31 lines
1.3 KiB
Bash
31 lines
1.3 KiB
Bash
#!/bin/sh
|
|
# One-time DSM administrator action, run with sudo; does not restart any service.
|
|
set -eu
|
|
test "$(id -u)" = 0 || { echo 'Run this setup with sudo' >&2; exit 1; }
|
|
account=${1:?Supply deployment account}
|
|
docker=${2:?Supply absolute Docker executable}
|
|
case "$account" in ''|*[!a-zA-Z0-9_-]*) exit 1;; esac
|
|
case "$docker" in /*) ;; *) exit 1;; esac
|
|
target=/etc/sudoers.d/"$account"
|
|
rule="$account ALL=(root) NOPASSWD: $docker"
|
|
test -x "$docker" && id "$account" >/dev/null
|
|
test -d /etc/sudoers.d || { echo 'Missing sudoers.d; no changes made' >&2; exit 1; }
|
|
if [ -e "$target" ]; then
|
|
test "$(cat "$target")" = "$rule" || { echo 'Existing sudoers entry differs; no changes made' >&2; exit 1; }
|
|
else
|
|
umask 077
|
|
temporary=$(mktemp /etc/sudoers.d/"$account".XXXXXX)
|
|
trap 'rm -f "$temporary"' EXIT
|
|
printf '%s\n' "$rule" > "$temporary"
|
|
chmod 440 "$temporary"
|
|
if command -v visudo >/dev/null 2>&1; then visudo -cf "$temporary"; fi
|
|
# A dot in the temporary name keeps sudo from loading the uncommitted file.
|
|
mv "$temporary" "$target"
|
|
if ! sudo -n -u "$account" sudo -n "$docker" info --format '{{.OSType}}/{{.Architecture}}'; then
|
|
rm "$target"
|
|
echo 'Docker permission check failed; new sudoers entry removed' >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
echo 'Dedicated Docker sudo permission is configured; no services were restarted.'
|