From 43a1c971c3e23936045de07717a41db7aa1a03ca Mon Sep 17 00:00:00 2001
From: Taksh <takshkothari09@gmail.com>
Date: Mon, 31 Aug 2026 22:18:27 +0530
Subject: [PATCH] Clear setgid when hardening Windows VM storage directories

chmod 0700 on a setgid directory leaves mode 2700, so the exact 700
privacy check failed and launch aborted on inherited setgid paths.
---
 bin/omarchy-windows-vm | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/bin/omarchy-windows-vm b/bin/omarchy-windows-vm
index f672ed7eee1..34135e9d477 100755
--- a/bin/omarchy-windows-vm
+++ b/bin/omarchy-windows-vm
@@ -580,7 +580,9 @@ prepare_caller_mounts() {
   # Privacy is an explicit preflight step for both already-pinned sources, not
   # a side effect halfway through the two-mount transaction. Old umask-022
   # installs are hardened together before either Docker-facing anchor changes.
-  chmod 0700 -- "/proc/$BASHPID/fd/$storage_fd" "/proc/$BASHPID/fd/$shared_fd" || {
+  # Drop setgid/setuid bits too: chmod 0700 alone leaves a setgid dir as 2700,
+  # which then fails the exact-mode privacy check below.
+  chmod a-s,u=rwx,go= -- "/proc/$BASHPID/fd/$storage_fd" "/proc/$BASHPID/fd/$shared_fd" || {
     exec {storage_fd}<&-
     exec {shared_fd}<&-
     return 1
@@ -1015,7 +1017,7 @@ prepare_user_mount_sources() {
     echo "omarchy-windows-vm: storage and shared must be different directories" >&2
     return 1
   }
-  chmod 0700 -- "$storage" "$shared"
+  chmod a-s,u=rwx,go= -- "$storage" "$shared"
 }
 
 storage_space_path() {