Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using /bin/rbash for some users. It's working as expected but there is some hack like when users run bash or dash, then they got unrestricted shells, so to avoid these commands, I have added below functions in their .bashrc files.

bash() {
echo "WARNING: NOT ALLOW!!"
}

sh() {
echo "WARNING: NOT ALLOW!!"
}

So my question is:

1# can we use functions with multiple names as below

func1,func2 () {
 # do stuff
}

2# I also tried:

case $BASH_COMMAND in # check each command`
        bash|dash|sh) 
        echo "WARNING: NOT ALLOW!!" 
        ;;
esac

3# /bin/rbash -> bash it's just a soft link of bash, then how does it work as restricted?

Also there is some command to avoid users to execute that like unset HISTFILE and kill -9 $$ Is there any alternate way to achieve the same?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Do not do this. rbash should only be used within a chroot unless you know what you are doing. There are many ways to break out a restricted bash shell that are not easy to predict in advance.

Functions can easily be overridden simply by doing command bash or command sh.

As for your questions:

  • You can't define multiple functions at the same time directly. You'd have to do something like this:
x()  { foo; }
alias f1=x
alias f2=x
  • rbash works because bash checks the value of argv[0] on launch. If the basename, with leading dashes stripped, is equal to RESTRICTED_SHELL_NAME (defaulting to rbash, see config.h), it runs in restricted mode. This is the same way that it runs in POSIX-compliance mode if invoked as sh. You can see this in the following code from shell.c in bash 4.2, lines 1132-1147:
/* Return 1 if the shell should be a restricted one based on NAME or the
   value of `restricted'.  Don't actually do anything, just return a
   boolean value. */
int
shell_is_restricted (name)
     char *name;
{
  char *temp;

  if (restricted)
    return 1;
  temp = base_pathname (name);
  if (*temp == '-')
    temp++;
  return (STREQ (temp, RESTRICTED_SHELL_NAME));
}
share|improve this answer
    
what about /bin/rbash, it's just an soft link, then how it's works as restricted. –  Rahul Patil Dec 25 '12 at 14:29
1  
@RahulPatil I think (might be wrong) it's because argv[0] received /bin/rbash and then bash proceeds in restricted mode. –  Renan Dec 25 '12 at 14:41
1  
@RahulPatil Added the code which determines if bash is running in restricted mode. –  Chris Down Dec 25 '12 at 14:58
    
@ChrisDown Thanks for your time :) –  Rahul Patil Dec 25 '12 at 15:07
    
@ChrisDown i am doing right to avoid bash,sh command or is there any alternate way ? –  Rahul Patil Dec 25 '12 at 15:08
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.