I am on Debian 9 (Stretch). I have a deploy
user where I've set the shell to /bin/rbash
. Here is the line from /etc/passwd
:
deploy:x:9000:9000::/home/deploy:/bin/rbash
If I am the root user, and I run su - deploy
or su -l deploy
, then it starts rbash
(echo $SHELL # => /bin/rbash
), but commands are not being restricted:
~$ echo $SHELL
/bin/rbash
~$ cd /tmp
/tmp$ echo asdf > /tmp/file
/tmp$ /bin/cat /tmp/file
asdf
# (Should not allow any commands with a slash)
If I just run su deploy
:
~$ echo $SHELL
/bin/rbash
~$ cd /tmp
rbash: cd: restricted
~$ /bin/cat /etc/passwd
rbash: /bin/cat: restricted: cannot specify `/' in command names
Why doesn't rbash
apply any restrictions if this is a login shell?
echo $SHELL
just lists the login shell, but that doesn't prove that you're running it. What doesecho $0 $-
report? – muru Jun 3 '19 at 9:41echo $0 $-
is:-su himBHs
– ndbroadbent Jun 3 '19 at 9:57su deploy
, then the output ofecho $-
ishimrBHs
, where ther
is the--restricted
flag. I wonder why it's not being added forsu - deploy
? – ndbroadbent Jun 3 '19 at 10:00