From 39d808829c185db7f3393a86b12cb04a8ba24050 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Mon, 24 Jan 2022 14:34:18 +0100
Subject: l xjails: switch from sudo to machinectl

---
 lass/3modules/xjail.nix | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

(limited to 'lass')

diff --git a/lass/3modules/xjail.nix b/lass/3modules/xjail.nix
index f94e7ebbf..08a28b8e3 100644
--- a/lass/3modules/xjail.nix
+++ b/lass/3modules/xjail.nix
@@ -41,10 +41,6 @@ with import <stockholm/lib>;
           type = types.path;
           default = pkgs.writeScript "echo_lol" "echo lol";
         };
-        vglrun = mkOption {
-          type = types.bool;
-          default = false;
-        };
         wm = mkOption {
           #TODO find type
           type = types.str;
@@ -122,21 +118,14 @@ with import <stockholm/lib>;
           ${pkgs.coreutils}/bin/kill $XEPHYR_PID
         '';
         # TODO fix xephyr which doesn't honor resizes anymore
-        sudo_ = pkgs.writeDash "${cfg.name}-sudo" (if cfg.vglrun then ''
-          /var/run/wrappers/bin/sudo -u ${cfg.name} -i ${vglrun_} "$@"
-        '' else ''
+        sudo_ = pkgs.writeDash "${cfg.name}-sudo" ''
           #/var/run/wrappers/bin/sudo -u ${cfg.name} -i env DISPLAY=:${cfg.display} ${cfg.script} "$@"
-          /var/run/wrappers/bin/sudo -u ${cfg.name} -i ${cfg.script} "$@"
-
-        '');
-        vglrun_ = pkgs.writeDash "${cfg.name}-vglrun" ''
-          DISPLAY=:${cfg.display} ${pkgs.virtualgl}/bin/vglrun ${cfg.extraVglrunArgs} ${cfg.script} "$@"
+          ${pkgs.systemd}/bin/machinectl shell -E DISPLAY=:0 --uid=${cfg.name} .host ${cfg.script} "$@"
         '';
       in nameValuePair name {
         existing = newOrExisting;
         xephyr = xephyr_;
         sudo = sudo_;
-        vglrun = vglrun_;
       }
     ) config.lass.xjail;
   in {
@@ -161,10 +150,19 @@ with import <stockholm/lib>;
       }
     ) config.lass.xjail;
 
-    security.sudo.extraConfig = (concatStringsSep "\n" (mapAttrsToList (_: cfg:
-      # TODO allow just the right script with sudo
-      "${cfg.from} ALL=(${cfg.name}) NOPASSWD: ALL"
-    ) config.lass.xjail));
+    security.polkit.extraConfig = (concatStringsSep "\n" (mapAttrsToList (_: cfg: ''
+    polkit.addRule(function(action, subject) {
+      if (
+        subject.user == "${cfg.from}" &&
+        action.id == "org.freedesktop.machine1.host-shell" &&
+        action.lookup("user") == "${cfg.user}" &&
+        action.lookup("program") == "${cfg.script}" &&
+        true
+      ) {
+        return polkit.Result.YES;
+      }
+    });
+    '') config.lass.xjail));
 
     lass.xjail-bins = mapAttrs' (name: cfg:
       nameValuePair name (pkgs.writeScriptBin cfg.name ''
-- 
cgit v1.2.3