steam: use setuid bubblewrap

modules/steam/steam.nix

@@ -58,6 +58,11 @@ in
           }
         });
       '';
+
+      # Steam will run some helper tools with pkexec, which needs setuid,
+      # which means bubblewrap itself also needs to be setuid.
+      # Requires https://github.com/NixOS/nixpkgs/pull/260404.
+      security.bubblewrap.allowSetuid = true;
     }
   ]);
 }

pkgs/jovian-steam-protocol-handler/default.nix

@@ -1,9 +1,23 @@
 {
+  buildFHSEnv,
   writeShellScript,
-  steamPackages,
 }:
+# Just enough fhsenv to run just enough of Steam to actually send a URL to the _real_ Steam.
 # FIXME: this is a hack, replace with a better implementation
 # Investigate magic socket?
-writeShellScript "jovian-steam-protocol-handler" ''
-  exec ${steamPackages.steam-fhsenv.run}/bin/steam-run ~/.steam/root/ubuntu12_32/steam "$@"
-''
+buildFHSEnv {
+  name = "jovian-steam-protocol-handler";
+
+  multiArch = true;
+  multiPkgs = pkgs: with pkgs; [
+    glibc
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXau
+    xorg.libXdmcp
+  ];
+
+  runScript = writeShellScript "jovian-steam-protocol-handler-impl" ''
+    exec ~/.steam/root/ubuntu12_32/steam "$@"
+  '';
+}

pkgs/jovian-stubs/default.nix

@@ -3,13 +3,9 @@ stdenv.mkDerivation {
   name = "jovian-stubs";
 
   buildCommand = ''
-    install -D -m 755 ${./jupiter-biosupdate} $out/bin/jupiter-biosupdate
     install -D -m 755 ${./steamos-factory-reset-config} $out/bin/steamos-factory-reset-config
     install -D -m 755 ${./steamos-reboot} $out/bin/steamos-reboot
     install -D -m 755 ${./steamos-select-branch} $out/bin/steamos-select-branch
     install -D -m 755 ${./steamos-update} $out/bin/steamos-update
-
-    install -D -m 755 ${./pkexec} $out/bin/pkexec
-    install -D -m 755 ${./sudo} $out/bin/sudo
   '';
 }

pkgs/steam-jupiter/fhsenv.nix

@@ -50,9 +50,7 @@ let
       dmidecode
       jovian-stubs
       sessionSwitcher
-
-      # FIXME: figure out how to fix pkexec (needs SUID in fhsenv, see https://github.com/NixOS/nixpkgs/issues/69338) 
-      # and readd steamos-polkit-helpers
+      steamos-polkit-helpers
     ];
     extraProfile = (args.extraProfile or "") + ''
       export PATH=${jovian-stubs}/bin:$PATH