Adding CONTAINER_COMMANDS_DISABLE variable for container-shell to add support for disallowing certain container commands for a specific container-shell invocation only.

Use case: Disallow some people (via their SSH key) some specific
container commands, e.g. container remove.

Signed-off-by: Daniel Baumann <daniel.baumann@open-infrastructure.net>

1 files changed, 21 insertions, 0 deletions

diff --git a/bin/container-shell b/bin/container-shell
index c27a0e3..38a9ab9 100755
--- a/bin/container-shell
+++ b/bin/container-shell
@@ -111,6 +111,27 @@ Shell ()
 		esac
 	fi
 
+	if [ -n "${CONTAINER_COMMANDS_DISABLE}" ]
+	then
+		COMMAND_DISALLOWED=""
+
+		for CONTAINER_COMMAND in ${CONTAINER_COMMANDS_DISABLE}
+		do
+			case "${CONTAINER_COMMAND}" in
+				${COMMAND}|all|about|logout|exit|help)
+						COMMAND_DISALLOWED="true"
+						;;
+			esac
+		done
+
+		case "${COMMAND_DISALLOWED}" in
+			true)
+				echo "'${COMMAND}': command not allowed for current user" >&2
+				return
+				;;
+		esac
+	fi
+
 	echo
 	sudo ${PROGRAM} ${COMMAND} ${OPTIONS} || true
 }