From c540beba183ee7c6afed754c040d3e7837cafed3 Mon Sep 17 00:00:00 2001 From: jasonwitty Date: Mon, 24 Aug 2026 07:33:11 -0700 Subject: [PATCH] update restricted shell to force (--no-kill) option. --- docker/session-shell.sh | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 docker/session-shell.sh diff --git a/docker/session-shell.sh b/docker/session-shell.sh new file mode 100644 index 0000000..321b81c --- /dev/null +++ b/docker/session-shell.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# Per-session entry point spawned by webterm-server for every websocket +# connection. When the server runs as root (the k8s deployment grants only +# CAP_SETUID/CAP_SETGID for exactly this), the session is dropped to the +# unprivileged `demo` user before the restricted shell starts. That makes the +# separation kernel-enforced: whatever a visitor manages to run, signals aimed +# at webterm-server, the socktop agent, or another user's processes fail with +# EPERM instead of relying on UI gating inside socktop. +# +# SOCKTOP_NO_KILL (set at the deployment level) rides through the environment +# untouched — setpriv does not reset the environment. + +if [ "$(id -u)" -eq 0 ]; then + export HOME=/home/demo + export USER=demo + export LOGNAME=demo + exec setpriv \ + --reuid demo \ + --regid demo \ + --clear-groups \ + --inh-caps -all \ + --no-new-privs \ + /usr/local/bin/restricted-shell.sh +fi + +# Not root (compose/dev, or someone running the image unprivileged): no way to +# switch UID, run the restricted shell directly. The --no-kill flag and the +# SOCKTOP_NO_KILL environment variable still apply. +exec /usr/local/bin/restricted-shell.sh