Proof Portal

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox

ReportR-2855GitHub issuePublicReceived

The sudo tries config does not seem to work - some suggestions for improvements

Reported by cyppe · filed Sep 12, 2025Closed upstream on 2026-02-01 by dhh. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.

Open at source

Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?: Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?: Not yet mapped to any requirement or component.
3 · Is it reproducible?: No validation has been run yet.
4 · What remains unclear?: Not validated yet: no claims, no reproducer.
5 · What happens next?: Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

The sudo tries config does not seem to work - some suggestions for improvementsrevision 1 · captured 2026-10-04 11:35 UTC via poll

What do you need?

Issue

The current faillock configuration scripts use deprecated inline parameters in PAM files, which is no longer the recommended approach according to Arch documentation.

And yes - this is mostly Claude generated, so need experts advice on this. But seems to work for me. I noticed I easily got locked out due to also having fat fingers. So did some AI investigation and this is the result that seems to work so far.

Current scripts:
- increase-lockout-limit.sh: Uses sed to modify /etc/pam.d/system-auth with inline deny=10 unlock_time=120 silent parameters
- increase-sudo-tries.sh: Correctly configures sudo (no changes needed)
- Official Arch manual states: "Configuring options on the module command line is not recommend. The /etc/security/faillock.conf should be used instead."

Problem

Uses deprecated configuration method
May conflict with modern pambase versions that expect configuration via /etc/security/faillock.conf
Less maintainable and future-proof

Proposed Solution

Replace the current PAM sed commands with modern /etc/security/faillock.conf configuration while keeping the sudo script unchanged.

Suggested Script

#!/bin/bash
sudo tee /etc/security/faillock.conf > /dev/null << 'EOF'
# Omarchy faillock configuration - matches current inline parameters
deny = 10
unlock_time = 120
silent
EOF

This approach:
- ✅ Follows official Arch recommendations
- ✅ Uses modern PAM configuration standards
- ✅ Maintains same security settings (10 attempts, 2min lockout)
- ✅ More maintainable and future-proof

References:
- [pam_faillock(8) Arch manual](https://man.archlinux.org/man/core/pam/pam_faillock.8.en)
- [faillock.conf(5) Arch manual](https://man.archlinux.org/man/core/pam/faillock.conf.5.en)

View raw text

### What do you need?

## Issue
The current faillock configuration scripts use deprecated inline parameters in PAM files, which is no longer the recommended approach according to Arch documentation.

And **yes** - this is mostly Claude generated, so need experts advice on this. But seems to work for me. I noticed I easily got locked out due to also having fat fingers. So did some AI investigation and this is the result that seems to work so far. 

Current scripts:
- `increase-lockout-limit.sh`: Uses `sed` to modify `/etc/pam.d/system-auth` with inline `deny=10 unlock_time=120 silent` parameters
- `increase-sudo-tries.sh`: Correctly configures sudo (no changes needed)
- Official Arch manual states: *"Configuring options on the module command line is not recommend. The /etc/security/faillock.conf should be used instead."*

## Problem
- Uses deprecated configuration method
- May conflict with modern pambase versions that expect configuration via `/etc/security/faillock.conf`
- Less maintainable and future-proof

## Proposed Solution
Replace the current PAM sed commands with modern `/etc/security/faillock.conf` configuration while keeping the sudo script unchanged.

## Suggested Script

```bash
#!/bin/bash
sudo tee /etc/security/faillock.conf > /dev/null << 'EOF'
# Omarchy faillock configuration - matches current inline parameters
deny = 10
unlock_time = 120
silent
EOF
```

This approach:
- ✅ Follows official Arch recommendations  
- ✅ Uses modern PAM configuration standards
- ✅ Maintains same security settings (10 attempts, 2min lockout)
- ✅ More maintainable and future-proof

**References:**
- [[pam_faillock(8) Arch manual](https://man.archlinux.org/man/core/pam/pam_faillock.8.en)](https://man.archlinux.org/man/core/pam/pam_faillock.8.en)
- [[faillock.conf(5) Arch manual](https://man.archlinux.org/man/core/pam/faillock.conf.5.en)](https://man.archlinux.org/man/core/pam/faillock.conf.5.en)

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.

Proof

History & reports

Reference