finance-root-wrapper

#!/bin/bash
#
# (C) 2018 Stefan Schallenberg
#
# Root wrapper
# correct ownership of files and call
# finance-entrypoint as restricted user.

set -euo pipefail
[ "${DEBUG-}" == "1" ] && set -x

printf "Setting permissions of /finance\n"
# change all files ownership to finance:finance
# use find instead of chown -R avoids touching all files. This is especially
# useful for backups
find /finance -! -user finance -exec chown finance {} ";"
find /finance -! -group finance -exec chown :finance {} ";"

# set permission to rr- of /finance/.hbci-pinfile
find /finance -maxdepth 1 -name .hbci-pinfile -perm /o=rwx -exec chmod o-rwx {} ";"
find /finance -maxdepth 1 -name .hbci-pinfile -perm /g=wx -exec chmod g-wx {} ";"
find /finance -maxdepth 1 -name .hbci-pinfile -perm /u=wx -exec chmod u-wx {} ";"

printf "Switching to restricted user finance\n"
cd /finance

su -s /bin/bash finance -- /usr/local/bin/finance-entrypoint "$@"