run-allowed.sh

#!/usr/bin/env sh

usage() {
    echo "Usage: $0 <allowed-cmds>... -- <run-cmd> <run-args>"
    echo
    echo "  <allowed-cmds>  One or more comma-separated allowed commands"
    echo "  run-cmd         Command to be tested against allowed list and ran"
    echo "  run-args        Optional arguments to pass to the run command"
    exit 2
}

error_not_allowed() {
    echo "error: command not allowed"
    exit 3
}

[ $# -ge 2 ] || usage

allowed_cmds=''

while [ $# -gt 1 ]; do
    case $1 in
        --)
            shift
            break
            ;;
        *)
            cmd=$(which "$1" 2>/dev/null)
            if [ -n "$cmd" ]; then
                allowed_cmds="${allowed_cmds}${allowed_cmds:+:}${cmd}"
            fi
            shift
    esac
done

run_cmd=$(which "$1" 2>/dev/null)
shift

if [ -n "$run_cmd" ]; then
    IFS=:
    for cmd in $allowed_cmds; do
        if [ "$cmd" = "$run_cmd" ]; then
            echo "run: $run_cmd"
            echo "args:" "$@"
            $run_cmd "$@"
            exit 0
        fi
    done
fi

error_not_allowed