#!/bin/rc
# fw.rc - run a command behind a firewall of its own.
#
#	fw.rc rules.ndb cmd [arg ...]
#
# Order matters.  The namespace is made private first, the firewall is
# mounted second, and the devices are dropped last: once dropped they
# cannot be regained by this process or any child, so fw has to
# already be serving by then.
#
# The devices dropped are the ones that reach a network without going
# through /net:
#	I	the IP stack itself - bind -a '#I' /net undoes everything
#	l	ethernet
#	u	usb, which can carry an ether device
#	σ	shr, where nusb publishes usbnet
# Relax that set only if you know the machine has no other way out.
rfork ne
if(~ $#* 0 1){
	echo usage: fw.rc rules.ndb cmd [arg ...] >[1=2]
	exit usage
}
rules=$1
shift
fw $rules || exit 'fw failed'
echo chdev '&~' 'Iluσ' >/dev/drivers || exit 'cannot drop devices'
exec $*