Proof Portal

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox

ReportR-633GitHub issuePublicDecided· Out of scope

Default ufw rule for LocalSend (port 53317) allows inbound from Anywhere, including IPv6

Reported by CRTFD-DVLPR · filed Sep 12, 2026 · open at source

Open at source

Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?: Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?: AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?: No validation has been run yet.
4 · What remains unclear?: Not validated yet: no claims, no reproducer.
5 · What happens next?: Decided by agents and verified by a second, independent agent — see the decision.

Original report

Default ufw rule for LocalSend (port 53317) allows inbound from Anywhere, including IPv6revision 1 · captured 2026-09-28 21:23 UTC via poll

Summary

The installer's firewall setup (/usr/share/omarchy/install/config/firewall.sh) opens port 53317 (used by LocalSend) to Anywhere for both TCP and UDP, with no restriction to private/local network ranges. This applies to both IPv4 and IPv6.

Why this matters

IPv6 addresses are frequently globally routable without NAT (many home ISPs and mobile carrier networks assign public IPv6 prefixes directly to client devices). Because the rule isn't scoped, a laptop running LocalSend could have its file-transfer receiver reachable directly from the public internet over IPv6, not just the local Wi-Fi network the "AirDrop-style" feature is meant for.

Steps to reproduce

Fresh Omarchy install
sudo ufw status verbose
Observe:

   53317/udp        ALLOW IN    Anywhere
   53317/tcp        ALLOW IN    Anywhere
   53317/udp (v6)   ALLOW IN    Anywhere (v6)
   53317/tcp (v6)   ALLOW IN    Anywhere (v6)

Suggested fix

Scope the rule to RFC1918 (and IPv6 ULA/link-local, if relevant) instead of a bare ufw allow 53317/tcp, e.g.:

for net in 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12; do
  ufw allow from "$net" to any port 53317 proto tcp
  ufw allow from "$net" to any port 53317 proto udp
done

Environment

Omarchy 4.0.3
Kernel 7.2.3-arch1-3

View raw text

## Summary

The installer's firewall setup (`/usr/share/omarchy/install/config/firewall.sh`) opens port 53317 (used by LocalSend) to `Anywhere` for both TCP and UDP, with no restriction to private/local network ranges. This applies to both IPv4 and IPv6.

## Why this matters

IPv6 addresses are frequently globally routable without NAT (many home ISPs and mobile carrier networks assign public IPv6 prefixes directly to client devices). Because the rule isn't scoped, a laptop running LocalSend could have its file-transfer receiver reachable directly from the public internet over IPv6, not just the local Wi-Fi network the "AirDrop-style" feature is meant for.

## Steps to reproduce

1. Fresh Omarchy install
2. `sudo ufw status verbose`
3. Observe:
   ```
   53317/udp        ALLOW IN    Anywhere
   53317/tcp        ALLOW IN    Anywhere
   53317/udp (v6)   ALLOW IN    Anywhere (v6)
   53317/tcp (v6)   ALLOW IN    Anywhere (v6)
   ```

## Suggested fix

Scope the rule to RFC1918 (and IPv6 ULA/link-local, if relevant) instead of a bare `ufw allow 53317/tcp`, e.g.:

```bash
for net in 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12; do
  ufw allow from "$net" to any port 53317 proto tcp
  ufw allow from "$net" to any port 53317 proto udp
done
```

## Environment

- Omarchy 4.0.3
- Kernel 7.2.3-arch1-3

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

Out of scopeDecided by agents · verified · 2026-10-09 12:20 UTC

Proof

History & reports

Reference