From 8ae7e6a4292723d1996656c51b23236161f7bf01 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@open-infrastructure.net>
Date: Thu, 29 Jun 2017 07:35:49 +0200
Subject: Adding CONTAINER_COMMANDS_DISABLE variable for container-shell to add
 support for disallowing certain container commands for a specific
 container-shell invocation only.

Use case: Disallow some people (via their SSH key) some specific
container commands, e.g. container remove.

Signed-off-by: Daniel Baumann <daniel.baumann@open-infrastructure.net>
---
 bin/container-shell | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

(limited to 'bin')

diff --git a/bin/container-shell b/bin/container-shell
index c27a0e3..38a9ab9 100755
--- a/bin/container-shell
+++ b/bin/container-shell
@@ -111,6 +111,27 @@ Shell ()
 		esac
 	fi
 
+	if [ -n "${CONTAINER_COMMANDS_DISABLE}" ]
+	then
+		COMMAND_DISALLOWED=""
+
+		for CONTAINER_COMMAND in ${CONTAINER_COMMANDS_DISABLE}
+		do
+			case "${CONTAINER_COMMAND}" in
+				${COMMAND}|all|about|logout|exit|help)
+						COMMAND_DISALLOWED="true"
+						;;
+			esac
+		done
+
+		case "${COMMAND_DISALLOWED}" in
+			true)
+				echo "'${COMMAND}': command not allowed for current user" >&2
+				return
+				;;
+		esac
+	fi
+
 	echo
 	sudo ${PROGRAM} ${COMMAND} ${OPTIONS} || true
 }
-- 
cgit v1.2.3