Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Consider setting kernel.kptr_restrict=1 by default
Reported by drneb99 · filed Aug 30, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Title: Consider setting kernel.kptr_restrict=1 by default
Body:
Omarchy currently ships with the Arch default of kernel.kptr_restrict=0, which exposes kernel pointer addresses in /proc (e.g. /proc/kallsyms) to unprivileged users. This is a minor but well-known local information-leak vector that makes kernel-address-space-layout-randomization (KASLR) bypass easier for local exploits.
Since Omarchy already ships several other hardening defaults out of the box (e.g. kernel.yama.ptrace_scope=1, kernel.dmesg_restrict=1), it seems like a natural fit to also set:
kernel.kptr_restrict = 1via a sysctl drop-in (e.g. /etc/sysctl.d/), consistent with how the other values above are presumably set.
This is a low-risk, no-functionality-impact change — kptr_restrict=1 only hides pointers from non-root users while leaving them visible to root, and doesn't affect any normal desktop workflow.
System info: Omarchy 4.0.1 (BUILD_ID 4.0.1)
View raw text
Title: Consider setting kernel.kptr_restrict=1 by default Body: Omarchy currently ships with the Arch default of `kernel.kptr_restrict=0`, which exposes kernel pointer addresses in `/proc` (e.g. `/proc/kallsyms`) to unprivileged users. This is a minor but well-known local information-leak vector that makes kernel-address-space-layout-randomization (KASLR) bypass easier for local exploits. Since Omarchy already ships several other hardening defaults out of the box (e.g. `kernel.yama.ptrace_scope=1`, `kernel.dmesg_restrict=1`), it seems like a natural fit to also set: ``` kernel.kptr_restrict = 1 ``` via a sysctl drop-in (e.g. `/etc/sysctl.d/`), consistent with how the other values above are presumably set. This is a low-risk, no-functionality-impact change — `kptr_restrict=1` only hides pointers from non-root users while leaving them visible to root, and doesn't affect any normal desktop workflow. System info: Omarchy 4.0.1 (BUILD_ID 4.0.1)
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 10:08 UTC