I have set restricted user with limited commands to run with .profile and PATH variable but user can set his path using:

$ export PATH=$PATH:/bin:/sbin:/usr/bin

and can get access to other commands.

Is there anyway to restrict user from setting his path?

closed as unclear what you're asking by l0b0, Kiwy, Jeff Schaller, Timothy Martin, Rui F Ribeiro Apr 26 '18 at 21:46

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • use a proper solution such as apparmor selinux simple user account without to much right, but please try to use the correct tool to the correct problem. As soon as a user is able to login with interactive shell or gui he can do whatever he wants with his env. hidding path to binary is also the worst way to protect yourself from anything – Kiwy Apr 26 '18 at 7:54
  • You should restrict the path they can read. Restricting PATH is not a good solution: one could explicitly add the full path in front to the commands. chroot could also be usefull. – Giacomo Catenazzi Apr 26 '18 at 12:35

You can use the readonly Bash built-in to make a variable, well, read only. But this is unlikely to deter someone bent on changing their environment, as they could simply start a new shell without running the RC files and set up their own environment. Also, this does not in any way hinder someone from running programs not in the PATH. The PATH variable is simply a convenience feature, to allow users to write foo rather than for example /usr/bin/foo. That's it. It's not related to security in any way.

The key to securing an environment is to first take a long hard look at what your threat model is - do you expect users to try to read other users' files, to break the installation, to eavesdrop on communications, to send spam, to get root access, or something else? Once you've established this you can start working out which measures will actually achieve this.

  • thats irony, I can add user in other group than root but then ssh can not login. It has to have ssh login and I can set up other group for that user – coder007 Apr 26 '18 at 3:31
  • What do you mean? Users not in the "root" group can't log in via SSH? If so that's a weird setup. – l0b0 Apr 26 '18 at 3:40
  • Initially there is only root user and group but for this restricted user, I can add new group if needed for permission denial for other commands but ssh also has root only group. I have to find way without changing much. – coder007 Apr 26 '18 at 4:00

You should look into bash "restricted" mode (started with bash --restricted or bash -r), which prevents commands such as cd and blocks running any executable by the full path, so it only allows executing what is in $PATH.

Also, it prevents modifying environment variables such as PATH.

You can find an overview of bash "restricted" mode here.

  • unfortunately, my shell is ash and not full featured bash. so only options are: Usage: ash [-/+OPTIONS] [-/+o OPT]... [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]] – coder007 Apr 26 '18 at 3:56
  • You can always install bash... Anyways, you mentioned "restricted user with limited commands" and bash -r fits that description... I don't know what else you think might be restricted. As @l0b0 pointed out, $PATH is just a shortcut, they can access other binaries by using their full path anyways... bash -r blocks that too. – filbranden Apr 26 '18 at 4:01
  • I installed bash and set bash -r shell but problem is I can not ssh login with it but if I just use bash then I can login. At this point user still in same group as root but in same situation ash can login. – coder007 Apr 26 '18 at 5:50

Finally, get it working so bash -r did not work but I found rbash binary installed which is restricted version of bash.

After adding /bin/rbash as a shell for restricted user, it can not set path or execute with complete path and thats what I wanted. Thanks for help everyone!

  • Be aware that rbash does not disable Ctrl/C while running the user's login scripts, so it's perfectly possible to break out during the login process. This allows the user to run programs in the standard PATH before it's been locked down or changed. Typically other shells are in that PATH and it's then trivial to escape. – roaima Apr 26 '18 at 6:54
  • Very nice, @coder007, I'm glad this helped you find what you were looking for! – filbranden Apr 26 '18 at 7:18
  • @roaima I got to know about that hack to break into rbash login but if login scripts are read and execute only, it should fix this hack ?? – coder007 May 11 '18 at 2:36
  • @coder007 unfortunately no. – roaima May 11 '18 at 6:14
  • Please note that rbash is not really a secure environment for interactive sessions, as there are many ways to escape into a non-restricted shell, e.g. awk 'BEGIN{system("/bin/sh");}' – Andreas Wiese May 11 '18 at 7:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.