tor-browser-bundle-bin: runtime purity improvements

These changes reduce file accesses outside TBB_HOME or the Nix store, as
determined by running under strace -e access,open,stat.

Changed files
+30 -2
pkgs
applications
networking
browsers
tor-browser-bundle-bin
+30 -2
pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
···
# Pluggable transport dependencies
, python27
+
# Wrapper runtime
+
, coreutils
+
, glibcLocales
+
, hicolor_icon_theme
+
, shared_mime_info
+
# Extra preferences
, extraPrefs ? ""
}:
···
with stdenv.lib;
let
-
libPath = makeLibraryPath ([
+
libPath = makeLibraryPath libPkgs;
+
+
libPkgs = [
atk
cairo
dbus
···
libXt
pango
stdenv.cc.cc
+
stdenv.cc.libc
zlib
]
++ optionals pulseaudioSupport [ libpulseaudio ]
···
gst-plugins-base
gmp
ffmpeg
-
]);
+
];
gstPluginsPath = concatMapStringsSep ":" (x:
"${x}/lib/gstreamer-0.10") [
···
GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6
EOF
+
WRAPPER_XDG_DATA_DIRS=${concatMapStringsSep ":" (x: "${x}/share") [
+
hicolor_icon_theme
+
shared_mime_info
+
]}
+
# Generate wrapper
mkdir -p $out/bin
cat > "$out/bin/tor-browser" << EOF
#! ${stdenv.shell}
set -o errexit -o nounset
+
+
PATH=${makeBinPath [ coreutils ]}
+
export LC_ALL=C
+
export LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive
# Enter local state directory.
REAL_HOME=\$HOME
···
# Setting FONTCONFIG_FILE is required to make fontconfig read the TBB
# fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
# indicates the system fonts.conf being used instead.
+
#
+
# XDG_DATA_DIRS is set to prevent searching system dirs (looking for .desktop & icons)
exec env -i \
+
TZ=":" \
+
TZDIR="\''${TZDIR:-}" \
+
LOCALE_ARCHIVE="\$LOCALE_ARCHIVE" \
+
\
+
TMPDIR="\''${TMPDIR:-/tmp}" \
HOME="\$HOME" \
XAUTHORITY="\$XAUTHORITY" \
DISPLAY="\$DISPLAY" \
DBUS_SESSION_BUS_ADDRESS="\$DBUS_SESSION_BUS_ADDRESS" \
+
\
+
XDG_DATA_HOME="\$HOME/.local/share" \
+
XDG_DATA_DIRS="$WRAPPER_XDG_DATA_DIRS" \
\
PULSE_SERVER="\''${PULSE_SERVER:-}" \
PULSE_COOKIE="\''${PULSE_COOKIE:-}" \