$ the-wire · showcase
Omarchy closes root-level sudo and argument-injection holes in its package helpers
By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology
Two Omarchy security fixes harden the privileged package paths that arbitrary user input and user-controlled code reach, while mainline takes a batch of stable hotfixes for HID, remoteproc, s390 crypto, and mm.
OM-SEC-22: Isolate OCaml cleanup authorization basecamp/omarchy
User-controlled opam code could run before a normal sudo cleanup, and a detached child could wait out that authentication and reuse the resulting timestamp; the OCaml removal path now invalidates existing sudo credentials before running opam, requires sudo --no-update support, and runs only the fixed /usr/local/bin/opam cleanup via sudo -N. Per the pull request, the fix leaves the package-manag...
[Security] Treat command operands as literal values basecamp/omarchy
Helper scripts forwarded command-line values to other programs without terminating the option list, so a value beginning with - was read as a flag: "omarchy-pkg-add --hookdir /tmp/attacker-hooks innocuous-package" reached root pacman as --hookdir /tmp/attacker-hooks instead of a package name. Omarchy now treats those operands as literal values, which closes the injection path for any caller pas...
Merge tag 'hid-for-linus-2026092202' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid torvalds/linux
Jiri Kosina's HID pull brings new device IDs and quirks for the Logitech G502X, Elecom M-XT4DRBK, Steelseries Arctis 7, Asus Rog Z13 Folio, and Lenovo Yoga Slim Gen 11, plus code fixes found by LLMs and an __hid_bpf_hw_check_param fix with an unnumbered variant added to the hid_bpf selftests.
Merge tag 'mm-hotfixes-stable-2026-09-21-17-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm torvalds/linux
Andrew Morton's batch lands 14 mm hotfixes, 10 of them cc:stable, including five DAMON fixes where one arm64 contpte bug lets DAMON write past the end of a page-table page, causing memory corruption and possible crashes, and a hugetlb mremap() address calculation bug that can panic x86-64.
Merge tag 'rproc-v7.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux torvalds/linux
The remoteproc pull fixes an unbalanced handover IRQ on attach and a shutdown return value that was being overwritten in the Qualcomm PAS driver, corrects which secure services the Qualcomm modem driver requires after the move to 'PAS service', and passes the right addresses to iommu_unmap() for the Qualcomm ADSP carveout. Separately, Herbert Xu's pull fixes an hmac hashing bug on s390.
