First version

files/security/team-vscode-extensions

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Prepares the VS Code extensions of the team account at boot, as root, with
+# the script of the ICPC image. The image runs that script at login through
+# sudo, which every account could then use as root. The paths it mounts and
+# changes are checked first: a symbolic link there could point anywhere.
+set -eu
+USER_NAME=team
+home=$(getent passwd "$USER_NAME" | cut -d: -f6)
+for path in "$home/.pki" "$home/.pki/nssdb" "$home/.vscode" \
+            "$home/.vscode/extensions" "$home/.vscode/extensions-work" \
+            "$home/.vscode/extensions-overlay" "$home/.vscode/extensions-root"; do
+    if [ -L "$path" ]; then
+        logger -t team-vscode-extensions "removing the symbolic link $path"
+        rm -f "$path"
+    fi
+done
+[ -L "$home" ] && { echo "$home is a symbolic link" >&2; exit 1; }
+export SUDO_UID=$(id -u "$USER_NAME") SUDO_GID=$(id -g "$USER_NAME")
+exec /usr/local/bin/vscode-extension-install

files/security/team-vscode-extensions.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=VS Code extensions of the team account
+After=local-fs.target
+Before=display-manager.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/sbin/team-vscode-extensions
+
+[Install]
+WantedBy=multi-user.target