tv ff: use abspath to sudo

tv/2configs/xserver/default.nix

@@ -18,7 +18,7 @@ in {
     pkgs.xlibs.fontschumachermisc
   ];
 
-  # TODO dedicated group, i.e. with a single user
+  # TODO dedicated group, i.e. with a single user [per-user-setuid]
   # TODO krebs.setuid.slock.path vs /var/setuid-wrappers
   krebs.setuid.slock = {
     filename = "${pkgs.slock}/bin/slock";

tv/5pkgs/ff/default.nix

@@ -1,8 +1,12 @@
 { pkgs, ... }:
 
-pkgs.writeScriptBin "ff" ''
- #! ${pkgs.bash}/bin/bash
- exec sudo -u ff -i <<EOF
+# TODO use krebs.setuid
+# This requires that we can create setuid executables that can only be accessed
+# by a single user. [per-user-setuid]
+
+# using bash for %q
+pkgs.writeBashBin "ff" ''
+ exec /var/setuid-wrappers/sudo -u ff -i <<EOF
  exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@")
  EOF
 ''