| Click Link Best Security Linux Security tips and Guide | Linux security optimizing linux internet security free ebook security tips and guide linux network security administrator e-book optimization | Click Link Bash Guide for Beginners | Bash Guide for Beginners - Free Online manual's and tips - Shell Start - Shell console - Shell Bash Guide Look Up !! | Click Link Internet Security Guide | Internet Security , Linux porting guide , block forward ports - Linux manage guide network administrator Online manual security | Click Link Linux Documentation Project - Add your work | LDP autor guide - Free linux manual's download help ? You also can add you work !!!! | Click Link Free administration guide | Network administrator admin linux administraton - network security internet security free administration guide network security linux administrator |
Disabled commands in restricted shells
Running a script or portion of a script in restricted mode disables certain commands that would otherwise be available. This is a security measure intended to limit the privileges of the script user and to minimize possible damage from running the script.
Using cd to change the working directory.
Changing the values of the $PATH, $SHELL, $BASH_ENV, or $ENV environmental variables.
Reading or changing the $SHELLOPTS, shell environmental options.
Output redirection.
Invoking commands containing one or more /'s.
Invoking exec to substitute a different process for the shell.
Various other commands that would enable monkeying with or attempting to subvert the script for an unintended purpose.
Getting out of restricted mode within the script.
Example 21-1. Running a script in restricted mode
#!/bin/bash # Starting the script with "#!/bin/bash -r" #+ runs entire script in restricted mode. echo echo "Changing directory." cd /usr/local echo "Now in `pwd`" echo "Coming back home." cd echo "Now in `pwd`" echo # Everything up to here in normal, unrestricted mode. set -r # set --restricted has same effect. echo "==> Now in restricted mode. <==" echo echo echo "Attempting directory change in restricted mode." cd .. echo "Still in `pwd`" echo echo echo "\$SHELL = $SHELL" echo "Attempting to change shell in restricted mode." SHELL="/bin/ash" echo echo "\$SHELL= $SHELL" echo echo echo "Attempting to redirect output in restricted mode." ls -l /usr/bin > bin.files ls -l bin.files # Try to list attempted file creation effort. echo exit 0 |