B
Bash
echo "Stop world-writable Chromium and Firefox policy directories"
|
|
|
|
source "$OMARCHY_PATH/install/helpers/browser-policy.sh"
|
|
|
|
browser_policy_setup_group
|
|
browser_policy_grant_user "${USER:-$(id -un)}"
|
|
|
|
repaired=0
|
|
for dir in "${BROWSER_POLICY_MANAGED_DIRS[@]}"; do
|
|
[[ -d $dir ]] || continue
|
|
browser_policy_dir_hardened "$dir" && continue
|
|
browser_policy_setup_dir "$dir"
|
|
repaired=1
|
|
done
|
|
|
|
if (( repaired )); then
|
|
omarchy-theme-set-browser
|
|
fi
|
|
|
|
for dir in "${BROWSER_POLICY_FIREFOX_DIRS[@]}"; do
|
|
[[ -d $dir ]] || continue
|
|
browser_policy_firefox_hardened "$dir" && continue
|
|
browser_policy_setup_firefox_distribution "$dir"
|
|
done
|