-7

I have a script that I got from one of the websites.It gave "Hello" as output when I ran it, but I couldn't understand the working of the script.

Can anyone explain what the script is actually doing?

#!/bin/bash

echo hello

if test -t 1; then
  # Stdout is a terminal.
  exec >log
else
  # Stdout is not a terminal.
  npipe=/tmp/$$.tmp
  trap "rm -f $npipe" EXIT
  mknod $npipe p
  tee <$npipe log &
  exec 1>&-
  exec 1>$npipe
fi

echo goodbye

closed as too broad by dr01, Jeff Schaller, GAD3R, countermode, kenorb Dec 19 '16 at 15:23

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    That is using a bunch of reasonably "advanced" shell scripting features (and, ugh, insecurely). It also looks needlessly complicated... – derobert Dec 19 '16 at 14:35
  • 2
    @derobert I think the most insecure part about this script is "I got a script off a website and I ran it, but I don't know how it works" – Centimane Dec 19 '16 at 15:12
  • did you try looking at the man pages for each of these commands first? Generally the best starting place for what a command does. – Centimane Dec 19 '16 at 15:13
4

The script is probably an example, and you are expected to change the echo goodbye to do something more.

Let us assume that the script is called demo. When you run it then as you have seen it first outputs "hello". It then sees if the output is going to the terminal or not, with the intention of deciding if you are running

demo

or

demo | some other program

If it is the former then it just send the output of the rest of the file to the file called log. If the latter then if creates a named pipe and starts a tee process to copy everything written to the named pipe to both the output of the demo script (so some other prog will get it) and to the file called log. It then arranges to send the output of the rest of the file to this named pipe. It also arranges that when demo finishes it will remove the named pipe.

The line exec 1>&- is not needed.

The net result of all of this is that the word "goodbye" is written to the file "log". If you ran demo | cat you would see both "hello" and "goodbye" on your screen.

As @derobert points out in the comments, the named pipe has a predictable name. Depending on the setting of umask this might allow someone to corrupt the output of demo either by reading it (so tee doesn't see it) or adding extra stuff for tee to copy. This is in addition to a number of standard attacks that can be used against known or predicable names. Soft or hard links can be set up in advance to cause other files to be opened or truncated. On my linux system the mknod will fail if the file already exists, but as the script ignores this error then the exec 1>$npipe will be executed.

  • I'd suggest you mention the predictable temporary file name, and the possible security implications. – derobert Dec 19 '16 at 14:49
  • @derobert done, probably a waste as this question is downvoted but we have tried. – icarus Dec 19 '16 at 15:02
  • There is more to that security problem—someone could throw a symlink there. mknod will then fail, but the script doesn't check for errors... and then the redirect will (depending on the setting of /proc/sys/fs/protected_symlinks) happily follow the symlink. Anyway, people should vote the answer independent of the question—and I think there is even a badge if you get enough upvotes on your answer to a downvoted question. – derobert Dec 19 '16 at 15:09
  • The badge is reversal, and needs +20 on the answer. There have only been two awarded. – icarus Dec 19 '16 at 19:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.