summaryrefslogtreecommitdiffstats
path: root/tv
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2016-05-25 11:29:20 +0200
committertv <tv@krebsco.de>2016-05-25 11:29:20 +0200
commit8ec65b04dc5010f910bf67f1db8a78bd844202b0 (patch)
treeedfdd043de9259a7cf4c349794e0ecb04729cd3a /tv
parent6370d2c2e2249f04202b88b35d0c945ce38b5fb8 (diff)
tv ff: use abspath to sudo
Diffstat (limited to 'tv')
-rw-r--r--tv/2configs/xserver/default.nix2
-rw-r--r--tv/5pkgs/ff/default.nix10
2 files changed, 8 insertions, 4 deletions
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index a4f2499ff..965c3bbe1 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -18,7 +18,7 @@ in {
pkgs.xlibs.fontschumachermisc
];
- # TODO dedicated group, i.e. with a single user
+ # TODO dedicated group, i.e. with a single user [per-user-setuid]
# TODO krebs.setuid.slock.path vs /var/setuid-wrappers
krebs.setuid.slock = {
filename = "${pkgs.slock}/bin/slock";
diff --git a/tv/5pkgs/ff/default.nix b/tv/5pkgs/ff/default.nix
index 2db404030..b1d2c579a 100644
--- a/tv/5pkgs/ff/default.nix
+++ b/tv/5pkgs/ff/default.nix
@@ -1,8 +1,12 @@
{ pkgs, ... }:
-pkgs.writeScriptBin "ff" ''
- #! ${pkgs.bash}/bin/bash
- exec sudo -u ff -i <<EOF
+# TODO use krebs.setuid
+# This requires that we can create setuid executables that can only be accessed
+# by a single user. [per-user-setuid]
+
+# using bash for %q
+pkgs.writeBashBin "ff" ''
+ exec /var/setuid-wrappers/sudo -u ff -i <<EOF
exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@")
EOF
''