3 Commits

Include renames

Author	SHA1	Message	Date
isaaccladandClaude Opus 4.8	75ba450938	Terminal: show the live full working-directory path in the toolbar ... The toolbar showed a static ~/public_html. The jailed shell now reports its cwd via OSC 7 each prompt (jail rcfile keeps the user's prompt + emits it); xterm captures it and the toolbar shows the full path (/home/<user>/...), updating as the user cd's. Launcher/rcfile committed in deployment/ for reproducibility. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 07:53:48 +00:00
isaaccladandClaude Opus 4.8	d54ae879b6	Jailed terminal: per-session passwd so customers can't enumerate tenants ... The jail's /etc/passwd listed every hosting username (no passwords — shadow isn't in the jail — but it enumerated tenants). The launcher now binds a per-session /etc/passwd|group (root + the current user only) inside each session's mount namespace, and the shared jail passwd no longer carries hosting users. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 07:22:47 +00:00
isaaccladandClaude Opus 4.8	2a1228b40e	Jail the control-panel terminal to the customer's home (chroot) ... SECURITY: the browser terminal ran an unconfined login shell as the account's system user, so customers could browse the whole host (/var/www, other tenants, /etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher (/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts ONLY that user's home into /home/jail, and chroots as the user. They can no longer see anything outside their own home. Provisioning committed in deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 23:41:18 +00:00