]>
git.immae.eu Git - perso/Immae/Config/Nix.git/blob - nixops/modules/pub/restrict
3 rootuser
="$HOME/$user/"
5 mkdir -p $HOME/$user-nixstore
7 orig
="$SSH_ORIGINAL_COMMAND"
8 if [ -z "$orig" ]; then
11 if [ "${orig:0:7}" = "command" ]; then
22 /run
/current
-system/sw \
23 /etc
/profiles
/per
-user/pub \
24 /etc
/ssl
/certs
/ca
-bundle.crt \
26 printf '%s--ro-bind\0'$i'\0'$i'\0' ''
31 (exec -c bwrap
--ro-bind /usr
/usr \
32 --bind /var
/lib
/pub
/$user-nixstore /nix \
36 --symlink ..
/tmp var
/tmp \
39 --ro-bind /etc
/resolv.conf
/etc
/resolv.conf \
40 --ro-bind /etc
/zoneinfo
/etc
/zoneinfo \
41 --ro-bind /etc
/ssl
/etc
/ssl \
42 --ro-bind /etc
/static
/ssl
/certs
/etc
/static
/ssl
/certs \
43 --ro-bind /run
/current
-system/sw
/lib
/locale
/locale
-archive /etc
/locale
-archive \
44 --ro-bind /run
/current
-system/sw
/bin
/bin \
45 --ro-bind /etc
/profiles
/per
-user/pub
/bin
/bin
-pub \
46 --bind /var
/lib
/pub
/$user /var
/lib
/pub \
47 --ro-bind $TMUX_RESTRICT /var
/lib
/pub
/.tmux.restrict.conf \
48 --chdir /var
/lib
/pub \
51 --dir /run
/user
/$(id -u) \
52 --setenv TERM
"$TERM" \
53 --setenv LOCALE_ARCHIVE
"/etc/locale-archive" \
54 --setenv XDG_RUNTIME_DIR
"/run/user/`id -u`" \
55 --setenv PS1
"$user@pub $ " \
56 --setenv PATH
"/bin:/bin-pub" \
57 --setenv HOME
"/var/lib/pub" \
58 --file 11 /etc
/passwd \
59 --file 12 /etc
/group \
61 10< <(nix_store_paths
) \
62 11< <(getent passwd
$UID 65534) \
63 12< <(getent group
$(id -g) 65534)