Skip to content

[Security] Keep the theme-set flock out of world-writable /tmp - #10504

Closed
Chessing234 wants to merge 1 commit into
omacom:quattrofrom
Chessing234:security/theme-set-lock-runtime
Closed

Chessing234 wants to merge 1 commit into
omacom:quattrofrom
Chessing234:security/theme-set-lock-runtime

Conversation

@Chessing234

@Chessing234 Chessing234 commented Sep 6, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • omarchy-theme-set flocked ${XDG_RUNTIME_DIR:-/tmp}/omarchy-theme-set.lock
  • A local user who held that path in /tmp could stall every theme switch
  • Stage the flock under $XDG_RUNTIME_DIR (or a 0700 /tmp/omarchy-$UID fallback)

Test plan

  • bash test/shell.d/theme-set-lock-test.sh
  • Switch a theme and confirm the lock file is not under world-writable /tmp

@Chessing234

Copy link
Copy Markdown
Contributor Author

@dhh @ryanrhughes ready for review

@Chessing234

Copy link
Copy Markdown
Contributor Author

folded into #12066 for a single review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant