Restricted Shells

Chapter 21. Restricted Shells

Disabled commands in restricted shells

. Running a script or portion of a script in restricted mode disables certain commands that would otherwise be available. This is a security measure intended to limit the privileges of the script user and to minimize possible damage from running the script.

The following commands and actions are disabled:

Example 21-1. Running a script in restricted mode

#!/bin/bash

#  Starting the script with "#!/bin/bash -r"
#+ runs entire script in restricted mode.

echo

echo "Changing directory."
cd /usr/local
echo "Now in `pwd`"
echo "Coming back home."
cd
echo "Now in `pwd`"
echo

# Everything up to here in normal, unrestricted mode.

set -r
# set --restricted    has same effect.
echo "==> Now in restricted mode. <=="

echo
echo

echo "Attempting directory change in restricted mode."
cd ..
echo "Still in `pwd`"

echo
echo

echo "\$SHELL = $SHELL"
echo "Attempting to change shell in restricted mode."
SHELL="/bin/ash"
echo
echo "\$SHELL= $SHELL"

echo
echo

echo "Attempting to redirect output in restricted mode."
ls -l /usr/bin > bin.files
ls -l bin.files    # Try to list attempted file creation effort.

echo

exit 0

50 visits (2 today, 10 this week, 8 this month, 50 this year)
Uptime: 07:28:54 up 3 days, 17:31, 2 users, load average: 0.00, 0.02, 0.00
18.191.97.151 GET from server z.lam1.us

Friday, April 4, 2025 @ 7:28:54 AM
z.ServerAdmin@lam1.us