30 lines
1.2 KiB
Bash
30 lines
1.2 KiB
Bash
|
#!/bin/bash
|
||
|
|
# Per-session entry point spawned by webterm-server for every websocket
|
||
|
|
# connection. When the server runs as root (the k8s deployment grants only
|
||
|
|
# CAP_SETUID/CAP_SETGID for exactly this), the session is dropped to the
|
||
|
|
# unprivileged `demo` user before the restricted shell starts. That makes the
|
||
|
|
# separation kernel-enforced: whatever a visitor manages to run, signals aimed
|
||
|
|
# at webterm-server, the socktop agent, or another user's processes fail with
|
||
|
|
# EPERM instead of relying on UI gating inside socktop.
|
||
|
|
#
|
||
|
|
# SOCKTOP_NO_KILL (set at the deployment level) rides through the environment
|
||
|
|
# untouched — setpriv does not reset the environment.
|
||
|
|
|
||
|
|
if [ "$(id -u)" -eq 0 ]; then
|
||
|
|
export HOME=/home/demo
|
||
|
|
export USER=demo
|
||
|
|
export LOGNAME=demo
|
||
|
|
exec setpriv \
|
||
|
|
--reuid demo \
|
||
|
|
--regid demo \
|
||
|
|
--clear-groups \
|
||
|
|
--inh-caps -all \
|
||
|
|
--no-new-privs \
|
||
|
|
/usr/local/bin/restricted-shell.sh
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Not root (compose/dev, or someone running the image unprivileged): no way to
|
||
|
|
# switch UID, run the restricted shell directly. The --no-kill flag and the
|
||
|
|
# SOCKTOP_NO_KILL environment variable still apply.
|
||
|
|
exec /usr/local/bin/restricted-shell.sh
|