Shell Programming and Scripting

dr.house, as you said there can be "n" number of possibilities the user can find out that he is being manipulated so I am thinking dropping this idea of making all this transparent to user. Let user know it. My goal is now to "execute a clone commands from /mydir if available else execute from normal system path" (if user fails authentication). If I use changing user PATH approach inside a script then my problem boils down to just make sure user is restricted to changing PATH. Now the only question remains is "how to restrict unauthenticated user change his PATH?", otherwise there is no difference between authenticated Vs unauthenticated user.

Will try implementing strategies you have suggested. chroot is out of question as it would require a lot of set up in terms of copying the binaries and other things from "real root" to new root. SELinux, not given a thought yet. But as now problem reduced to just restricting user of changing PATH these options may not be appropriate.

No way, I daresay - as you don't even need 'export' to update a PATH (at least for the session being ...):

Code:

[house@leonov] id
uid=1000(house) gid=1000(house) 
[house@leonov] echo $PATH
/usr/bin:/bin:/usr/sbin:/sbin
[house@leonov] PATH=/illegalPath:$PATH
[house@leonov] echo $PATH
/illegalPath:/usr/bin:/bin:/usr/sbin:/sbin

Agreed, so do you think it is NOT possible to restrict user from changing PATH?

I was thinking of exploring this possibility but if it is at all not possible then may be I can direct my thoughts towards finding alternate ways rather than considering this solution. Please comment.

You may set the variable readonly:

Code:

bash-3.2.49(22)[~]$ declare -rx PATH
bash-3.2.49(22)[~]$ PATH=
bash: PATH: readonly variable

But this could be easily "bypassed" by spawning a new shell:

Code:

bash-3.2.49(22)[~]$ declare -rx PATH
bash-3.2.49(22)[~]$ PATH=
bash: PATH: readonly variable
bash-3.2.49(22)[~]$ bash
bash-3.2.49(22)[~]$ PATH=
bash-3.2.49(22)[~]$

With some versions of ksh (tested with ksh93) you can export the variable as readonly:

Code:

zsh-4.3.10[sysadmin]% ksh93
ksh-M 93t 2008-11-04$ typeset -rx PATH
ksh-M 93t 2008-11-04$ PATH=
/var/opt/ast/bin/ksh: PATH: is read only
ksh-M 93t 2008-11-04$ /var/opt/ast/bin/ksh
ksh-M 93t 2008-11-04$ PATH=               
/var/opt/ast/bin/ksh: PATH: is read only

... but, of course, the user could run something like this:

Code:

ksh-M 93t 2008-11-04$ bash -c 'PATH=.;echo $PATH'
.
ksh-M 93t 2008-11-04$

Just one random thought came into my mind. Can we TRAP ENTER/RETURN key and run our script whenever that key is pressed?

Using trap, as far as I know, no.