jail

#!/usr/bin/env -S unshare -rm --map-auto sh

# Copyright (C) 2022, Sol Boucher
#
# This program is free software: you can redistribute it and/or modify it under the terms of the GNU
# Lesser General Public License as published by the Free Software Foundation, version 3.
#
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License along with this program.
# If not, see <https://www.gnu.org/licenses/>. 

if [ "$#" -eq "0" ]
then
	cat <<-tac
		USAGE: $0 <mountpoint> [cmdline]...

		Enters a container at <mountpoint>---which can be an empty/nonexistent directory or
		a template root "filesystem" (in which case it will be write protected)---and
		executes the specified [cmdline] if provided (or otherwise spawns an instance of the
		current shell).

		Note that while most resources are isolated from the rest of the system, notable
		exceptions include interprocess communication, networking, and the abstract sockets
		namespace.  The container is intended for use on a headless system, since otherwise
		its contents could break out via the X Window System.

		Once a directory tree has been write protected by this command, one must manually
		reverse this operation in order to remove it.  This can be done via the accompanying
		unprotect script.
	tac
	exit 1
fi

dir="$1"
shift
[ -e "$dir" ] || mkdir "$dir"
if [ -n "`ls "$dir"`" ]
then
	# Workaround so mount -M will not be a no-op.
	mount -B "$dir" "$dir"

	[ -e "$dir/home" ] || chown -R nobody: "$dir"
	nonempty="true"
else
	mount -t tmpfs none "$dir"
	nonempty="false"
fi
cd "$dir"

ln -sf lib/x86_64-linux-gnu lib64
if [ -d bin ]
then
	ln -sf ../usr/bin/sh bin
	ln -sf "../usr/bin/`basename "$SHELL"`" bin
else
	ln -sf usr/bin .
fi

mkdir -p dev
mkdir -p etc
mkdir -p lib
mkdir -p proc
mkdir -p usr
mount -R /dev dev
mount -Bo ro /etc etc
mount -Bo ro /lib lib
mount -R /proc proc
mount -Bo ro,nosuid /usr usr

mkdir -p home/nobody
mkdir -p tmp
mount -t tmpfs none home/nobody
mount -t tmpfs none tmp
cp -r etc/skel/. home/nobody

if "$nonempty"
then
	chown nobody: home
else
	mount -o remount,ro none .
fi

# Allow unshare within unshare -R.
mount -M . / 2>/dev/null

exec env -i HOME=/home/nobody PATH="$PATH" SHELL="$SHELL" TERM="$TERM" unshare -R. unshare -Upf --mount-proc --kill-child "$@"