I have a program which generates some shell script, then runs and deletes it. Is there any chance to get a contents of this script without of intrusion into the program which generates it?

  • Depends on the program. There are various ways to do that; the simplest way is if you can get the program to stop before it deletes the shell script, and then copy it e.g. using the file descriptors available from /proc/.
    – dirkt
    Nov 24, 2016 at 7:31

3 Answers 3


You can temporarily replace your script interpreter with a program of your choice (e.g. cat) which would let you either examine the script on screen or store it somewhere. By definition, there is no way to hide the script from the interpreter.

If the program in question hasn't been designed to keep the script secret, you will probably be able to find it on your disk with extundelete or a similar tool for the filesystem you're using.

  • 1
    The first option is very interest. The second one is not applicable because the program designed exactly as you mentioned... Nov 24, 2016 at 7:47

I found this non-trivial solution:



while inotifywait -e create "$1"; test ! -f "$file_path"

chmod g+rw "$file_path"
chown root "$file_path"

This script must be run with the root's privileges:

sudo <catch-script> /dir/where/the/target/will/be/generated

Previously a dir, where the script will be generated, must be chowned as follows:

chown root /dir/where/the/target/will/be/generated
chmod 1775 /dir/where/the/target/will/be/generated

I.e. we set the sticky bit to the dir where the script will be placed. Then the specified (catching) script waits while the target script will be created, sets the write permission for it (to give an ability to the generating-program to work with it) and changes the owner to the root (to disable of a deletion).


Arrange for the temporary file to be in a filesystem that keeps all versions of files, such as copyfs. Sample usage:

mkdir /tmp/backend /tmp/recorded
copyfs-mount /tmp/backend /tmp/recorded
TMPDIR=/tmp/recorded myprogram
ls /tmp/backend
cat /tmp/backend/metadata.
fusermount -u /tmp/recorded

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .