diff options
author | tv <tv@krebsco.de> | 2016-05-25 11:29:20 +0200 |
---|---|---|
committer | tv <tv@krebsco.de> | 2016-05-25 11:29:20 +0200 |
commit | 34de94dd521afd9908c2a02a98e226ee6cc81ef0 (patch) | |
tree | adb6dd17475e2c05568305c23b986a658ab0e5f1 /tv/5pkgs/ff/default.nix | |
parent | 54ea29c76127453fe0975dbf015288344afe4c94 (diff) |
tv ff: use abspath to sudo
Diffstat (limited to 'tv/5pkgs/ff/default.nix')
-rw-r--r-- | tv/5pkgs/ff/default.nix | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/tv/5pkgs/ff/default.nix b/tv/5pkgs/ff/default.nix index 2db4040..b1d2c57 100644 --- a/tv/5pkgs/ff/default.nix +++ b/tv/5pkgs/ff/default.nix @@ -1,8 +1,12 @@ { pkgs, ... }: -pkgs.writeScriptBin "ff" '' - #! ${pkgs.bash}/bin/bash - exec sudo -u ff -i <<EOF +# TODO use krebs.setuid +# This requires that we can create setuid executables that can only be accessed +# by a single user. [per-user-setuid] + +# using bash for %q +pkgs.writeBashBin "ff" '' + exec /var/setuid-wrappers/sudo -u ff -i <<EOF exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@") EOF '' |