summaryrefslogtreecommitdiffstats
path: root/bin
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@open-infrastructure.net>2017-06-29 05:35:49 +0000
committerDaniel Baumann <daniel.baumann@open-infrastructure.net>2017-06-29 06:24:47 +0000
commit4b113ae6dd56280db044f35e3cf92efddd96b656 (patch)
tree1e7ea22f927960b16552423d45371ae96915d99d /bin
parentAdding CONTAINER_COMMANDS_ENABLE variable for container-shell to add support ... (diff)
downloadcompute-tools-4b113ae6dd56280db044f35e3cf92efddd96b656.tar.xz
compute-tools-4b113ae6dd56280db044f35e3cf92efddd96b656.zip
Adding CONTAINER_COMMANDS_DISABLE variable for container-shell to add support for disallowing certain container commands for a specific container-shell invocation only.
Use case: Disallow some people (via their SSH key) some specific container commands, e.g. container remove. Signed-off-by: Daniel Baumann <daniel.baumann@open-infrastructure.net>
Diffstat (limited to '')
-rwxr-xr-xbin/container-shell21
1 files changed, 21 insertions, 0 deletions
diff --git a/bin/container-shell b/bin/container-shell
index c27a0e3..38a9ab9 100755
--- a/bin/container-shell
+++ b/bin/container-shell
@@ -111,6 +111,27 @@ Shell ()
esac
fi
+ if [ -n "${CONTAINER_COMMANDS_DISABLE}" ]
+ then
+ COMMAND_DISALLOWED=""
+
+ for CONTAINER_COMMAND in ${CONTAINER_COMMANDS_DISABLE}
+ do
+ case "${CONTAINER_COMMAND}" in
+ ${COMMAND}|all|about|logout|exit|help)
+ COMMAND_DISALLOWED="true"
+ ;;
+ esac
+ done
+
+ case "${COMMAND_DISALLOWED}" in
+ true)
+ echo "'${COMMAND}': command not allowed for current user" >&2
+ return
+ ;;
+ esac
+ fi
+
echo
sudo ${PROGRAM} ${COMMAND} ${OPTIONS} || true
}