Restricted shell

The restricted shell is a Unix shell that restricts some of the capabilities available to an interactive user session, or to a shell script, running within it. It is intended to provide an additional layer of security, but is insufficient to allow execution of entirely untrusted software. A restricted mode operation is found in the original Bourne shellPOSIX sh specification
/ref> and its later counterpart ,
/ref> and in the KornShell.ksh manual
Solaris (SunOS 5.10) manual page, Oracle Inc. In some cases a restricted shell is used in conjunction with a chroot jail, in a further attempt to limit access to the system as a whole.

Invocation

The restricted mode of the Bourne shell , and its POSIX workalikes, is used when the interpreter is invoked in one of the following ways:
*    ''note that this conflicts with the "read" option in some variants''
*    ''note that this may conflict with the remote shell command, which is also called on some systems''

The restricted mode of Bash is used when Bash is invoked in one of the following ways:
*
*
*

Similarly KornShell's restricted mode is produced by invoking it thus:
*
*

Setting up rbash

For some systems (e.g., CentOS), the invocation through is not enabled by default, and the user obtains a error if invoked directly, or a login failure if the /etc/passwd file indicates as the user's shell.

It suffices to create a link named pointing directly to . Though this invokes Bash directly, without the or options, Bash does recognize that it was invoked through and it does come up as a restricted shell.

This can be accomplished with the following simple commands (executed as root, either logged in as user root, or using sudo):

root@host:~# cd /bin
root@host:/bin# ln bash rbash

Limited operations

The following operations are not permitted in a restricted shell:

* changing directory
* specifying absolute pathnames or names containing a slash
* setting the PATH or SHELL variable
* redirection of output

Bash adds further restrictions, including:
* limitations on function definitions
* limitations on the use of slash-ed filenames in Bash builtins

Restrictions in the restricted KornShell are much the same as those in the restricted Bourne shell.ksh(1) manual page
IBM AIX documentation set

Weaknesses of a restricted shell

The restricted shell is not secure. A user can break out of the restricted environment by running a program that features a shell function. The following is an example of the shell function in vi being used to escape from the restricted shell:

user@host:~$ vi


:set shell=/bin/sh
:shell

Or by simply starting a new unrestricted shell, if it is in the , as demonstrated here:

user@host:~$ rbash
user@host:~$ cd /
rbash: cd: restricted
user@host:~$ bash
user@host:~$ cd /
user@host:/$

List of programs

Beyond the restricted modes of usual shells, specialized restricted shell programs include:
* rssh
/code> – used with OpenSSH, permitting only certain file copying programs, namely scp, sftp, rsync, cvs, and rdist
* smrsh, which limits the commands sendmail can invoke

See also

* Remote Shell

References

{{reflist

Command shells