blob: 09f2960bd8cc5618b6077b20ac32c30d9cdc36d3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
#!/bin/rc
# fw.rc - run a command behind a firewall of its own.
#
# fw.rc rules.ndb cmd [arg ...]
#
# Order matters. The namespace is made private first, the firewall is
# mounted second, and the devices are dropped last: once dropped they
# cannot be regained by this process or any child, so fw has to
# already be serving by then.
#
# The devices dropped are the ones that reach a network without going
# through /net:
# I the IP stack itself - bind -a '#I' /net undoes everything
# l ethernet
# u usb, which can carry an ether device
# σ shr, where nusb publishes usbnet
# Relax that set only if you know the machine has no other way out.
rfork ne
if(~ $#* 0 1){
echo usage: fw.rc rules.ndb cmd [arg ...] >[1=2]
exit usage
}
rules=$1
shift
fw $rules || exit 'fw failed'
echo chdev '&~' 'Iluσ' >/dev/drivers || exit 'cannot drop devices'
exec $*
|
