source: trunk/debathena/config/reactivate/debian/snapshot-run @ 24278

Revision 24278, 1.5 KB checked in by broder, 15 years ago (diff)
In reactivate: * Bind-mount /boot (read-only), but not /home. (Trac: #314) * Deter people from thinking that /home will persist by getting rid of it in the chroot.
  • Property svn:executable set to *
Line 
1#!/bin/sh
2#
3# snapshot-run PROGRAM [ARGS]
4# Create an Athena login snapshot, run PROGRAM within it, and clean up
5# the snapshot.
6#
7# This script is run as the user who is logging in, usually as a wrapper
8# around their Xsession or shell. You probably want to run reactivate
9# immediately afterwards, as root.
10
11set -e
12cd /
13
14addgroups="admin lpadmin adm fuse cdrom floppy audio video plugdev scanner dialout"
15daemons="$(/usr/sbin/policy-rc.d --daemons)"
16
17# Setup
18
19session=$(schroot -c login -b)
20sch() { schroot -r -c "$session" -- "$@"; }          # Run in the chroot
21schq() { schroot -q -r -c "$session" -- "$@"; }      # Run in the chroot quietly
22schr() { schroot -r -c "$session" -u root -- "$@"; } # Run in the chroot as root
23
24for group in $addgroups; do
25    schr getent group "$group" >/dev/null 2>&1 && schr adduser "$USER" "$group"
26done
27
28schr sed -i "/su-error/d" "/etc/pam.d/su.debathena"
29
30schr touch /ClusterLogin
31
32for daemon in $daemons; do
33    schr invoke-rc.d "$daemon" start || [ $? = 100 ]
34done
35
36schr rm /etc/debian_chroot
37
38# Deter people from thinking they can use /home as persistant storage
39# by punting it
40schr rm -rf /home
41
42# Run the session
43#
44# We wrap the target command in sudo because it runs initgroups(3)
45# /after/ being chrooted, which puts users back in the groups we
46# added them to
47
48set +e
49
50cd
51schroot -c "$session" -r -p -- sudo -E -u "$USER" -- "$@"
52cd /
53
54# Teardown
55
56for daemon in $daemons; do
57    schr invoke-rc.d "$daemon" stop || [ $? = 100 ]
58done
59
60schroot -c "$session" -e
Note: See TracBrowser for help on using the repository browser.