Harden browser managed policy permissions

[afurm]

Summary

Fixes #5547.

This keeps Chromium and Brave managed policy directories from being writable by every local user, while preserving no-sudo theme switching.

Changes

• Create /etc/chromium/policies/managed and /etc/brave/policies/managed as root:root mode 755.
• Pre-create Omarchy’s managed color.json as root:wheel mode 664.
• Keep omarchy-theme-set-browser sudo-free by only overwriting the existing color.json.
• Remove stale color.json paths during migration before recreating them, so old symlinks from the previous world-writable directory state are not followed.
• Update the older migration path to use the same hardened directory/file setup.

Validation

• bash -n bin/omarchy-theme-set-browser install/config/theme.sh migrations/1757147211.sh migrations/1777653181.sh
• git diff --check
• Focused shell checks for:
  • sudo-free theme writer
  • stale color.json symlink removal
  • root:root policy directories
  • root:wheel mode 664 policy file setup

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d1aef6a0f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Hardens browser managed policy directory permissions for Chromium/Brave so theme policy files remain admin/root-controlled, and adds a migration to repair existing installs.

Changes:

• Create managed policy directories with root ownership and 755 perms (instead of user-writable).
• Write color.json via privileged write (sudo tee) and enforce root-owned 644 perms.
• Add a migration to correct directory and color.json permissions on upgrade.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
migrations/1777653181.sh	New migration to reset managed policy directory and color.json ownership/permissions, then re-apply policy.
migrations/1757147211.sh	Updates initial directory creation to root-owned 755 (removes world-writable).
install/config/theme.sh	Ensures managed policy directories are created root-owned 755 during install.
bin/omarchy-theme-set-browser	Centralizes policy writing and switches to privileged writes with enforced ownership/mode.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.