Security Audit
Ran a security audit on the vander-mattox MacBook Air (Omarchy Linux). Found and closed the two things that actually mattered today: Docker’s passwordless-root path and a plaintext keyring left behind by system snapshots.
Wednesday 2:39PM
Snapshots hold plaintext copies of the old keyring — sudo snapper list to see what exists.
Still Open
- Snapshots — hold plaintext copies of the old keyring;
sudo snapper listto see what exists. - Transcript redaction — the sed command from earlier, after this session ends.
- HIGH-3 — unsigned Omarchy repo; can draft the upstream issue.
- HIGH-4 — Apple EFI firmware password needs a macOS Recovery boot.
- Boot check — confirm the keyring stays locked through autologin next time you reboot.
Decisions around autologin and revocation were saved to memory so a future session doesn’t re-litigate them.
Closed the two things that actually mattered today. The rest can wait for a fresh sitting.
Recap: Audited the MacBook Air for security hardening and closed the two urgent items — Docker’s passwordless-root path and the plaintext keyring. Next: reboot to confirm the keyring stays locked through autologin.