[codex] OM-SEC-13: Remove the package-conflict root-write primitive

[AFOliveira]

Summary

A second local process could race the generic conflict mover and make its root restore publish attacker-controlled bytes into a root configuration path.

Finding: OM-SEC-13

Security impact

The attacker can replace bytes restored by root into a privileged configuration path; a suitable target produces host root code execution.

Remediation

The generic move/quarantine/restore handler was deleted. Static root files are package-owned, legacy bytes are handled by exact migrations, ordinary conflicts fail closed, and the sole broad overwrite is the one-time Quattro settings ownership bridge.

The reviewed implementation applies these concrete controls:

• bin/omarchy-update-system-pkgs-when-conflicted is deleted.
• Ordinary package updates use normal Pacman ownership checks and leave filesystem conflicts untouched.
• Package-vs-package conflicts may receive one attended Pacman retry; no file is moved, restored, or quarantined.
• The sole broad overwrite is the Quattro transition's one-time omarchy-settings adoption transaction.
• Static sleep hooks and Omarchy's os-release content are installed by omarchy-settings, not copied into /usr at runtime.
• /etc/os-release is only a relative selector; package removal restores the Arch selector only when the exact Omarchy selector is dangling and preserves an administrator-selected target.
• The GPU toggle owns only /etc/omarchy/force-igpu and one symlink to a packaged drop-in.
• Chromium EULA state moved to the user profile; known unowned initial_preferences bytes are retired exactly.
• Legacy system and sleep-hook migrations remove only exact known, unowned regular files and preserve package-owned, linked, or modified administrator state.

Validation

The real baseline handler was exploited with two isolated UIDs. Conflict, ownership-transition, migration, and extracted-package tests pass.

Detailed regression coverage: update-conflict-security-test.sh, update-file-conflict-test.sh, update-package-conflict-test.sh, system-sleep-hook-transition-test.sh, legacy-system-state-transition-test.sh, chromium-eula-transition-test.sh, unowned-system-paths-test.sh, upgrade-to-quattro-test.sh, and both package payloads pass.

Current status: Fixed structurally, provided the main and settings packages ship together.

All changed shell files on this branch pass bash -n, and git diff --check passes.

Coordination

This is one finding in a coordinated 21-finding disclosure sent to the Omarchy security team. The corresponding Markdown report contains the affected-code analysis and safe reproduction.

The matching omarchy-settings ownership change must ship in the coordinated release.

[AFOliveira]

Closing this branch in favor of #9070 together with omacom/omarchy-pkgs#239. I ran #9070’s file-conflict, package-conflict, and package-ownership bridge tests locally against the companion package branch; all pass, along with changed-script syntax and git diff --check. #9070 already deletes the exploitable mover, prevents filesystem-conflict retries/quarantines, and confines the one broad overwrite to package ownership adoption. This branch’s only unique regression restated those invariants, while the remaining diff duplicated #9070 and unrelated findings.