From 4b113ae6dd56280db044f35e3cf92efddd96b656 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Thu, 29 Jun 2017 07:35:49 +0200 Subject: Adding CONTAINER_COMMANDS_DISABLE variable for container-shell to add support for disallowing certain container commands for a specific container-shell invocation only. Use case: Disallow some people (via their SSH key) some specific container commands, e.g. container remove. Signed-off-by: Daniel Baumann --- bin/container-shell | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'bin/container-shell') diff --git a/bin/container-shell b/bin/container-shell index c27a0e3..38a9ab9 100755 --- a/bin/container-shell +++ b/bin/container-shell @@ -111,6 +111,27 @@ Shell () esac fi + if [ -n "${CONTAINER_COMMANDS_DISABLE}" ] + then + COMMAND_DISALLOWED="" + + for CONTAINER_COMMAND in ${CONTAINER_COMMANDS_DISABLE} + do + case "${CONTAINER_COMMAND}" in + ${COMMAND}|all|about|logout|exit|help) + COMMAND_DISALLOWED="true" + ;; + esac + done + + case "${COMMAND_DISALLOWED}" in + true) + echo "'${COMMAND}': command not allowed for current user" >&2 + return + ;; + esac + fi + echo sudo ${PROGRAM} ${COMMAND} ${OPTIONS} || true } -- cgit v1.2.3