#!/bin/bash
# Per-session entry point spawned by webterm-server for every websocket
# connection. When the server runs as root (the k8s deployment grants only
# CAP_SETUID/CAP_SETGID for exactly this), the session is dropped to the
# unprivileged `demo` user before the restricted shell starts. That makes the
# separation kernel-enforced: whatever a visitor manages to run, signals aimed
# at webterm-server, the socktop agent, or another user's processes fail with
# EPERM instead of relying on UI gating inside socktop.
#
# SOCKTOP_NO_KILL (set at the deployment level) rides through the environment
# untouched — setpriv does not reset the environment.

if [ "$(id -u)" -eq 0 ]; then
    export HOME=/home/demo
    export USER=demo
    export LOGNAME=demo
    exec setpriv \
        --reuid demo \
        --regid demo \
        --clear-groups \
        --inh-caps -all \
        --no-new-privs \
        /usr/local/bin/restricted-shell.sh
fi

# Not root (compose/dev, or someone running the image unprivileged): no way to
# switch UID, run the restricted shell directly. The --no-kill flag and the
# SOCKTOP_NO_KILL environment variable still apply.
exec /usr/local/bin/restricted-shell.sh