How to prevent automatic appendings to .bashrc from being effective?

Question

I'm looking for a way to nullify the undesirable behaviour of some installers that append code to .bashrc to force-load their environment automatically. The problem cropped-up a few times, mostly with Conda, and in some cases the user ended-up with a broken account that prevented them from logging in anymore.

I tried to add an unclosed here-document at the end of .bashrc, like this:

# .bashrc

#...

: <<'__END__'

Which works, but generates parsing errors annoying warnings.

What would be a clean way to do that (without making the .bashrc readonly)?

Answer 1

If you end your .bashrc with

return 0

Bash will ignore any lines added after that, since .bashrc is handled like a sourced script:

return may also be used to terminate execution of a script being executed with the . (source) builtin, returning either n or the exit status of the last command executed within the script as the exit status of the script.

(exit 0 causes the shell to exit, which isn’t what you want.)

Answer 2

While Stephen's trick definitely works, the fundamental problem here is that the installer is run with privileges that allow it to modify your .bashrc. If it's doing that, it could be making all sorts of unwanted changes to other things that might cause broken interactions or be outright malicious (ranging from phone-home spyware shipped intentionally to outright malware from a supply chain compromise or inside threat).

The right solution is not to run "installers" with any privileges. Instead you can run them inside a throwaway container or user account, then copy only the wanted files out of the "staging" environment to the environment you want to use them in. I do something like this with a tool I wrote, usand, which uses unshare to make new user and mount namespaces that block network access and write access to files outside of the current directory and everything under it. While it's not presently very flexible, many of the same concepts can be applied to do something suited to your particular workflow.

Answer 3

Using return prevents the extra content from being executed, but it doesn't prevent the file from filling up with all that junk over time. It also creates the problem where you accidentally add something below the return and have to figure out why your changes aren't taking effect.

What I've done before is to add a line at the end like # END_ACTUAL_CONTENT. I created a script that would locate this marker and delete everything located after it, and set that script to run periodically.

You can also use functions like this to neutralize those annoying installers:

function bashrc_save() { cp -f ~/.bashrc ~/.bashrc.backup }
function bashrc_restore() { mv -f ~/.bashrc.backup ~/.bashrc }

Install your program with bashrc_save; ./install.sh; bashrc_restore and any changes that it makes to your .bashrc file will be automatically rolled back.

I currently take this a step farther. I store my .bashrc file (as well as a bunch of other configuration files) in a separate directory ~/.configfiles, and I create symlinks to the locations where these files normally reside. The contents of that folder are in a git repository. I do that to make it easy to synchronize between systems, but it has the added benefit of being able to use git diff to see all the changes an installer has made and to use git restore to revert them en masse.