Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
omarchy-drive-password: "No encrypted drives available" due to unprivileged blkid call
Reported by LoupiBe · filed Aug 31, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details
Intel i7-8665U, Intel UHD Graphics 620, Omarchy 4.0.2-1 (Linux 7.1.9-arch1-2, Hyprland 0.56.2)
What's wrong?
Description
When attempting to change the drive encryption password via the desktop menu (Drive Encryption) or by running omarchy drive password as an unprivileged user, the script immediately exits with:
> No encrypted drives available.
even on systems installed on a LUKS2 encrypted partition.
Root Cause
In /usr/share/omarchy/bin/omarchy-drive-password (line 6):
encrypted_drives=$(blkid -t TYPE=crypto_LUKS -o device)When omarchy-drive-password is executed without root privileges (such as via omarchy-launch-floating-terminal-with-presentation omarchy-drive-password), blkid fails to probe raw block device headers, exiting with status code 2 and returning an empty string. Consequently, the script incorrectly assumes no encrypted drives exist.
Steps to Reproduce
- Install Omarchy on an encrypted LUKS partition (or have any LUKS encrypted partition).
- Open the Omarchy menu and select Drive Encryption (or run
omarchy drive passwordas standard user). - Observe output:
No encrypted drives available.
Expected Behavior
The command should detect existing crypto_LUKS partitions and proceed to prompt for password selection/change without unprivileged blkid failure.
Suggested Fix
Use lsblk instead of blkid to query encrypted partitions without requiring root permissions:
encrypted_drives=$(lsblk -lnpo NAME,FSTYPE | awk '$2 == "crypto_LUKS" {print $1}')View raw text
### System details
Intel i7-8665U, Intel UHD Graphics 620, Omarchy 4.0.2-1 (Linux 7.1.9-arch1-2, Hyprland 0.56.2)
### What's wrong?
#### Description
When attempting to change the drive encryption password via the desktop menu (**Drive Encryption**) or by running `omarchy drive password` as an unprivileged user, the script immediately exits with:
> `No encrypted drives available.`
even on systems installed on a LUKS2 encrypted partition.
#### Root Cause
In `/usr/share/omarchy/bin/omarchy-drive-password` (line 6):
```bash
encrypted_drives=$(blkid -t TYPE=crypto_LUKS -o device)
```
When `omarchy-drive-password` is executed without root privileges (such as via `omarchy-launch-floating-terminal-with-presentation omarchy-drive-password`), `blkid` fails to probe raw block device headers, exiting with status code 2 and returning an empty string. Consequently, the script incorrectly assumes no encrypted drives exist.
#### Steps to Reproduce
1. Install Omarchy on an encrypted LUKS partition (or have any LUKS encrypted partition).
2. Open the Omarchy menu and select **Drive Encryption** (or run `omarchy drive password` as standard user).
3. Observe output: `No encrypted drives available.`
#### Expected Behavior
The command should detect existing `crypto_LUKS` partitions and proceed to prompt for password selection/change without unprivileged `blkid` failure.
#### Suggested Fix
Use `lsblk` instead of `blkid` to query encrypted partitions without requiring root permissions:
```bash
encrypted_drives=$(lsblk -lnpo NAME,FSTYPE | awk '$2 == "crypto_LUKS" {print $1}')
```Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 10:18 UTC