Fix hostkey being too short

Modern versions of ssh refuse to connect to a server with a rsa key that
  is less than 2048 and this may change to 3072 or 4096 in the future.
  ed25519 cannot change keysize

README.md

@@ -97,7 +97,7 @@ busybox: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically li
 for GNU/Linux 3.7.0, BuildID[sha1]=c9e20e9849ed0ca3c2bd058427ac31a27c008efe, stripped
 $ ln -s busybox sh
 $ tar cf breakglass.tar --dereference sh
-$ breakglass -debug_tarball_pattern=debug.tar gokrazy
+$ breakglass -debug_tarball_pattern=breakglass.tar gokrazy
 /tmp/breakglass564067692 # df -h
 Filesystem                Size      Used Available Use% Mounted on
 /dev/root                60.5M     60.5M         0 100% /

breakglass.go

@@ -10,14 +10,12 @@ import (
 	"crypto/rand"
 	"crypto/x509"
 	"encoding/pem"
-	"errors"
 	"flag"
 	"fmt"
 	"io/ioutil"
 	"log"
 	"net"
 	"os"
-	"path"
 	"strings"
 	"syscall"
 
@@ -33,10 +31,6 @@ var (
 		"/perm/breakglass.authorized_keys",
 		"path to an OpenSSH authorized_keys file; if the value is 'ec2', fetch the SSH key(s) from the AWS IMDSv2 metadata")
 
-	authorizedUserCAPath = flag.String("authorized_ca",
-		"/perm/breakglass.authorized_user_ca",
-		"path to an OpenSSH TrustedUserCAKeys file; note the certificate must list ':gokrazy:' as a valid principal")
-
 	hostKeyPath = flag.String("host_key",
 		"/perm/breakglass.host_key",
 		"path to a PEM-encoded RSA, DSA or ECDSA private key (create using e.g. ssh-keygen -f /perm/breakglass.host_key -N '' -t rsa)")
@@ -52,9 +46,6 @@ var (
 	forwarding = flag.String("forward",
 		"",
 		"allow port forwarding. Use `loopback` for loopback interfaces and `private-network` for private networks")
-
-	home  = "/perm/home"
-	shell = ""
 )
 
 func loadAuthorizedKeys(path string) (map[string]bool, error) {
@@ -90,19 +81,6 @@ func loadAuthorizedKeys(path string) (map[string]bool, error) {
 	return result, nil
 }
 
-func loadPasswd(passwd string) {
-	b, err := os.ReadFile(passwd)
-	if err != nil {
-		return
-	}
-	fields := bytes.SplitN(bytes.SplitN(b, []byte("\n"), 2)[0], []byte(":"), 7)
-	if len(fields) != 7 {
-		return
-	}
-	home = path.Clean(string(fields[5]))
-	shell = path.Clean(string(fields[6]))
-}
-
 func loadHostKey(path string) (ssh.Signer, error) {
 	b, err := ioutil.ReadFile(path)
 	if err != nil {
@@ -194,9 +172,7 @@ func main() {
 	flag.Parse()
 	log.SetFlags(log.LstdFlags | log.Lshortfile)
 
-	installBusybox()
+	gokrazy.DontStartOnBoot()
-
-	loadPasswd("/etc/passwd")
 
 	authorizedKeys, err := loadAuthorizedKeys(*authorizedKeysPath)
 	if err != nil {
@@ -206,59 +182,19 @@ func main() {
 		log.Fatal(err)
 	}
 
-	authorizedUserCertificateCA, err := loadAuthorizedKeys(strings.TrimPrefix(*authorizedUserCAPath, "ec2"))
-	if err != nil {
-		if os.IsNotExist(err) {
-			log.Printf("TrustedUserCAKeys not loaded")
-		}
-	}
-
 	if err := initMOTD(); err != nil {
 		log.Print(err)
 	}
-	certChecker := ssh.CertChecker{
+
-		IsUserAuthority: func(auth ssh.PublicKey) bool {
+	config := &ssh.ServerConfig{
-			return authorizedUserCertificateCA[string(auth.Marshal())]
+		PublicKeyCallback: func(conn ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
-		},
-		UserKeyFallback: func(conn ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
 			if authorizedKeys[string(pubKey.Marshal())] {
 				log.Printf("user %q successfully authorized from remote addr %s", conn.User(), conn.RemoteAddr())
-				return &ssh.Permissions{map[string]string{}, map[string]string{}}, nil
+				return nil, nil
 			}
 			return nil, fmt.Errorf("public key not found in %s", *authorizedKeysPath)
 		},
 	}
-	config := &ssh.ServerConfig{
-		PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
-			cert, ok := key.(*ssh.Certificate)
-			if !ok {
-				if certChecker.UserKeyFallback != nil {
-					return certChecker.UserKeyFallback(conn, key)
-				}
-				return nil, errors.New("ssh: normal key pairs not accepted")
-			}
-
-			if cert.CertType != ssh.UserCert {
-				return nil, fmt.Errorf("ssh: cert has type %d", cert.CertType)
-			}
-			if !certChecker.IsUserAuthority(cert.SignatureKey) {
-				return nil, fmt.Errorf("ssh: certificate signed by unrecognized authority")
-			}
-
-			if err := certChecker.CheckCert(":gokrazy:", cert); err != nil {
-				return nil, err
-			}
-			if cert.Permissions.CriticalOptions == nil {
-				cert.Permissions.CriticalOptions = map[string]string{}
-			}
-			if cert.Permissions.Extensions == nil {
-				cert.Permissions.Extensions = map[string]string{}
-			}
-
-			return &cert.Permissions, nil
-
-		},
-	}
 
 	signer, err := loadHostKey(*hostKeyPath)
 	if err != nil {
@@ -308,7 +244,7 @@ func main() {
 			}
 
 			go func(conn net.Conn) {
-				c, chans, reqs, err := ssh.NewServerConn(conn, config)
+				_, chans, reqs, err := ssh.NewServerConn(conn, config)
 				if err != nil {
 					log.Printf("handshake: %v", err)
 					return
@@ -318,7 +254,7 @@ func main() {
 				go ssh.DiscardRequests(reqs)
 
 				for newChannel := range chans {
-					handleChannel(newChannel, c)
+					handleChannel(newChannel)
 				}
 			}(conn)
 		}

cmd/breakglass/breakglass.go

@@ -26,7 +26,6 @@ import (
 	"github.com/gokrazy/internal/config"
 	"github.com/gokrazy/internal/httpclient"
 	"github.com/gokrazy/internal/instanceflag"
-	"github.com/gokrazy/internal/tlsflag"
 	"github.com/gokrazy/internal/updateflag"
 )
 
@@ -35,9 +34,11 @@ type bg struct {
 	cfg          *config.Struct
 	forceRestart bool
 	sshConfig    string
+	insecure     bool
 
 	// state
 	GOARCH string
+	update updateflag.Value
 }
 
 func (bg *bg) startBreakglass() error {
@@ -46,35 +47,26 @@ func (bg *bg) startBreakglass() error {
 		return err
 	}
 
-	updateHttpClient, foundMatchingCertificate, updateBaseURL, err := httpclient.For(bg.cfg)
+	updateHttpClient, _, updateBaseURL, err := httpclient.For(bg.update, bg.cfg)
 	if err != nil {
 		return err
 	}
 	updateHttpClient.Jar = jar
 
-	remoteScheme, err := httpclient.GetRemoteScheme(updateBaseURL)
-	if remoteScheme == "https" && !tlsflag.Insecure() {
-		updateBaseURL.Scheme = "https"
-		updateflag.SetUpdate(updateBaseURL.String())
-	}
-
-	if updateBaseURL.Scheme != "https" && foundMatchingCertificate {
-		fmt.Printf("\n")
-		fmt.Printf("!!!WARNING!!! Possible SSL-Stripping detected!\n")
-		fmt.Printf("Found certificate for hostname in your client configuration but the host does not offer https!\n")
-		fmt.Printf("\n")
-		if !tlsflag.Insecure() {
-			log.Fatalf("update canceled: TLS certificate found, but negotiating a TLS connection with the target failed")
-		}
-		fmt.Printf("Proceeding anyway as requested (-insecure).\n")
-	}
-
-	if err != nil {
-		return err
-	}
-
 	form, err := updateHttpClient.Get(updateBaseURL.String() + "status?path=/user/breakglass")
 	if err != nil {
+		if updateBaseURL.Scheme == "https" && bg.insecure {
+			// Try falling back to HTTP
+			bg.cfg.Update.UseTLS = "off"
+			updateHttpClient, _, updateBaseURL, err = httpclient.For(bg.update, bg.cfg)
+			if err != nil {
+				return err
+			}
+			form, err = updateHttpClient.Get(updateBaseURL.String() + "status?path=/user/breakglass")
+			if err != nil {
+				return err
+			}
+		}
 		return err
 	}
 	if form.StatusCode == http.StatusNotFound {
@@ -198,6 +190,11 @@ func breakglass() error {
 			false,
 			"prepare the SSH connection only, but do not execute SSH (useful for using breakglass within an SSH ProxyCommand)")
 
+		insecure = flag.Bool(
+			"insecure",
+			false,
+			"Fall back to HTTP if HTTPS is configured, but does not work.")
+
 		proxy = flag.Bool(
 			"proxy",
 			false,
@@ -209,13 +206,6 @@ func breakglass() error {
 			"an alternative per-user configuration file for ssh and scp")
 	)
 
-	// TODO: remove the -tls and -gokrazy_url flags after 2023-June (half a year
-	// after the introduction of instance centric config), so that we can then
-	// merge these flags into tools/internal/oldpacker and remove their global
-	// state.
-	tlsflag.RegisterFlags(flag.CommandLine)
-	updateflag.RegisterFlags(flag.CommandLine, "gokrazy_url")
-
 	flag.Usage = func() {
 		fmt.Fprintf(os.Stderr, "Usage of %s:\n\n", os.Args[0])
 
@@ -231,13 +221,6 @@ func breakglass() error {
 		log.Fatalf("syntax: breakglass <hostname> [command]")
 	}
 
-	// If the user did not explicitly specify -update=yes, we default to it.
-	// This differs from the gokr-packer, but breakglass is only useful for
-	// gokrazy instances that already exist.
-	if updateflag.NewInstallation() {
-		updateflag.SetUpdate("yes")
-	}
-
 	instance := flag.Arg(0)
 	instanceflag.SetInstance(instance)
 
@@ -255,6 +238,8 @@ func breakglass() error {
 		cfg:          cfg,
 		forceRestart: *forceRestart,
 		sshConfig:    *sshConfig,
+		insecure:     *insecure,
+		update:       updateflag.Value{Update: "yes"},
 	}
 	if cfg.Update.Hostname == "" {
 		cfg.Update.Hostname = cfg.Hostname

go.mod

@@ -1,16 +1,16 @@
 module github.com/gokrazy/breakglass
 
-go 1.24
+go 1.24.0
 
 require (
 	github.com/gokrazy/gokapi v0.0.0-20250222071133-506fdb322775
 	github.com/gokrazy/gokrazy v0.0.0-20250222061409-bd0bb5f1d0b5
-	github.com/gokrazy/internal v0.0.0-20250214203001-b1610a6e7271
+	github.com/gokrazy/internal v0.0.0-20251208203110-3c1aa9087c82
 	github.com/google/renameio/v2 v2.0.0
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/kr/pty v1.1.8
 	github.com/pkg/sftp v1.13.5
-	golang.org/x/crypto v0.35.0
+	golang.org/x/crypto v0.45.0
 )
 
 require (
@@ -19,6 +19,6 @@ require (
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mdlayher/watchdog v0.0.0-20221003142519-49be0df7b3b5 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/oauth2 v0.23.0 // indirect
+	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
 )

go.sum

@@ -7,8 +7,8 @@ github.com/gokrazy/gokapi v0.0.0-20250222071133-506fdb322775 h1:f5+2UMRRbr3+e/gd
 github.com/gokrazy/gokapi v0.0.0-20250222071133-506fdb322775/go.mod h1:q9mIV8al0wqmqFXJhKiO3SOHkL9/7Q4kIMynqUQWhgU=
 github.com/gokrazy/gokrazy v0.0.0-20250222061409-bd0bb5f1d0b5 h1:VQhDGxRliP4ZTQ8+33v4VKtOpX4VzN8pA4zBMZQSSxs=
 github.com/gokrazy/gokrazy v0.0.0-20250222061409-bd0bb5f1d0b5/go.mod h1:6fAh0J7aH6o5HWSiwN6uxNlm6Rjx1BxeNMWyNBQZ6sI=
-github.com/gokrazy/internal v0.0.0-20250214203001-b1610a6e7271 h1:CG2P/McW77phMh+iUSsGweJd4VwGhGS4UQJ92gV7Ihg=
+github.com/gokrazy/internal v0.0.0-20251208203110-3c1aa9087c82 h1:4ghNfD9NaZLpFrqQiBF6mPVFeMYXJSky38ubVA4ic2E=
-github.com/gokrazy/internal v0.0.0-20250214203001-b1610a6e7271/go.mod h1:vvnvmAv/38qDCHJ9b6Bq7yvUap6DcGtjZWjGuv/RA1k=
+github.com/gokrazy/internal v0.0.0-20251208203110-3c1aa9087c82/go.mod h1:dQY4EMkD4L5ZjYJ0SPtpgYbV7MIUMCxNIXiOfnZ6jP4=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
@@ -33,20 +33,20 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
+golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
-golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

ssh.go

@@ -2,19 +2,16 @@ package main
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"log"
 	"net"
 	"os"
 	"os/exec"
-	"path"
 	"strconv"
 	"strings"
 	"sync"
 	"syscall"
-	"time"
 	"unsafe"
 
 	"github.com/gokrazy/gokrazy"
@@ -24,15 +21,11 @@ import (
 	"golang.org/x/crypto/ssh"
 )
 
-func handleChannel(newChan ssh.NewChannel, conn *ssh.ServerConn) {
+func handleChannel(newChan ssh.NewChannel) {
 	switch t := newChan.ChannelType(); t {
 	case "session":
-		handleSession(newChan, conn)
+		handleSession(newChan)
 	case "direct-tcpip":
-		if _, portForwardDenied := conn.Permissions.Extensions["no-port-forwarding"]; portForwardDenied {
-			newChan.Reject(ssh.Prohibited, "port forwarding is disabled. For you in particular :-P")
-			return
-		}
 		handleTCPIP(newChan)
 	default:
 		newChan.Reject(ssh.UnknownChannelType, fmt.Sprintf("unknown channel type: %q", t))
@@ -119,7 +112,7 @@ func handleTCPIP(newChan ssh.NewChannel) {
 	}()
 }
 
-func handleSession(newChannel ssh.NewChannel, conn *ssh.ServerConn) {
+func handleSession(newChannel ssh.NewChannel) {
 	channel, requests, err := newChannel.Accept()
 	if err != nil {
 		log.Printf("Could not accept channel (%s)", err)
@@ -127,12 +120,12 @@ func handleSession(newChannel ssh.NewChannel, conn *ssh.ServerConn) {
 	}
 
 	// Sessions have out-of-band requests such as "shell", "pty-req" and "env"
-	go func(channel ssh.Channel, requests <-chan *ssh.Request, conn *ssh.ServerConn) {
+	go func(channel ssh.Channel, requests <-chan *ssh.Request) {
 		ctx, canc := context.WithCancel(context.Background())
 		defer canc()
 		s := session{channel: channel}
 		for req := range requests {
-			if err := s.request(ctx, req, conn); err != nil {
+			if err := s.request(ctx, req); err != nil {
 				log.Printf("request(%q): %v", req.Type, err)
 				errmsg := []byte(err.Error())
 				// Append a trailing newline; the error message is
@@ -146,7 +139,7 @@ func handleSession(newChannel ssh.NewChannel, conn *ssh.ServerConn) {
 			}
 		}
 		log.Printf("requests exhausted")
-	}(channel, requests, conn)
+	}(channel, requests)
 }
 
 func expandPath(env []string) []string {
@@ -221,52 +214,34 @@ type exitStatus struct {
 	Status uint32
 }
 
-func shellWorks(shell string) bool {
-	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, shell, "-c", "exit 58")
-	cmd.Run()
-	return cmd.ProcessState != nil && cmd.ProcessState.ExitCode() == 58
-}
-
 func findShell() string {
 	if _, err := os.Stat(wellKnownBusybox); err == nil {
 		// Install busybox to /bin to provide the typical userspace utilities
 		// in standard locations (makes Emacs TRAMP work, for example).
 		if err := installBusybox(); err != nil {
 			log.Printf("installing busybox failed: %v", err)
-			// fallthrough, we don't return /bin/sh as we read /etc/passwd
+			// fallthrough
+		} else {
+			return "/bin/sh" // available after installation
 		}
 	}
-	if _, err := exec.LookPath(shell); path.IsAbs(shell) && shellWorks(shell) && err == nil {
+	if path, err := exec.LookPath("sh"); err == nil {
-		return shell
-	}
-	if path, err := exec.LookPath("bash"); shellWorks(path) && err == nil {
-		return path
-	}
-	if path, err := exec.LookPath("sh"); shellWorks(path) && err == nil {
 		return path
 	}
 	const wellKnownSerialShell = "/tmp/serial-busybox/ash"
-	if _, err := exec.LookPath(wellKnownSerialShell); err == nil {
+	if _, err := os.Stat(wellKnownSerialShell); err == nil {
 		return wellKnownSerialShell
 	}
 	return ""
 }
 
-func (s *session) request(ctx context.Context, req *ssh.Request, conn *ssh.ServerConn) error {
+func (s *session) request(ctx context.Context, req *ssh.Request) error {
 	switch req.Type {
 	case "pty-req":
-		if _, portForwardDenied := conn.Permissions.Extensions["no-pty"]; portForwardDenied {
-			return errors.New("Pseudo-Terminal is disabled. For you in particular :-P")
-		}
 		var r ptyreq
 		if err := ssh.Unmarshal(req.Payload, &r); err != nil {
 			return err
 		}
-		if r.TERM != "" {
-			s.env = append(s.env, fmt.Sprintf("TERM=%s", r.TERM))
-		}
 
 		var err error
 		s.ptyf, s.ttyf, err = pty.Open()
@@ -380,25 +355,21 @@ func (s *session) request(ctx context.Context, req *ssh.Request, conn *ssh.Serve
 
 		// Ensure the $HOME directory exists so that shell history works without
 		// any extra steps.
-		if err := os.MkdirAll(home, 0755); err != nil {
+		if err := os.MkdirAll("/perm/home", 0755); err != nil {
 			// TODO: Suppress -EROFS
 			log.Print(err)
 		}
 
 		var cmd *exec.Cmd
 		if shell := findShell(); shell != "" {
-			if len(cmdline) == 0 || (len(cmdline) == 1 && cmdline[0] == "sh") {
+			cmd = exec.CommandContext(ctx, shell, "-c", r.Command)
-				cmd = exec.CommandContext(ctx, shell, "-l")
-			} else {
-				cmd = exec.CommandContext(ctx, shell, "-c", r.Command)
-			}
 		} else {
 			cmd = exec.CommandContext(ctx, cmdline[0], cmdline[1:]...)
 		}
 		log.Printf("Starting cmd %q", cmd.Args)
 		env := expandPath(s.env)
 		env = append(env,
-			"HOME="+home,
+			"HOME=/perm/home",
 			"TMPDIR=/tmp")
 		cmd.Env = env
 		cmd.SysProcAttr = &syscall.SysProcAttr{}