2 files changed, 88 insertions, 0 deletions
diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index fd77b2262..0c10e1ec2 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -11,6 +11,7 @@ _:
     ./screenlock.nix
     ./umts.nix
     ./usershadow.nix
+    ./xjail.nix
     ./xserver
   ];
 }
diff --git a/lass/3modules/xjail.nix b/lass/3modules/xjail.nix
new file mode 100644
index 000000000..af851760b
--- /dev/null
+++ b/lass/3modules/xjail.nix
@@ -0,0 +1,87 @@
+{ config, pkgs, ... }:
+
+with import <stockholm/lib>;
+{
+  options.lass.xjail = mkOption {
+    type = types.attrsOf (types.submodule ({ config, ...}: {
+      options = {
+        user = mkOption {
+          type = types.string;
+          default = "nobody";
+        };
+        groups = mkOption {
+          type = types.listOf types.str;
+          default = [];
+        };
+        name = mkOption {
+          type = types.string;
+          default = config._module.args.name;
+        };
+        display = mkOption {
+          type = types.string;
+          default = toString (genid_signed config._module.args.name);
+        };
+        script = mkOption {
+          type = types.path;
+          default = pkgs.writeScript "echo_lol" "echo lol";
+        };
+        from = mkOption {
+          type = types.string;
+          default = "lass";
+        };
+      };
+    }));
+    default = {};
+  };
+
+  options.lass.xjail-bins = mkOption {
+    type = types.attrsOf types.path;
+  };
+
+  # implementation
+  config = {
+
+    users.users = mapAttrs' (_: cfg:
+      nameValuePair cfg.name {
+        uid = genid cfg.name;
+        home = "/home/${cfg.name}";
+        useDefaultShell = true;
+        createHome = true;
+        extraGroups = cfg.groups;
+      }
+    ) config.lass.xjail;
+
+    users.groups = mapAttrs' (_: cfg:
+      nameValuePair cfg.name {
+        members = [
+          cfg.name
+          cfg.from
+        ];
+      }
+    ) config.lass.xjail;
+
+    security.sudo.extraConfig = (concatStringsSep "\n" (mapAttrsToList (_: cfg:
+      # TODO allow just the right script with sudo
+      "${cfg.from} ALL=(${cfg.name}) NOPASSWD: ALL"
+    ) config.lass.xjail));
+
+    lass.xjail-bins = mapAttrs' (name: cfg:
+      let
+        sudo-wrapper = pkgs.writeScript name ''
+          /var/run/wrappers/bin/sudo -u ${cfg.name} -i ${cfg.script} "$@"
+        '';
+      in nameValuePair name (pkgs.writeScriptBin cfg.name ''
+        export NDISPLAY=${cfg.display}
+        DISPLAY=:$NDISPLAY ${pkgs.xorg.xrandr}/bin/xrandr
+        if test $? -eq 0; then
+          echo xephyr already running
+          export DISPLAY=:$NDISPLAY
+          ${sudo-wrapper} "$@"
+        else
+          echo xephyr not running
+          DROP_TO_USER=${cfg.name} ${pkgs.xephyrify}/bin/xephyrify ${sudo-wrapper} "$@"
+        fi
+      '')
+    ) config.lass.xjail;
+  };
+}