Very Computer

by **c..** » Thu, 25 Sep 1997 04:00:00

to disable "!" (escape to shell) while they are viewing the file in "more/pg".
Note, these users generally work from a captive menu and are restricted
from command entry.

I have checked man pages for these commands but can't see
any means of enforcing this restriction.

Any suggestions would be welcome as well as any other commands I might use to
accomplish this.

TIA

by **Dave Plon** » Thu, 25 Sep 1997 04:00:00

: to disable "!" (escape to shell) while they are viewing the file in "more/pg".
: Note, these users generally work from a captive menu and are restricted
: from command entry.

These utilities should use the environment variable "SHELL", if set, to
determine which shell to lauch. Just set (and export) it to something
harmless like "/bin/false":

ksh$ SHELL=/bin/false less file

Dave

--

by **Tapani Tarvaine** » Fri, 26 Sep 1997 04:00:00

> to disable "!" (escape to shell) while they are viewing the file in "more/pg".
> Note, these users generally work from a captive menu and are restricted
> from command entry.

Try setting the SHELL variable to something like /bin/true.
Ditto EDITOR, if you don't want the 'v' editor escape as well.
It's probably best to set them just for the duration of the
command, e.g., with sh/ksh:

SHELL=/bin/true EDITOR=/bin/true more file

--
Tapani Tarvainen

by **Brian McCaule** » Fri, 26 Sep 1997 04:00:00

> to disable "!" (escape to shell) while they are viewing the file in "more/pg".
> Note, these users generally work from a captive menu and are restricted
> from command entry.

In that case I'd expect the ! to take them back to the menu
(reentrantly). If your copy of "more" doesn't honour the setting of
the SHELL environment variable then it is IMHO broken. To make "!" do
nothing simply set SHELL=/bin/true.

Quote:> I have checked man pages for these commands but can't see
> any means of enforcing this restriction.

You are probably going about this the wrong way - seeking to treat
individual symptoms rather than the root cause. If you've made the
account "captive" by giving it an ordinary shell and creating a login
script then you will likely find many such holes. Consider doing it
the right way - making the shell entry in /etc/passwd point to the
menu program/script directly.

--

. _\\__[oo from | Phones: +44 121 471 3789 (home)

. l___\\ /~~) /~~[ / [ | PGP-fp: D7 03 2A 4B D8 3A 05 37...
# ll l\\ ~~~~ ~ ~ ~ ~ | http://wcl-l.bham.ac.uk/~bam/

by **Volker Borche** » Fri, 26 Sep 1997 04:00:00

|> You are probably going about this the wrong way - seeking to treat
|> individual symptoms rather than the root cause. If you've made the
|> account "captive" by giving it an ordinary shell and creating a login
|> script then you will likely find many such holes. Consider doing it
|> the right way - making the shell entry in /etc/passwd point to the
|> menu program/script directly.

Or look at smrsh (SendMail Restricted SHell) from sendmail 8.8.x.
It will only allow commands from a single directory to be executed.
No PATH or SHELL setting will override this.

vb
--

by **luv..** » Sun, 28 Sep 1997 04:00:00

> to disable "!" (escape to shell) while they are viewing the file in "more/pg".
> Note, these users generally work from a captive menu and are restricted
> from command entry.

> I have checked man pages for these commands but can't see
> any means of enforcing this restriction.

> Any suggestions would be welcome as well as any other commands I might use to
> accomplish this.

> TIA

the most obvious way is to set their SHELL to be the menu program, so
shelling out just runs it again... other solutions include putting
them inside a chroot'd environment which doesn't contain any shell,
downloading less/more/most and changing the source to disable the
escapes, and you *might* be able to (primo hack) just filter all !
charactors out of the input.

best of luck,
andru

by **era eriksso** » Sun, 28 Sep 1997 04:00:00

> to disable "!" (escape to shell) while they are viewing the file in
>?"more/pg".

Try setting SHELL=/bin/false before running less (perhaps in their
login script). Remember to export :^)

/* era */

--
Paparazzi of the Net: No matter what you do to protect your privacy,
they'll hunt you down and spam you. <http://www.iki.fi/~era/spam/>

Very Computer

Need to disable "!"(escape to shell) while in "more"

Need to disable "!"(escape to shell) while in "more"

Need to disable "!"(escape to shell) while in "more"

Need to disable "!"(escape to shell) while in "more"

Need to disable "!"(escape to shell) while in "more"

Need to disable "!"(escape to shell) while in "more"

Need to disable "!"(escape to shell) while in "more"

Need to disable "!"(escape to shell) while in "more"