Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1961GitHub issuePublicDecided· Out of scope

Browser managed policy directories are world-writable

Reported by afurm · filed May 2, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Browser managed policy directories are world-writablerevision 1 · captured 2026-09-28 21:29 UTC via poll

System details

Omarchy dev branch at 3fabdf73; Chromium/Brave browser policy setup; hardware independent

What's wrong?

Omarchy creates Chromium and Brave managed policy directories under /etc, then makes them writable by every local user.

Affected files:

  • install/config/theme.sh
  • migrations/1757147211.sh

Current behavior:

sudo mkdir -p /etc/chromium/policies/managed
sudo chmod a+rw /etc/chromium/policies/managed

sudo mkdir -p /etc/brave/policies/managed
sudo chmod a+rw /etc/brave/policies/managed

These directories are privileged browser managed-policy inputs. Chromium's Linux policy docs say managed policy files/directories should not be writable by non-admin users.

Steps to recreate:

  1. Run the Omarchy install path or the existing migration that creates browser policy directories.
  2. Check permissions:
   ls -ld /etc/chromium/policies/managed /etc/brave/policies/managed
  1. Notice that non-root users can write files into those directories.

Expected behavior:

The managed policy directories should remain root/admin writable only, for example root-owned mode 755. Omarchy can still update color.json by writing it through sudo.

Actual behavior:

The directories are made writable by everyone so omarchy-theme-set-browser can write color.json without sudo.

Suggested fix:

  • Create /etc/chromium/policies/managed and /etc/brave/policies/managed with root ownership and mode 755.
  • Write color.json via sudo tee.
  • Set color.json to root-owned mode 644.
  • Add a migration to repair permissions on existing installs.

I have a patch prepared for this.

View raw text
### System details

Omarchy dev branch at 3fabdf73; Chromium/Brave browser policy setup; hardware independent

### What's wrong?

Omarchy creates Chromium and Brave managed policy directories under `/etc`, then makes them writable by every local user.

Affected files:

- `install/config/theme.sh`
- `migrations/1757147211.sh`

Current behavior:

```bash
sudo mkdir -p /etc/chromium/policies/managed
sudo chmod a+rw /etc/chromium/policies/managed

sudo mkdir -p /etc/brave/policies/managed
sudo chmod a+rw /etc/brave/policies/managed
```

These directories are privileged browser managed-policy inputs. Chromium's Linux policy docs say managed policy files/directories should not be writable by non-admin users.

Steps to recreate:

1. Run the Omarchy install path or the existing migration that creates browser policy directories.
2. Check permissions:

   ```bash
   ls -ld /etc/chromium/policies/managed /etc/brave/policies/managed
   ```

3. Notice that non-root users can write files into those directories.

Expected behavior:

The managed policy directories should remain root/admin writable only, for example root-owned mode `755`. Omarchy can still update `color.json` by writing it through `sudo`.

Actual behavior:

The directories are made writable by everyone so `omarchy-theme-set-browser` can write `color.json` without sudo.

Suggested fix:

- Create `/etc/chromium/policies/managed` and `/etc/brave/policies/managed` with root ownership and mode `755`.
- Write `color.json` via `sudo tee`.
- Set `color.json` to root-owned mode `644`.
- Add a migration to repair permissions on existing installs.

I have a patch prepared for this.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 02:52 UTC