Create "ni" prefix to disable internet access for specific commands

install_ni_prefix.sh

#!/bin/bash
# Install "ni" prefix for executing scripts without allowing internet access.
# Tested on Ubuntu 13.04.
# Example:
#     $ ni ping google.com
#     ping: unknown host google.com
#
#     $ ping google.com
#     PING google.com (173.194.40.229) 56(84) bytes of data.
#     64 bytes from arn02s06-in-f5.1e100.net (173.194.40.229): icmp_req=1 ttl=59 time=1.41 ms
#
# Original idea from http://ubuntuforums.org/showthread.php?t=1188099

sudo -s <<EOF
set -e
make_script() {
    f=\$1
    if [ -e \$f ]; then
        echo "WARNING: \$f already exists. Aborting script."
        exit 1
    fi
    cat > \$f
    chmod +x \$f
}

if groups | grep -qv no-internet; then
    groupadd no-internet
fi
usermod -a -G no-internet $USER

(
    echo '#!/bin/bash'
    echo 'COMMAND="\$1"'
    echo 'shift'
    echo 'for arg; do COMMAND="\$COMMAND \"\$arg\""; done'
    echo 'sg no-internet "\$COMMAND"'
) | make_script /usr/local/bin/ni

(
    echo '#!/bin/bash'
    echo 'iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP'
) | make_script /etc/network/if-pre-up.d/iptables_no-internet_rule

/etc/network/if-pre-up.d/iptables_no-internet_rule

echo "Done. You might need to log out and back in."

EOF