Path: utzoo!utgpu!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!rutgers!bellcore!faline!thumper!ulysses!andante!alice!debra
From: debra@alice.UUCP (Paul De Bra)
Newsgroups: comp.unix.wizards
Subject: Re: Restricted shell (was Re: rsh environment)
Keywords: no /etc/profile sourced?
Message-ID: <8636@alice.UUCP>
Date: 30 Dec 88 16:31:11 GMT
References: <1276@uwbull.uwbln.UUCP> <14640@cisunx.UUCP> <901@philmds.UUCP> <278@dcs.UUCP> <425@aurora.auvax.uucp>
Reply-To: debra@alice.UUCP ()
Organization: AT&T, Bell Labs
Lines: 40

In article <425@aurora.auvax.uucp> lyndon@auvax.UUCP (Lyndon Nerenberg) writes:
}In article <278@dcs.UUCP> wnp@dcs.UUCP (Wolf N. Paul) writes:
}>Some notes: sh and rsh are links to the same binary, with "sh -r" being 
}>equivalent to an invocation of rsh. "set -r" after the shell has started
}>also has the same effect, as Leo's demo showed. The manual further points out
}>that shell scripts are executed using standard sh, thus the restriction can
}>probably be gotten around.
}
}No kidding :-)
}
}(9:55pm) aurora:/nfs/aurora2/lyndon% sh -r
}$ pwd
}/nfs/aurora2/lyndon
}$ cd ..
}cd: restricted
}$ sh
}$ pwd
}/nfs/aurora2/lyndon
}$ cd ..
}$ pwd
}/nfs/aurora2
}(9:55pm) aurora:/nfs/aurora2/lyndon% exit
}

Hold it! The restricted shell is intended to be used together with a small
set of programs, put in a special directory, and with a $PATH that only
goes through that directory.

Furthermore, the programs for "restricted" users should not include editors
(maybe just red), shells (rsh will find /bin/sh though /bin is not in $PATH)
mail, etc. etc. etc...

The sad part is that it is very difficult to find a useful set of commands
that still does not allow the user to break out.

Paul.
-- 
------------------------------------------------------
|debra@research.att.com   | uunet!research!debra     |
------------------------------------------------------