Jail the control-panel terminal to the customer's home (chroot)

SECURITY: the browser terminal ran an unconfined login shell as the account's
system user, so customers could browse the whole host (/var/www, other tenants,
/etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher
(/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts
ONLY that user's home into /home/jail, and chroots as the user. They can no
longer see anything outside their own home. Provisioning committed in
deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deployment/ladill-jailsh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# Ladill jailed shell for the hosting browser terminal. Confines a hosting
+# account to /home/jail with only its own home bind-mounted (private mount ns).
+# Usage: ladill-jailsh <username> [relpath]
+set -euo pipefail
+JAIL=/home/jail
+U=${1:-}
+REL=${2:-/public_html}
+[ -n "$U" ] || { echo 'usage: ladill-jailsh <user> [relpath]'; exit 2; }
+# resolve + validate the target user (must be a real hosting account)
+UID_=$(id -u "$U" 2>/dev/null || true)
+GID_=$(id -g "$U" 2>/dev/null || true)
+[ -n "$UID_" ] && [ "$UID_" -ge 1000 ] || { echo 'refusing: not a hosting user'; exit 1; }
+HOMEDIR=/home/$U
+[ -d "$HOMEDIR" ] || { echo 'no home directory'; exit 1; }
+case "$REL" in *..*) REL=/public_html;; esac
+mkdir -p "$JAIL/home/$U"
+# re-exec into a private mount namespace so the bind is per-session
+if [ -z "${LADILL_JAIL_NS:-}" ]; then
+  exec env LADILL_JAIL_NS=1 unshare --mount --propagation private -- "$0" "$U" "$REL"
+fi
+mount --bind "$HOMEDIR" "$JAIL/home/$U"
+export HOME="/home/$U" USER="$U" LOGNAME="$U" SHELL=/bin/bash PATH=/usr/bin:/bin
+export TERM="${TERM:-xterm-256color}"
+exec /usr/sbin/chroot --userspec="$UID_:$GID_" "$JAIL" /bin/bash -l -c "cd '/home/$U$REL' 2>/dev/null || cd ~; exec /bin/bash -l"