List of dangerous shell commands


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting List of dangerous shell commands
# 1  
Old 01-18-2012
List of dangerous shell commands

Hello,
I have a Application which needs to run shell scripts in a elevated state (root) for system interrogation. So I execute each script using bash -C. This has worked really well.

I now want to add another layer of security, I cant inspect each of the scripts before they get deployed to the systems. So I would like to have my app inspect the script for dangerous command line apps that might be on purpose or a fat finger, like rm; mv; cp; chown; chmod; etc.

I did try running bash in restricted mode but I had issues running some of the scripts. Is there a list or a command I can run to add a layer of protection to protect against something dangerous from happening?

Thanks,
tom
# 2  
Old 01-18-2012
treat all commands as dangerous. if they are allowed to run arbitrary scripts as root you might as well give them root.
These 2 Users Gave Thanks to frank_rizzo For This Post:
# 3  
Old 01-18-2012
IMO you are going at it in the wrong way.

First off, create a chrooted user that has some privilege, not all.
In the chroot jail (new / root directory ) only populate /usr/bin (or whatever with commands you can live with). No commands can be a link outside the jail.

Next, grant whatever users you want the privilege of becoming that special user, via sudo and /etc/sudoers

Basically though I gave you and answer, this is a not a good idea overall. I would not do this. Why do you want ordinary users doing normally restricted operations on the system.

You can probably use /etc/sudoers to set up what you want, but DO'NT let everybody have access to everything. The model is grant access. The model is never deny access.
Which is what your question is all about. Deny access.

The reason is the negative approach has serious flaws, even though you may think otherwise. You will notice that the security model that comes with the system is the "grant access model". There lots of good reasons for that. Don't bypass 30 years of security work for no good reason.

*I like Frank's answer better,I was being too polite.
# 4  
Old 01-19-2012
How are you running scripts in an "elevated state" ? The command "bash -C" (i.e. "noclobber) is doesn't cause any change of privilege.

Last edited by methyl; 01-19-2012 at 09:34 AM.. Reason: spellin
# 5  
Old 01-19-2012
The Shell "bash" itself contains enough built-in commands to wreak havoc.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. War Stories

Dangerous rm -rf command

Hello All, I am posting a intresting story which is posted by Mark Brader but actual story is from Mario Wolczko. Original link is here Thanks, R. Singh (4 Replies)
Discussion started by: RavinderSingh13
4 Replies

2. Shell Programming and Scripting

Any shell or hack that makes the shell command line take vi commands?

basically i'm tired of hitting the left arrow a few dozen times when correcting a mistake or modifying a history command i'd like to use vim style key shortcuts while on the command line so that a 55 moves the cursor 55 places to the left... and i want all the other vi goodies, search of... (3 Replies)
Discussion started by: marqul
3 Replies

3. Linux

Is umount -l dangerous?

I had a umount busy issue, that the usual fuser -mk did not solve, I did a umount -l and was able to unmount the device, I then got in trouble by the storage team staff: Here was a snippet of their response: Using "umount -l" is a potentially dangerous act. The command combination for a lazy... (8 Replies)
Discussion started by: pastajet
8 Replies

4. Shell Programming and Scripting

Can BASH execute commands on a remote server when the commands are embedded in shell

I want to log into a remote server transfer over a new config and then backup the existing config, replace with the new config. I am not sure if I can do this with BASH scripting. I have set up password less login by adding my public key to authorized_keys file, it works. I am a little... (1 Reply)
Discussion started by: bash_in_my_head
1 Replies

5. Shell Programming and Scripting

List of internal commands ??

Dear Sir/Mam, Can you tell me list of internal commands which are easy to implements...??? Means sir I am a beginner in unix shell programming. So, I just wanted to know that which internal commands are easy to implements in C language. thanks.... (1 Reply)
Discussion started by: ranusahu
1 Replies

6. Shell Programming and Scripting

list files commands

hi all scripting gurus, need some guide and advise from you. i'm trying to list all the files in the year 2004 and the file format is something like this: 11176MZ00004JV900004JVB00004JVCcDBU20041206.txt try to use the symbol ^ but somehow it does not help. i try this as well: ls -ltr |... (12 Replies)
Discussion started by: lweegp
12 Replies

7. UNIX for Advanced & Expert Users

Comparison List of commands

Hi, I would like to have a list of commands in a table, see below example Command description HPUNIX SUN UNIX IBM AIX all above i need comparison list of commands ASAP please.......... B.R (1 Reply)
Discussion started by: f_amshan
1 Replies

8. Shell Programming and Scripting

How to run unix commands in a new shell inside a shell script?

Hi , I am having one situation in which I need to run some simple unix commands after doing "chroot" command in a shell script. Which in turn creates a new shell. So scenario is that - I need to have one shell script which is ran as a part of crontab - in this shell script I need to do a... (2 Replies)
Discussion started by: hkapil
2 Replies

9. Solaris

List of Commands

Dear All, I am a new Administrator of Solaris in the company , I need a list of the commands pls ... Regards Adel (2 Replies)
Discussion started by: ArabOracle.com
2 Replies

10. UNIX for Dummies Questions & Answers

List of dangerous Unix command

Hi Guys, I wonder if one of you would have a list of dangerous commands on unix. Regards (8 Replies)
Discussion started by: JBB873
8 Replies
Login or Register to Ask a Question