aboutsummaryrefslogtreecommitdiff
path: root/systems/eldiron/pub/restrict
diff options
context:
space:
mode:
Diffstat (limited to 'systems/eldiron/pub/restrict')
-rw-r--r--systems/eldiron/pub/restrict71
1 files changed, 71 insertions, 0 deletions
diff --git a/systems/eldiron/pub/restrict b/systems/eldiron/pub/restrict
new file mode 100644
index 0000000..698e394
--- /dev/null
+++ b/systems/eldiron/pub/restrict
@@ -0,0 +1,71 @@
1#!/usr/bin/env bash
2user="$1"
3rootuser="$HOME/$user/"
4mkdir -p $rootuser
5
6orig="$SSH_ORIGINAL_COMMAND"
7if [ -z "$orig" ]; then
8 orig="/bin/bash -l"
9fi
10if [ "${orig:0:7}" = "command" ]; then
11 orig="${orig:8}"
12fi
13
14case "$orig" in
15rsync*)
16 rrsync $HOME/$user/
17 ;;
18*)
19 nix_store_paths() {
20 nix-store -q -R \
21 /run/current-system/sw \
22 /etc/profiles/per-user/pub \
23 /etc/ssl/certs/ca-bundle.crt \
24 | while read i; do
25 printf '%s--ro-bind\0'$i'\0'$i'\0' ''
26 done
27 if [ -e "/run/current-system/pub/$user" ]; then
28 nix-store -q -R "/run/current-system/pub/$user" \
29 | while read i; do
30 printf '%s--ro-bind\0'$i'\0'$i'\0' ''
31 done
32 printf '%s--ro-bind\0/run/current-system/pub/'$user'/bin\0/bin-pub-'$user'\0' ''
33 fi
34 }
35
36 set -euo pipefail
37 (exec -c bwrap --ro-bind /usr /usr \
38 --args 10 \
39 --dir /tmp \
40 --dir /var \
41 --symlink ../tmp var/tmp \
42 --proc /proc \
43 --dev /dev \
44 --ro-bind /etc/resolv.conf /etc/resolv.conf \
45 --ro-bind /etc/zoneinfo /etc/zoneinfo \
46 --ro-bind /etc/ssl /etc/ssl \
47 --ro-bind /etc/static/ssl/certs /etc/static/ssl/certs \
48 --ro-bind /run/current-system/sw/lib/locale/locale-archive /etc/locale-archive \
49 --ro-bind /run/current-system/sw/bin /bin \
50 --ro-bind /etc/profiles/per-user/pub/bin /bin-pub \
51 --bind /var/lib/pub/$user /var/lib/pub \
52 --dir /var/lib/commons \
53 --ro-bind $TMUX_RESTRICT /var/lib/commons/tmux.restrict.conf \
54 --chdir /var/lib/pub \
55 --unshare-all \
56 --share-net \
57 --dir /run/user/$(id -u) \
58 --setenv TERM "$TERM" \
59 --setenv LOCALE_ARCHIVE "/etc/locale-archive" \
60 --setenv XDG_RUNTIME_DIR "/run/user/`id -u`" \
61 --setenv PS1 "$user@pub $ " \
62 --setenv PATH "/bin-pub-$user:/bin:/bin-pub" \
63 --setenv HOME "/var/lib/pub" \
64 --file 11 /etc/passwd \
65 --file 12 /etc/group \
66 -- $orig) \
67 10< <(nix_store_paths | sort | uniq) \
68 11< <(getent passwd $UID 65534) \
69 12< <(getent group $(id -g) 65534)
70 ;;
71esac