In my .bashrc there are a couple commands which redirect standard error to /dev/null, and this is not allowed within rbash:

bash: /dev/null: restricted: cannot redirect output

Is there some way to get around this (short of modifying Bash)? That is, to either

  • discard standard error some other way or
  • only attempt to redirect if it's allowed.

You can close stderr as in:

ls /blah 2>&-

While that will work in most cases, it may cause problems as poorly written applications may end up opening a new file which would automatically get 2 as the file descriptor and could end up writing error messages where you wouldn't want them to.

That also means that any write to stderr done by the application would return with an error (EBADF) which may affect their behavior.

As pipes are allowed, you could provide with a command that discards all its input. Here, using grep -v '^' (but you could use tail -n 0 or sed d or a script called discard that does cat > /dev/null):

{ ls /blah 2>&1 >&3 | grep -v '^'; } 3>&1

Alternatively, you could have whatever starts that restricted shell start it with the fd 3 (for instance) redirected to /dev/null (rbash 3> /dev/null), so you can then do within the restricted shell:

ls /blah 2>&3

Which is allowed:

$ rbash -c 'ls /blah 2>&3' 3> /dev/null

You can check whether redirection to /dev/null is allowed/works or not with:

if true 2>&- > /dev/null; then
  echo allowed

You can check whether the shell is restricted or not with:

case $- in
  (*r*) echo restricted
  • According to man rbash you won't be able to do any redirecting (even to closed) from within the shell. I think pipes are forbidden also. – Yuugian Jan 24 '13 at 0:38
  • @Yuugian, it's only redirections that can cause the shell to create a file that are prohibited. Input redirections (<) and pipes (which are more a way to run concurrent processes with their stdout and in connected), including process substitution and command substitution are allowed. You can double-check the manual and try it for yourself. – Stéphane Chazelas Jan 24 '13 at 7:35
  • This actually works! Create a file test.sh with the lines echo fail >&2 and echo success, chmod u+x test.sh, PATH=$PATH:. rbash, then run test.sh and test.sh 2>&- to verify. – l0b0 Jan 24 '13 at 9:55

From man rbash it looks like any redirect is prohibited: (the following are disallowed or not performed)redirecting output using the >, >|, <>, >&, &>, and >> redirection operators

It does look like you can spawn another shell script to do the redirect because When a command that is found to be a shell script is executed, rbash turns off any restrictions in the shell spawned to execute the script.

So, while you couldn't $ foo 2>/dev/null it looks like you could run $ bar where bar contains
foo 2>/dev/null

It would have to be set up in advance from a full bash environment because rbash also disallowed specifying command names containing / which looks like it would prohibit your current directory./bar but not the implicit /bin/bar

Please note: I haven't tried this yet

  • 1
    If you can do that, it is surely a bug in restricted bash... – vonbrand Jan 23 '13 at 21:57
  • that's why I was thinking that you would have to set it up from outside the rbash. If your cwd is not in $PATH then it is not much of a hole. rbash keeps you from using cd, calling a program not in $PATH, or changing $PATH – Yuugian Jan 24 '13 at 0:41
  • rbash stinks. I have never used it and gladly so. – Rolf Mar 26 '17 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.