Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
/usr/bin/btop installed with CAP_DAC_READ_SEARCH (bypasses file read permissions)
Reported by helioryn · filed Aug 25, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details
Intel Core i3-10110U @ 2.10GHz - Omarchy - 4.0.1
What's wrong?
/usr/bin/btop, a monitoring/process viewer, is installed with the Linux file
capability cap_dac_read_search (plus cap_perfmon). CAP_DAC_READ_SEARCH lets the
process read any file regardless of its file permissions (bypasses the DAC read
check). On a machine where /etc/shadow is otherwise correctly restricted to root
only (mode 600), btop can read it and expose password hashes for offline cracking.
Observed
$ getcap /usr/bin/btop
/usr/bin/btop cap_dac_read_search,cap_perfmon=ep
$ ls -l /usr/bin/btop
-rwxr-xr-x 1 root root 1630104 <date> /usr/bin/btop
$ ls -l /etc/shadow
-rw------- 1 root root 850 <date> /etc/shadow
Impact
An unprivileged user can run btop (it is world-executable, root-owned) and use the
capability to read files it should not be able to read, including /etc/shadow. This
is a confidentiality breach and a stepping stone to account compromise via password
cracking. cap_perfmon additionally exposes kernel performance counters.
Expected behaviour
A process viewer does not need CAP_DAC_READ_SEARCH to show CPU/memory metrics.
The capability is broader than required and should not be granted on a default
install.
Steps to reproduce
1. Note /etc/shadow is mode 600 root:root and unreadable by a normal user.
2. Confirm the btop binary carries cap_dac_read_search.
3. Running btop as the unprivileged user exposes reads that bypass the permission.
Environment
OS: Omarchy 4.0.1 (id=omarchy, id_like=arch)
Kernel: linux 7.1.9.arch1-2
Arch: x86_64
Host: HP ProBook 450 G7
Suggested fix
- Remove the capability: sudo setcap -r /usr/bin/btop
- If any privileged behavior is genuinely needed, scope it via systemd
CapabilityBoundingSet and run the tool under a dedicated unprivileged user
rather than a file capability on a world-executable binary.
View raw text
### System details Intel Core i3-10110U @ 2.10GHz - Omarchy - 4.0.1 ### What's wrong? /usr/bin/btop, a monitoring/process viewer, is installed with the Linux file capability cap_dac_read_search (plus cap_perfmon). CAP_DAC_READ_SEARCH lets the process read any file regardless of its file permissions (bypasses the DAC read check). On a machine where /etc/shadow is otherwise correctly restricted to root only (mode 600), btop can read it and expose password hashes for offline cracking. Observed $ getcap /usr/bin/btop /usr/bin/btop cap_dac_read_search,cap_perfmon=ep $ ls -l /usr/bin/btop -rwxr-xr-x 1 root root 1630104 <date> /usr/bin/btop $ ls -l /etc/shadow -rw------- 1 root root 850 <date> /etc/shadow Impact An unprivileged user can run btop (it is world-executable, root-owned) and use the capability to read files it should not be able to read, including /etc/shadow. This is a confidentiality breach and a stepping stone to account compromise via password cracking. cap_perfmon additionally exposes kernel performance counters. Expected behaviour A process viewer does not need CAP_DAC_READ_SEARCH to show CPU/memory metrics. The capability is broader than required and should not be granted on a default install. Steps to reproduce 1. Note /etc/shadow is mode 600 root:root and unreadable by a normal user. 2. Confirm the btop binary carries cap_dac_read_search. 3. Running btop as the unprivileged user exposes reads that bypass the permission. Environment OS: Omarchy 4.0.1 (id=omarchy, id_like=arch) Kernel: linux 7.1.9.arch1-2 Arch: x86_64 Host: HP ProBook 450 G7 Suggested fix - Remove the capability: sudo setcap -r /usr/bin/btop - If any privileged behavior is genuinely needed, scope it via systemd CapabilityBoundingSet and run the tool under a dedicated unprivileged user rather than a file capability on a world-executable binary.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 09:07 UTC