]>
git.immae.eu Git - perso/Immae/Config/Nix.git/blob - restrict
6d80590487417f88e83254e54cdb3d5b7b9f7c90
3 rootuser
="$HOME/$user/"
6 orig
="$SSH_ORIGINAL_COMMAND"
7 if [ -z "$orig" ]; then
10 if [ "${orig:0:7}" = "command" ]; then
21 /run
/current
-system/sw \
22 /etc
/profiles
/per
-user/pub \
24 printf '%s--bind\0'$i'\0'$i'\0' ''
29 (exec -c bwrap
--ro-bind /usr
/usr \
33 --symlink ..
/tmp var
/tmp \
36 --ro-bind /etc
/resolv.conf
/etc
/resolv.conf \
37 --ro-bind /etc
/zoneinfo
/etc
/zoneinfo \
38 --ro-bind /run
/current
-system/sw
/lib
/locale
/locale
-archive /etc
/locale
-archive \
39 --ro-bind /run
/current
-system/sw
/bin
/bin \
40 --ro-bind /etc
/profiles
/per
-user/pub
/bin
/bin
-pub \
41 --bind /var
/lib
/pub
/$user /var
/lib
/pub \
42 --ro-bind $TMUX_RESTRICT /var
/lib
/pub
/.tmux.restrict.conf \
43 --chdir /var
/lib
/pub \
46 --dir /run
/user
/$(id -u) \
47 --setenv TERM
"$TERM" \
48 --setenv LOCALE_ARCHIVE
"/etc/locale-archive" \
49 --setenv XDG_RUNTIME_DIR
"/run/user/`id -u`" \
50 --setenv PS1
"$user@pub $ " \
51 --setenv PATH
"/bin:/bin-pub" \
52 --setenv HOME
"/var/lib/pub" \
53 --file 11 /etc
/passwd \
54 --file 12 /etc
/group \
56 10< <(nix_store_paths
) \
57 11< <(getent passwd
$UID 65534) \
58 12< <(getent group
$(id -g) 65534)