Judge the invoking user's authorized keys when removing SSH access - #9573
Open
shaynhornik wants to merge 1 commit into
Open
Judge the invoking user's authorized keys when removing SSH access#9573shaynhornik wants to merge 1 commit into
shaynhornik wants to merge 1 commit into
Conversation
omarchy-remove-security-sshd resolved authorized_keys through $HOME, but it carries requires-sudo and can arrive under sudo or pkexec, where $HOME is root's. The key-removal prompt then keys off root's usually-absent file: the invoking user's keys silently survive the teardown and are live again if sshd is re-enabled. Derive the invoking user the way omarchy-apply-lock does and judge that user's keys. Fixes omacom#9572 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FTqr6ZjXfNthXT719ag7Qc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #9572
Problem
omarchy-remove-security-sshdpromises to "optionally remove authorized keys" but resolves the file through$HOME. Undersudo/pkexec(the script carriesrequires-sudo=true, andpkexecis the SKILL.md-prescribed path for terminal-less callers) that is/root/.ssh/authorized_keys: the prompt is silently skipped when root has no keys — leaving the invoking user's keys authorized and live again the moment sshd is re-enabled — or, worse, targets root's keys when root has them.Fix
The same target-user derivation
omarchy-apply-lockuses (OMARCHY_INSTALL_USER→SUDO_USER→PKEXEC_UIDvia getent →$USER), thenAUTHORIZED_KEYSpoints at that user's home. Direct invocation is unchanged.Split from #9571 (the same
$HOME-under-escalation class in the data-removal scripts) because this one changes a security decision rather than cleanup coverage; related hardening context: #9267, #9255.Verification
bash -nclean;./test/clipasses (116 ok).PKEXEC_UID+HOME=/root,SUDO_USER+HOME=/root, and direct invocation.🤖 Generated with Claude Code
https://claude.ai/code/session_01FTqr6ZjXfNthXT719ag7Qc