#!/usr/bin/env bash
# runsuper -- run a task as invoker but with backup read rights

set -u
. lib.bash || exit

usage() {
	echo "Usage: $progname [-s] [-C <path>] <command...>"
	echo
	echo_opt "-C <path>"	"set initial working directory"
	echo_opt "-s"		"run command as root"
}

opt_base="~"
opt_sudo=0

while getopts :C:s OPT; do
	case $OPT in
	C) opt_base=$OPTARG;;
	s) opt_sudo=1;;
	*) lib:die_getopts;;
	esac
done; shift $[OPTIND-1]

cmd=(sudo SYSTEMD_TINT_BACKGROUND=0 SYSTEMD_ADJUST_TERMINAL_TITLE=0 systemd-run -q -G -t)

if (( opt_sudo )); then
	cmd+=(--description="Backup task for $LOGNAME/root")
else
	cmd+=(--description="Backup task for $LOGNAME")
	cmd+=(--uid="$LOGNAME")
fi

cmd+=(--nice=10)
cmd+=(-p AmbientCapabilities="cap_dac_read_search")
cmd+=(-p WorkingDirectory="$opt_base")
cmd+=(-p IgnoreSIGPIPE=no)

for env in KRB5CCNAME SSH_AUTH_SOCK; do
	if [[ -v $env ]]; then
		cmd+=(-E "$env=${!env}")
	fi
done

cmd+=(-- "$@")

"${cmd[@]}"
