From b4ca66d23ab27f742d49057f28b7b4e03d7dfabe Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 25 May 2016 11:06:22 +0200
Subject: tv xserver: refactor

---
 tv/5pkgs/default.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'tv/5pkgs')

diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index 05dc02887..dc6082a44 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -17,6 +17,7 @@
       erlang = pkgs.erlangR16;
     };
     ff = pkgs.callPackage ./ff {};
+    need-reload = pkgs.writeDashBin "need-reload" ''echo "$*"'';
     viljetic-pages = pkgs.callPackage ./viljetic-pages {};
     xmonad-tv = import ./xmonad-tv.nix { inherit pkgs; };
   };
-- 
cgit v1.3.1


From 6370d2c2e2249f04202b88b35d0c945ce38b5fb8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 25 May 2016 11:16:38 +0200
Subject: tv xserver: replace need-reload by echo

---
 tv/2configs/xserver/default.nix | 4 ++--
 tv/5pkgs/default.nix            | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

(limited to 'tv/5pkgs')

diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 9e718a48f..a4f2499ff 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -97,7 +97,7 @@ in {
     };
     serviceConfig = {
       SyslogIdentifier = "xserver";
-      ExecReload = "${pkgs.need-reload}/bin/need-reload xserver.service";
+      ExecReload = "${pkgs.coreutils}/bin/echo NOP";
       ExecStart = toString [
         "${pkgs.xorg.xorgserver}/bin/X"
         ":${toString config.services.xserver.display}"
@@ -115,7 +115,7 @@ in {
     reloadIfChanged = true;
     serviceConfig = {
       SyslogIdentifier = "urxvtd";
-      ExecReload = "${pkgs.need-reload}/bin/need-reload urxvtd.service";
+      ExecReload = "${pkgs.coreutils}/bin/echo NOP";
       ExecStart = "${pkgs.rxvt_unicode}/bin/urxvtd";
       Restart = "always";
       RestartSec = "2s";
diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index dc6082a44..05dc02887 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -17,7 +17,6 @@
       erlang = pkgs.erlangR16;
     };
     ff = pkgs.callPackage ./ff {};
-    need-reload = pkgs.writeDashBin "need-reload" ''echo "$*"'';
     viljetic-pages = pkgs.callPackage ./viljetic-pages {};
     xmonad-tv = import ./xmonad-tv.nix { inherit pkgs; };
   };
-- 
cgit v1.3.1


From 8ec65b04dc5010f910bf67f1db8a78bd844202b0 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 25 May 2016 11:29:20 +0200
Subject: tv ff: use abspath to sudo

---
 tv/2configs/xserver/default.nix |  2 +-
 tv/5pkgs/ff/default.nix         | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

(limited to 'tv/5pkgs')

diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index a4f2499ff..965c3bbe1 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -18,7 +18,7 @@ in {
     pkgs.xlibs.fontschumachermisc
   ];
 
-  # TODO dedicated group, i.e. with a single user
+  # TODO dedicated group, i.e. with a single user [per-user-setuid]
   # TODO krebs.setuid.slock.path vs /var/setuid-wrappers
   krebs.setuid.slock = {
     filename = "${pkgs.slock}/bin/slock";
diff --git a/tv/5pkgs/ff/default.nix b/tv/5pkgs/ff/default.nix
index 2db404030..b1d2c579a 100644
--- a/tv/5pkgs/ff/default.nix
+++ b/tv/5pkgs/ff/default.nix
@@ -1,8 +1,12 @@
 { pkgs, ... }:
 
-pkgs.writeScriptBin "ff" ''
- #! ${pkgs.bash}/bin/bash
- exec sudo -u ff -i <<EOF
+# TODO use krebs.setuid
+# This requires that we can create setuid executables that can only be accessed
+# by a single user. [per-user-setuid]
+
+# using bash for %q
+pkgs.writeBashBin "ff" ''
+ exec /var/setuid-wrappers/sudo -u ff -i <<EOF
  exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@")
  EOF
 ''
-- 
cgit v1.3.1