aboutsummaryrefslogtreecommitdiff
path: root/nixops/modules/pub/restrict
blob: 4a3e2152c3162e0817a8539aacea196b16c287b8 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
#!/usr/bin/env bash
user="$1"
rootuser="$HOME/$user/"
mkdir -p $rootuser
mkdir -p $HOME/$user-nixstore

orig="$SSH_ORIGINAL_COMMAND"
if [ -z "$orig" ]; then
  orig="/bin/bash -l"
fi
if [ "${orig:0:7}" = "command" ]; then
  orig="${orig:8}"
fi

case "$orig" in
rsync*)
        rrsync $HOME/$user/
        ;;
*)
        nix_store_paths() {
          nix-store -q -R \
               /run/current-system/sw \
               /etc/profiles/per-user/pub \
               /etc/ssl/certs/ca-bundle.crt \
               | while read i; do
            printf '%s--ro-bind\0'$i'\0'$i'\0' ''
          done
        }

        set -euo pipefail
        (exec -c bwrap --ro-bind /usr /usr \
              --bind /var/lib/pub/$user-nixstore /nix \
              --args 10 \
              --dir /tmp \
              --dir /var \
              --symlink ../tmp var/tmp \
              --proc /proc \
              --dev /dev \
              --ro-bind /etc/resolv.conf /etc/resolv.conf \
              --ro-bind /etc/zoneinfo /etc/zoneinfo \
              --ro-bind /etc/ssl /etc/ssl \
              --ro-bind /etc/static/ssl/certs /etc/static/ssl/certs \
              --ro-bind /run/current-system/sw/lib/locale/locale-archive /etc/locale-archive \
              --ro-bind /run/current-system/sw/bin /bin \
              --ro-bind /etc/profiles/per-user/pub/bin /bin-pub \
              --bind /var/lib/pub/$user /var/lib/pub \
              --ro-bind $TMUX_RESTRICT /var/lib/pub/.tmux.restrict.conf \
              --chdir /var/lib/pub \
              --unshare-all \
              --share-net \
              --dir /run/user/$(id -u) \
              --setenv TERM "$TERM" \
              --setenv LOCALE_ARCHIVE "/etc/locale-archive" \
              --setenv XDG_RUNTIME_DIR "/run/user/`id -u`" \
              --setenv PS1 "$user@pub $ " \
              --setenv PATH "/bin:/bin-pub" \
              --setenv HOME "/var/lib/pub" \
              --file 11 /etc/passwd \
              --file 12 /etc/group \
              -- $orig) \
              10< <(nix_store_paths) \
              11< <(getent passwd $UID 65534) \
              12< <(getent group $(id -g) 65534)
        ;;
esac