Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
/etc/sudoers.d/omarchy-passwd-tries silently overrides a user's own stricter drop-in
Reported by CRTFD-DVLPR · filed Sep 18, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Omarchy ships /etc/sudoers.d/omarchy-passwd-tries with Defaults passwd_tries=10. sudoers.d is read in lexical order with last-wins semantics, so this silently overrides any stricter value a user drops in earlier in the alphabet. I tried lowering it myself with /etc/sudoers.d/99-passwd-tries, not realizing o sorts after 9 — the override had no effect, and sudo -l still showed 10 as the winning value.
This is the same shape of footgun as the kernel-cmdline one (#12390): a normal-looking user customization silently loses to one of Omarchy's own drop-ins because of file-naming order, with nothing telling you it didn't take effect.
Two independent things worth considering:
1. Is passwd_tries=10 (vs. upstream sudo's default of 3) an intentional choice? If so, a mention in the hardening docs that overriding it needs a zz--prefixed filename would save others the same silent-failure experience.
2. If not intentional, lowering the shipped default closer to upstream's 3 would remove the need for users to override it at all.
(Filed as a plain issue rather than a security report — faillock's separate deny=5 lockout already bounds consecutive attempts system-wide, so this doesn't meaningfully cross a privilege boundary on its own; it's a docs/config footgun like #12390.)
View raw text
Omarchy ships `/etc/sudoers.d/omarchy-passwd-tries` with `Defaults passwd_tries=10`. `sudoers.d` is read in lexical order with last-wins semantics, so this silently overrides any stricter value a user drops in earlier in the alphabet. I tried lowering it myself with `/etc/sudoers.d/99-passwd-tries`, not realizing `o` sorts after `9` — the override had no effect, and `sudo -l` still showed 10 as the winning value. This is the same shape of footgun as the kernel-cmdline one (#12390): a normal-looking user customization silently loses to one of Omarchy's own drop-ins because of file-naming order, with nothing telling you it didn't take effect. Two independent things worth considering: 1. Is `passwd_tries=10` (vs. upstream sudo's default of 3) an intentional choice? If so, a mention in the hardening docs that overriding it needs a `zz-`-prefixed filename would save others the same silent-failure experience. 2. If not intentional, lowering the shipped default closer to upstream's 3 would remove the need for users to override it at all. (Filed as a plain issue rather than a security report — `faillock`'s separate deny=5 lockout already bounds consecutive attempts system-wide, so this doesn't meaningfully cross a privilege boundary on its own; it's a docs/config footgun like #12390.)
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 15:22 UTC