Browser managed policy directories are world-writable #5547

System details

Omarchy dev branch at 3fabdf7; Chromium/Brave browser policy setup; hardware independent

What's wrong?

Omarchy creates Chromium and Brave managed policy directories under /etc, then makes them writable by every local user.

Affected files:

• install/config/theme.sh
• migrations/1757147211.sh

Current behavior:

sudo mkdir -p /etc/chromium/policies/managed
sudo chmod a+rw /etc/chromium/policies/managed

sudo mkdir -p /etc/brave/policies/managed
sudo chmod a+rw /etc/brave/policies/managed

These directories are privileged browser managed-policy inputs. Chromium's Linux policy docs say managed policy files/directories should not be writable by non-admin users.

Steps to recreate:

1. Run the Omarchy install path or the existing migration that creates browser policy directories.

2. Check permissions:

   ls -ld /etc/chromium/policies/managed /etc/brave/policies/managed

3. Notice that non-root users can write files into those directories.

Expected behavior:

The managed policy directories should remain root/admin writable only, for example root-owned mode 755. Omarchy can still update color.json by writing it through sudo.

Actual behavior:

The directories are made writable by everyone so omarchy-theme-set-browser can write color.json without sudo.

Suggested fix:

• Create /etc/chromium/policies/managed and /etc/brave/policies/managed with root ownership and mode 755.
• Write color.json via sudo tee.
• Set color.json to root-owned mode 644.
• Add a migration to repair permissions on existing installs.

I have a patch prepared for this.