Harden cmd execution

app/app

@@ -3,6 +3,7 @@ set -e
 APP_CMD="$(realpath "$BASH_SOURCE")"
 APP_DIR="$(dirname "$APP_CMD")"
 source "$APP_DIR/env"
+source "$APP_DIR/cmd/trap"
 
 echo "Locking '/run/$APP_NAME/lock' ..." >&2
 mkdir -p "/run/$APP_NAME"
@@ -14,4 +15,9 @@ while true; do
 	fi
 	sleep 1
 done
-exec bash "$APP_DIR/cmd/main" "${@}"
+
+set +e
+bash "$APP_DIR/cmd/main" "${@}"
+EXITCODE="$?"
+flock -u 100
+exit "$EXITCODE"

app/cmd/eject

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 set -e
-source "$APP_DIR/cmd/trap"
 eval "$(bash "$APP_DIR/cmd/main" plist "$2")"
 if ! [ "$mm_type" = "disk" ]; then
 	echo "$mm_path is not a disk." >&2

app/cmd/main

@@ -4,6 +4,11 @@ APP_CMD="$(realpath "$(dirname "$BASH_SOURCE")/../app")"
 APP_DIR="$(dirname "$APP_CMD")"
 source "$APP_DIR/env"
 if [ -f "$APP_DIR/cmd/$1" ]; then
+	if ! [[ "$(realpath "$APP_DIR/cmd/$1")" == "$APP_DIR/cmd/"* ]]; then
+		echo "ERROR: Action \"$1\" not found, use: \"$0\" help" >&2
+		exit 1
+	fi
+	
 	source "$APP_DIR/cmd/$1"
 	exit 0
 else

app/cmd/mount

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 set -e
-source "$APP_DIR/cmd/trap"
 eval "$(bash "$APP_DIR/cmd/main" plist "$2")"
 
 if [ "$mm_format" = "crypto_LUKS" ]; then

app/cmd/umount

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 set -e
-source "$APP_DIR/cmd/trap"
 eval "$(bash "$APP_DIR/cmd/main" plist "$2")"
 
 if [ "$mm_format" = "crypto_LUKS" ]; then