[codex] OM-SEC-23: Keep debug collectors outside dmesg authorization

AGENTS.md

@@ -28,7 +28,7 @@ Three documentation trees, split by genre and audience:
 - Prefer `(( ))` over numeric operators inside `[[ ]]` (e.g., `(( count < 50 ))`, not `[[ $count -lt 50 ]]`)
 - Prefer a full `if`/`else` conditional for simple two-path control flow; don't rely on `exec` or `exit` in one branch to make following statements unreachable
 - For strings/paths with spaces, quote them instead of escaping spaces with `\ ` (e.g., `"$APP_DIR/Disk Usage.desktop"`, not `$APP_DIR/Disk\ Usage.desktop`)
-- Shebangs must use `#!/bin/bash` consistently (never `#!/usr/bin/env bash`)
+- Shebangs must use `#!/bin/bash` consistently (never `#!/usr/bin/env bash`). A security-sensitive entrypoint may use the exact `#!/bin/bash -p` form only when it must suppress `BASH_ENV` and exported-function startup injection before its first command; that exception must be explained at the boundary and covered by a regression that rejects an ordinary Bash launch with a decoy `-p` argument.
 - Scripts under `install/` and `migrations/` may be sourced and intentionally omit shebangs
 
 # Command Naming

bin/omarchy-debug

@@ -1,10 +1,20 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # omarchy:summary=Print debugging information
 # omarchy:args=[--no-sudo] [--print]
 # omarchy:examples=omarchy debug --print --no-sudo
 # omarchy:requires-sudo=true
 
+source "${BASH_SOURCE[0]%/*}/omarchy-security-functions" || exit 126
+
+omarchy_security_require_privileged_bash_startup || {
+  echo "Refusing an unsafe Bash startup for debug collection." >&2
+  exit 126
+}
+unset BASH_ENV ENV
+
+set -uo pipefail
+
 NO_SUDO=false
 PRINT_ONLY=false
 
@@ -26,15 +36,51 @@ while (( $# > 0 )); do
   esac
 done
 
-LOG_FILE="/tmp/omarchy-debug.log"
+# OM-SEC-06 owns this private staging change in #8370. Keep the same shape so
+# this stacked branch can focus on the later sudo-credential boundary.
+log_dir="${XDG_RUNTIME_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/omarchy}"
+LOG_FILE="$log_dir/omarchy-debug.log"
+if ! mkdir -p "$log_dir" || ! install -m 600 /dev/null "$LOG_FILE"; then
+  echo "Error: Failed to create $LOG_FILE" >&2
+  exit 1
+fi
+
+SUDO_BOUNDARY_ACTIVE=false
+cleanup_debug_authorization() {
+  local status=$?
+
+  trap - EXIT HUP INT TERM
+  if [[ $SUDO_BOUNDARY_ACTIVE == true ]]; then
+    omarchy_security_exit_with_revoked_sudo "$status"
+  fi
+  exit "$status"
+}
+trap cleanup_debug_authorization EXIT
+omarchy_security_install_signal_exit_traps
 
-if [[ $NO_SUDO = "true" ]]; then
+if [[ $NO_SUDO == true ]]; then
   DMESG_OUTPUT="(skipped - --no-sudo flag used)"
 else
-  DMESG_OUTPUT="$(sudo dmesg)"
+  omarchy_security_sudo_supports_no_update || {
+    echo "This sudo does not support --no-update; refusing privileged debug collection." >&2
+    exit 1
+  }
+  omarchy_security_revoke_sudo_timestamp || {
+    echo "Could not invalidate cached sudo authorization." >&2
+    exit 1
+  }
+  SUDO_BOUNDARY_ACTIVE=true
+  if ! DMESG_OUTPUT=$(/usr/bin/sudo -N -- /usr/bin/dmesg); then
+    echo "Could not collect the kernel log through command-scoped sudo." >&2
+    exit 1
+  fi
+  omarchy_security_revoke_sudo_timestamp || {
+    echo "Could not invalidate cached sudo authorization." >&2
+    exit 1
+  }
 fi
 
-cat > "$LOG_FILE" <<EOF
+cat >"$LOG_FILE" <<EOF
 Date: $(date)
 Hostname: $(hostname)
 Omarchy Package: $(pacman -Q omarchy-dev 2>/dev/null || pacman -Q omarchy 2>/dev/null || echo "unknown")
@@ -60,7 +106,7 @@ INSTALLED PACKAGES
 $({ expac -S '%n %v (%r)' $(pacman -Qqe) 2>/dev/null; comm -13 <(pacman -Sql | sort) <(pacman -Qqe | sort) | xargs -r expac -Q '%n %v (AUR)'; } | sort)
 EOF
 
-if [[ $PRINT_ONLY = "true" ]]; then
+if [[ $PRINT_ONLY == true ]]; then
   cat "$LOG_FILE"
   exit 0
 fi
@@ -75,8 +121,7 @@ ACTION=$(gum choose "${OPTIONS[@]}")
 case "$ACTION" in
   "Upload log")
     echo "Uploading debug log to logs.omarchy.org..."
-    URL=$(curl -sf -F "file=@$LOG_FILE" -Fexpires=24 https://logs.omarchy.org/)
-    if (( $? == 0 )) && [[ -n $URL ]]; then
+    if URL=$(curl -sf -F "file=@$LOG_FILE" -Fexpires=24 https://logs.omarchy.org/) && [[ -n $URL ]]; then
       echo "✓ Log uploaded successfully!"
       echo "Share this URL:"
       echo ""

bin/omarchy-security-functions

@@ -0,0 +1,87 @@
+#!/bin/bash
+
+# omarchy:hidden=true
+# omarchy:summary=Provide internal fail-closed helpers for security-sensitive commands
+
+# Shared fail-closed primitives for security-sensitive Omarchy commands. This
+# file is sourced from the same package-owned bin directory as its consumers.
+
+if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
+  echo "omarchy-security-functions is an internal function library." >&2
+  exit 64
+fi
+
+omarchy_security_require_privileged_bash_startup() {
+  local pid=${1:-$$}
+
+  [[ $- == *p* && $pid =~ ^[1-9][0-9]*$ ]] || return 1
+  /usr/bin/env -i /usr/bin/bash -p -c '
+    mapfile -d "" -t argv <"/proc/$1/cmdline" || exit 1
+    executable=$(/usr/bin/readlink -e -- "/proc/$1/exe") || exit 1
+    [[ $executable == /usr/bin/bash ]]
+    [[ ${argv[0]:-} == /bin/bash || ${argv[0]:-} == /usr/bin/bash ]]
+    [[ ${argv[1]:-} == -p ]]
+  ' omarchy-bash-startup "$pid"
+}
+
+omarchy_security_sudo_supports_no_update() {
+  LC_ALL=C /usr/bin/sudo -h 2>&1 |
+    /usr/bin/grep -Eq '^usage: sudo .*\[[^]]*N[^]]*\]'
+}
+
+omarchy_security_revoke_sudo_timestamp() {
+  /usr/bin/sudo -k >/dev/null 2>&1
+}
+
+omarchy_security_exit_with_revoked_sudo() {
+  local status=$1
+  local message=${2:-Could not invalidate cached sudo authorization.}
+
+  trap - EXIT HUP INT TERM
+  if ! omarchy_security_revoke_sudo_timestamp; then
+    echo "$message" >&2
+    (( status != 0 )) || status=1
+  fi
+  exit "$status"
+}
+
+omarchy_security_install_signal_exit_traps() {
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+}
+
+omarchy_security_run_sudo_cleanup_trap() {
+  local status=$?
+
+  omarchy_security_exit_with_revoked_sudo "$status" \
+    "${OMARCHY_SECURITY_SUDO_CLEANUP_MESSAGE:-Could not invalidate cached sudo authorization.}"
+}
+
+omarchy_security_install_sudo_cleanup_traps() {
+  OMARCHY_SECURITY_SUDO_CLEANUP_MESSAGE=${1:-Could not invalidate cached sudo authorization.}
+  trap omarchy_security_run_sudo_cleanup_trap EXIT
+  omarchy_security_install_signal_exit_traps
+}
+
+omarchy_security_assert_root_directory() {
+  local path=$1 expected_mode=$2 canonical owner actual_mode
+
+  [[ $path == /* && -d $path && ! -L $path ]] || return 1
+  canonical=$(/usr/bin/realpath -e -- "$path") || return 1
+  [[ $canonical == "$path" ]] || return 1
+  read -r owner actual_mode < <(/usr/bin/stat -Lc '%u %a' -- "$path") || return 1
+  [[ $owner == "0" && $actual_mode == "$expected_mode" ]]
+}
+
+omarchy_security_prepare_private_root_directory() {
+  local path=$1 parent=$2
+
+  omarchy_security_assert_root_directory "$parent" 755 || return 1
+  if [[ -e $path || -L $path ]]; then
+    omarchy_security_assert_root_directory "$path" 700
+  else
+    /usr/bin/install -d -o root -g root -m 0700 -- "$path" || return 1
+    omarchy_security_assert_root_directory "$path" 700
+  fi
+}