Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-620GitHub issuePublicDecided· Out of scope

[Security] omarchy-update-stay-awake stages inhibit state under predictable /tmp/omarchy-$UID

Reported by Chessing234 · filed Sep 13, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

[Security] omarchy-update-stay-awake stages inhibit state under predictable /tmp/omarchy-$UIDrevision 1 · captured 2026-09-28 21:23 UTC via poll

Problem

bin/omarchy-update-stay-awake falls back to:

state_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}/omarchy-update-stay-awake"

and then mkdir -p with no mode or ownership check.

When XDG_RUNTIME_DIR is unset, another local user can create /tmp/omarchy-$UID first and control inhibit-pid / idle-owner (redirect the kill on stop, block idle restore, or race the inhibitor).

Expected

Prefer XDG_RUNTIME_DIR. Without it, use a private 0700 owner-checked directory under ${XDG_STATE_HOME:-$HOME/.local/state}/omarchy, never a bare predictable name in world-writable /tmp.

View raw text
## Problem

`bin/omarchy-update-stay-awake` falls back to:

```bash
state_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}/omarchy-update-stay-awake"
```

and then `mkdir -p` with no mode or ownership check.

When `XDG_RUNTIME_DIR` is unset, another local user can create `/tmp/omarchy-$UID` first and control `inhibit-pid` / `idle-owner` (redirect the kill on stop, block idle restore, or race the inhibitor).

## Expected

Prefer `XDG_RUNTIME_DIR`. Without it, use a private 0700 owner-checked directory under `${XDG_STATE_HOME:-$HOME/.local/state}/omarchy`, never a bare predictable name in world-writable `/tmp`.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 12:25 UTC