Visit Our UNIX and Linux User Community


PATH manipulation


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting PATH manipulation
# 1  
Old 09-09-2009
PATH manipulation

I have a requirement like this:

I have modified versions of certain internal/external commands that I am putting into some directory say /mydir.

All the users will go an authentication check once they log in and based on the outcome there are two possibilities:

1. User passes authentication - No action required.
2. User fails authentication - Any command user executes will be looked upon in /mydir first and if modified version of the command is available there it is

executed else normal command will be executed.

I have taken a simple logical approach to achieve this. Change PATH to PATH=/mydir:$PATH from within /etc/profile. Now I want to restrict the users to

revert back to original path. Is there any way to do this?

Also ideally I don't want users to view this modified PATH and allow them to change the PATH but the change should not take place.
Basically I want to achieve something like this:

1. User logs in - PATH gets changed to new PATH - User issues PATH command - Original PATH is displayed even though actually PATH is changed and new PATH is

in effect.
2. User tries to change PATH - PATH command is executed - user issues “echo $PATH” to verify - he gets modified PATH displayed but actually PATH is not

changed.

I summary I want to change user's PATH but don't want him to know that this has happened.

Is this possible? Ideally I want to achieve what I have described but if it is not at all possible then at least I want to restrict user from executing

PATH command.

Any ideas?

Thanks in advance and look forward know your thoughts on this.

Regards,
Ramesh
# 2  
Old 09-10-2009
Why do you want to do it this way? It seems like a dishonest way to deal with your users, in my opinion. Why not simply deny them access if they fail authentication?
# 3  
Old 09-10-2009
This is my client's requirement so I cannot question him why he want to do this, I simply have to provide the solution as long as it is not crime by law :-) so it would be better we discuss this purely in technical terms rather than debating if it's appropriate or not.

I am thinking of achieving this by trapping the signal for ENTER (RETURN) key so that I can monitor each command entered by the user and handle them inside my script. I this way when user enters PATH command my script will trigger and handle it inside the script.

Now question is whether there is better way to do this? and How do I TRAP ENTER or RETURN key. Is that possible?

---------- Post updated at 11:59 AM ---------- Previous update was at 11:43 AM ----------

Quote:
Originally Posted by Annihilannic
Why not simply deny them access if they fail authentication?
Also this is not just the question of denying them access. The users should not be able to change PATH and defeat our purpose for changing their PATH. This is the main requirement (fooling the user is secondary and if that is achieved it will be bonus).

Any clues or pointers?
# 4  
Old 09-10-2009
If you've got ksh available, you could try set up an restricted environment. Quote from the man page:
Code:
Rksh  is  used  to  set up login names and execution environments whose
capabilities are more controlled than those of the standard shell.  The
actions  of rksh are identical to those of ksh, except that the follow-
ing are disallowed:
       Unsetting the restricted option.
       changing directory (see cd(1)),
       setting or unsetting the value  or  attributes  of  SHELL,  ENV,
       FPATH, or PATH,
       specifying path or command names containing /,
       redirecting output (>, >|, <>, and >>).
       adding or deleting built-in commands.
       using command -p to invoke a command.

Another way that I can think of would be:
  • Copy the checked commands to an alternative directory
  • Replace the original with (a) shell script(s) which, depending on the authentication state, runs either the original command or the file from /mybin
That way there wouldn't be a need to modify / prevent modification of the PATH variable.
# 5  
Old 09-10-2009
Manipulating the PATH won't do the trick expected by your client, I'm afraid, as any user experienced enough to tinker with this variable could simply use 'which' to get an idea of what tools he's supposed to work with, then prepend the absolute path to the tool in question in order to bypass your preselection ... at least, that's what the ordinary user in me would do to begin with ;-)
# 6  
Old 09-10-2009
pludi: I have given a thought on using restricted shell (rbash) but I just want to restrict user doing few things like not allowing him changing PATH etc. I am checking if it is possible to set up rbash and customize it, I mean if I can set up rbash allowing certain things and restricting other.

dr.house:
You have a good point that user can use "which" command. I am checking all these possibilities and also alternate ways to achieve this if this is not the proper way.

Your thoughts on this would be really helpful so please keep on sharing, I will also share what I am up to.

Thanks,
Ramesh
# 7  
Old 09-10-2009
What may or may not keep the unaware at bay (- as all others would revert to 'find', 'export' and the like as need be ...): update '/etc/profile' and '/etc/bashrc' (or the like) with functions, variables and aliases to create an environment based on the current user's status, then replace '/home/[user]/.profile' and '/home/[user]/.bashrc' by links to the system-wide, "root-write only" configuration files - and hope for the best (as, of course, any such manipulation will be transparent to those able to read ... this is Linux, after all).

On the long run (not least of yours away from the users figuring out what you've done ...), however, chroot or even SELinux might become increasingly attractive to you and your client, respectively Smilie

Previous Thread | Next Thread
Test Your Knowledge in Computers #44
Difficulty: Easy
Data moves through the Internet in a data structure called a 'packet'.
True or False?

10 More Discussions You Might Find Interesting

1. Programming

Makefile missing include path Although the path exists and defined

i have make file which i try to make them generic but it keeps to compline it missing include directory this is the makefile : CXX=g++ CPPFAGS= -Wall -O0 -g -std=c++14 INCLUDES = -I/home/vagrant/libuv/include -Isrc LIBS_DIRS = -L/home/vagrant/libuv/build LDFLAGS=... (7 Replies)
Discussion started by: umen
7 Replies

2. UNIX for Beginners Questions & Answers

Convert Relative path to Absolute path, without changing directory to the file location.

Hello, I am creating a file with all the source folders included in my git branch, when i grep for the used source, i found source included as relative path instead of absolute path, how can convert relative path to absolute path without changing directory to that folder and using readlink -f ? ... (4 Replies)
Discussion started by: Sekhar419
4 Replies

3. UNIX for Advanced & Expert Users

Command to see the logical volume path, device mapper path and its corresponding dm device path

Currently I am using this laborious command lvdisplay | awk '/LV Path/ {p=$3} /LV Name/ {n=$3} /VG Name/ {v=$3} /Block device/ {d=$3; sub(".*:", "/dev/dm-", d); printf "%s\t%s\t%s\n", p, "/dev/mapper/"v"-"n, d}' Would like to know if there is any shorter method to get this mapping of... (2 Replies)
Discussion started by: royalibrahim
2 Replies

4. Shell Programming and Scripting

Generate class path dynamically based on source path

Hi experts, I have multiple file names ending with .jsp located in $SOME_DIR, $SOME_DIR/f1/,$SOME_DIR/f2/test,$SOME_DIR/f3/fa and there are equivalent class files in $SOME_DIR/WEB-INF/classes/_pages,$SOME_DIR/WEB-INF/classes/_pages/_f1,... (0 Replies)
Discussion started by: oraclermanpt
0 Replies

5. Shell Programming and Scripting

Pattern match a path anywhere in the line and replace it with new path

I want to pattern match only path part from below and replace them with new path string. LoadModule jk_module /fldrA/fldrBaf/fldrCaa/modules/mod_jk.so JkWorkersFile /fldrA/fldrBaf/fldrCaa/config/OHS/ohs1/workers.properties JkLogFile... (4 Replies)
Discussion started by: kchinnam
4 Replies

6. Shell Programming and Scripting

Moving files from parent path to multiple child path using bash in efficient way

Hi All, Can you please provide some pointers to move files from Base path to multiple paths in efficient way.Folder Structure is already created. /Path/AdminUser/User1/1111/Reports/aaa.txt to /Path/User1/1111/Reports/aaa.txt /Path/AdminUser/User1/2222/Reports/bbb.txt to... (6 Replies)
Discussion started by: karthikgv417
6 Replies

7. Shell Programming and Scripting

Retrieve directory path from full file path through sh

Hi, I have a file abcd.txt which has contents in the form of full path file names i.e. $home> vi abcd.txt /a/b/c/r1.txt /q/w/e/r2.txt /z/x/c/r3.txt Now I want to retrieve only the directory path name for each row i.e /a/b/c/ /q/w/e/ How to get the same through shell script?... (7 Replies)
Discussion started by: royzlife
7 Replies

8. UNIX for Advanced & Expert Users

PATH manipulation

I have a requirement like this: I have modified versions of certain internal/external commands that I am putting into some directory say /mydir. All the users will go an authentication check once they log in and based on the outcome there are two possibilities: 1. User passes... (1 Reply)
Discussion started by: ramesh_samane
1 Replies

9. Shell Programming and Scripting

Executing Commands From Non-Standard Path (Changing user's PATH secretely???)

Hi: I have a requirement as below: I have some standard Unix commands modified and kept them in a directory say /usr/clsh/bin. For example I have a script named "ls" kept here which is modified version of "ls" (say it always gives long listing i.e. ls -l). When any user logs on and types... (2 Replies)
Discussion started by: ramesh_samane
2 Replies

10. UNIX for Dummies Questions & Answers

vi - replacing a relative path with absolute path in a file

Hi, I have a file with about 60 lines of path: app-defaults/boxXYZ....... I want to change this to /my/path/goes/here/app-defaults/boxXYZ, but of course vi doesn't like the regualr :s/old/new/ command. Is there any other quick way to do this? Thanks ;) (2 Replies)
Discussion started by: Yinzer955i
2 Replies

Featured Tech Videos