From 5e11c6318c14d737036e7dc7bda55fe5a1f09ba0 Mon Sep 17 00:00:00 2001
From: brent s <r00t@square-r00t.net>
Date: Thu, 15 Aug 2019 08:32:51 -0400
Subject: [PATCH] fixing some minor weirdness

---
 tools/add-borguser.py    | 17 +++++++++++++++--
 tools/borg-restricted.py | 18 +++++++++++++-----
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/tools/add-borguser.py b/tools/add-borguser.py
index 4e6aa50..86e4cb7 100755
--- a/tools/add-borguser.py
+++ b/tools/add-borguser.py
@@ -52,8 +52,9 @@ class UserAdder(object):
 
     def addKey(self, ssh_key, *args, **kwargs):
         key_template = ('command='
-                            '"cd {homedir};'
-                            'borg serve --restrict-to-path {homedir}",'
+                            #'"cd {homedir};'
+                            #'borg serve --restrict-to-path {homedir}",'
+                            '"/usr/local/bin/borg-restricted.py ${SSH_ORIGINAL_COMMAND}"',
                         'no-port-forwarding,'
                         'no-X11-forwarding,'
                         'no-pty,'
@@ -63,11 +64,23 @@ class UserAdder(object):
         for u, kp in self.users.items():
             userent = pwd.getpwnam(u)
             homedir = userent.pw_dir
+            sshdir = os.path.join(homedir, '.ssh')
             key_insert = key_template.format(user = u,
                                              homedir = homedir,
                                              keystr = ssh_key)
             with open(kp, 'a') as f:
                 f.write(key_insert)
+            # When CentOS/RHEL move to python3 native, and port policycoreutils, do this natively.
+            # But for now...
+            subprocess.run(['chcon',
+                            '-R unconfined_u:object_r:user_home_t:s0',
+                            sshdir])
+            subprocess.run(['semanage',
+                            'fcontext',
+                            '-a',
+                                '-t',
+                                    'ssh_home_t',
+                            sshdir])
         return()
 
     def clean(self):
diff --git a/tools/borg-restricted.py b/tools/borg-restricted.py
index 63c6ea4..b139f17 100755
--- a/tools/borg-restricted.py
+++ b/tools/borg-restricted.py
@@ -3,15 +3,23 @@
 import os
 import pwd
 import subprocess
+import sys
 
 
+# You can optionally add logging, etc. to log attempts that fail to verify the command enforcement,
+# client IPs, etc. via environment variables, etc.
+
 cur_user = os.geteuid()
 homedir = pwd.getpwuid(cur_user).pw_dir
+os.chdir(homedir)
 
-borg_bin = '/usr/bin/borg'
+orig_cmd = sys.argv[1:]
+if orig_cmd.pop(0) != 'borg':
+    raise PermissionError('That command is not allowed')
+if orig_cmd.pop(0) != 'serve':
+    raise PermissionError('That command is not allowed')
+new_cmd = ['borg', 'serve', '--restrict-to-path', homedir]
+new_cmd.extend(orig_cmd)
 
 os.chdir(homedir)
-subprocess.run([borg_bin,
-                'serve',
-                '--restrict-to-path',
-                homedir])
\ No newline at end of file
+subprocess.run(new_cmd)