$ the-wire · showcase
Omarchy closes three installer security holes, cgroup iterator fixes a use-after-free
By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology
Omarchy's install and trust paths got the serious attention today, three security fixes covering RDP credentials, project-local PATH injection, and world-writable state files, while 7.3-rc3 brings a cgroup use-after-free and a regressed sysctl range check back into line.
Merge pull request #7902 from dicemans/rdp-password-not-in-argv basecamp/omarchy
The Windows VM password no longer travels in the RDP client's argument list, where any local process could read it from /proc. If you scripted RDP sessions against argv, that assumption is now gone.
Remove unsafe project bin PATH injection (#11336) basecamp/omarchy
Fresh installs stop creating and trusting ~/Work/.mise.toml with the dynamic {{ cwd }}/bin PATH entry, existing installs get migrated by deleting the stock config or backing up customized ones before stripping only the unsafe assignment, and the legacy directory-root trust is revoked without overriding an explicit Mise ignore decision. Anything relying on the implicit project bin path now needs...
[Security] Keep screen-recording state out of world-writable /tmp (#8374) basecamp/omarchy
Screen-recording state moves out of world-writable /tmp, closing a path where any local user could tamper with it. The resizer resolves the region file through the same location, so there is no half-migrated read.
Merge tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup torvalds/linux
The task iterator could pick up a dying task whose refcount had already dropped to zero and resurrect it, producing a use-after-free when reading cgroup.procs; such tasks are now skipped. It is a correct read of a container's process list under teardown, fixed before the read becomes a crash.
Merge tag 'sysctl-7.03-fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl torvalds/linux
A range check for millisecond-to-jiffy conversion was dropped when SYSCTL_INT_CONV_CUSTOM was replaced with functions, and sysctl_msec_to_jiffies truncated the values it no longer bounds-checked. The check is back in do_proc_ulong_conv_ms_jiffies_minmax and proc_dointvec_ms_jiffies_minmax, so millisecond sysctls reject out-of-range writes again instead of silently narrowing them.
Action items
- → Rebuild or update Omarchy installs that use the project bin PATH injection, and set explicit relative paths for trust... basecamp/omarchy [plan]
- → Update Omarchy so the Windows VM password leaves the RDP client's argument list basecamp/omarchy [plan]
