Repository navigation
Installer: verify the Browser helper hash before sudo install #406
Description
scripts/install.sh:908-926 copies a user-writable Browser helper to root with sudo on any Linux host with /dev/kvm (called at :952). Malware already running as the user could swap the file first.
Done means: the helper's hash is checked against the signed release before sudo install (or it ships root-owned).
Source: external audit of develop 55dcb79 (rev 3) verified independently by OMP and grook on 16 Oct. Related: #165, #288.
Acceptance record — 3 November 2026
The current #90 source snapshot 3a8f41c62 still copies the helper from the user's data directory with sudo install and then executes the root copy. Its printed manual command uses the same input. Source review confirms the existing finding on both paths. Prove that the exact bytes admitted by the signed manifest are the bytes the privileged step executes, including a replacement between validation and installation. Keep the explicit operator confirmation, removal and ordinary-user Runtime proof in #165/#90. Main owns the Linux release lane.
Activity
andersalm commentedon Oct 17, 2026
Scope correction from source review: prepare_browser_linux_host checks Linux, helper availability and /dev/kvm; it has no architecture or Jetson exclusion.
A qualifying Jetson can enter this setup path. Treat target eligibility as unverified until checked; the claim that this issue cannot affect Jetson is unsupported by the installer.
changelog: 0.8.0 notes name the gaps planned for 0.8.1 (#403, #406) a…
andersalm commentedon Nov 6, 2026
Source review of #535 candidate
f1232e148f2b1d0ab8ab9ee03d63e9c3e366aab2, tree3de15aca32bce6ea2c4f63ea0809a521f2539270: the new explicit Browser setup checks the installed helper against its admitted checksum, then separately copies and executes the privileged helper. The handoff still leaves this issue’s exact executed-byte requirement unresolved (setup/browser_linux.rs:37–53,158–185). This is a source finding; Root performed zero privileged operations.Main owns a handoff that binds the privileged copy to the admitted bytes, plus the existing replacement-between-validation-and-installation regression and ordinary success/decline/removal checks. The scoped #534 no-hold decision covers a different authority boundary.