Ryan Hughes
eb988b42e6
A free-form shell-string --exec sitting next to the safe --exec-arg is a standing invitation for the next caller to interpolate untrusted data and reintroduce the RCE. Remove it: omarchy-notification-send --exec now errors and points at --exec-arg, and the shell drops the omarchy-exec string hint and its bash -lc execution path, leaving only the argv path. Migrate the remaining string callers (the first-run invitation hooks, wifi and welcome prompts) to --exec-arg, and update their notification mocks. Trim the verbose security comments added along the way.
13 lines
542 B
Bash
13 lines
542 B
Bash
#!/bin/bash
|
|
|
|
set -e
|
|
|
|
# Only invite when there's a reader to use and it isn't set up yet (the lock
|
|
# PAM file is the last thing the setup writes on success).
|
|
if omarchy-hw-fingerprint && [[ ! -f /etc/pam.d/omarchy-lock-fingerprint ]] &&
|
|
omarchy-done ensure fingerprint-setup-invitation; then
|
|
omarchy-notification-send -u critical -g "Setup Fingerprint Reader" \
|
|
"Enable sudo and unlocking with your fingerprint." \
|
|
--exec-arg omarchy-launch-floating-terminal-with-presentation --exec-arg omarchy-setup-security-fingerprint
|
|
fi
|