topic Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others in Operating System - HP-UX

Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Ravi S. Banda — Thu, 18 Jan 2007 16:32:04 GMT

How do I set Execute-Only Permission on a Unix Shell Script for Group & Others?

I would like the group and "others" to be able to just execute my shell script, but not be able to read the shell script.

Could you tell me how I could accomplish it?
Thanks!

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Sandman! — Thu, 18 Jan 2007 16:35:12 GMT

# chmod go-r-w+x filename

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Rick Garland — Thu, 18 Jan 2007 16:39:16 GMT

chmod 111 $FILE
would give perms of --x--x--x for the file
Nobody could read/write the file (except root, of course)

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Ravi S. Banda — Thu, 18 Jan 2007 16:40:12 GMT

But, then, I cannot execute the file because I don't have read permissions on the file. I just tried after reading the reply from you.

cat /etc/lp/interface/myshell.sh
cat: Cannot open /etc/lp/interface/myshell.sh: Permission denied

The above is what I need but:

./myshell.sh
./myshell.sh: Cannot find or open the file.

But, I want to be able to execute.

Thanks!

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

James R. Ferguson — Thu, 18 Jan 2007 16:40:57 GMT

Hi Ravi:

You can't. Shell scripts must be *readable* and executable to be executable (unless you are the root user). The shell interpreter (as specified on the "she-bang" line) must be able to read the file to interpret and execute it.

Regards!

...JRF...

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Jeff_Traigle — Thu, 18 Jan 2007 16:41:22 GMT

While you can set the permissions that way, it won't work. Shell scripts must be read to be executed. See the results:

jtraigle$ ls -l test.sh
-rwx--x--x 1 root sys 35 Jan 18 15:39 test.sh
jtraigle$ ./test.sh
/usr/bin/sh: ./test.sh: Cannot find or open the file.

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Rick Garland — Thu, 18 Jan 2007 16:45:10 GMT

My mistake - I was working as root

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Ravi S. Banda — Thu, 18 Jan 2007 17:05:36 GMT

So, there's no solution?

ps: When I run the script, I login as a non-root user.

Thanks!

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Patrick Wallek — Thu, 18 Jan 2007 17:06:38 GMT

Correct. The script MUST be readable to be executed.

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Patrick Wallek — Thu, 18 Jan 2007 17:13:23 GMT

A good article on shell script security:
http://searchopensource.techtarget.com/tip/0,289483,sid39_gci1216976,00.html

There is a package called SHC that may be of some use to you. I have not used it, but rather just found it via google.

SHC 2.4a
http://hpux.connect.org.uk/hppd/hpux/Shells/shc-2.4a/

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Jeff_Traigle — Thu, 18 Jan 2007 17:27:42 GMT

Well, no direct solution with permissions.

You could configure sudo to take care of it by allowing certain users to execute the script as the scripts owner and set the script permissions to read and execute only for the owner.

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

TwoProc — Thu, 18 Jan 2007 18:33:55 GMT

The program "sudo" would be a nice facilitator for this requirement. Using the sudo tool, you could give execute access to a single .sh script file(or more if needed), but the permission could be set so that the intended user could never read it,only run it.

Of course, you'd have to go through the time & effort to set up "sudo" on the server - but it is useful for many things, and therefore it would pay you back for your effort(s) over time anyway.

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

TwoProc — Thu, 18 Jan 2007 18:39:05 GMT

Ugh,

I just noticed Jeff's posting re: sudo. Excuse the posting.

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Ravi S. Banda — Thu, 18 Jan 2007 21:06:57 GMT

points submitted. Thanks, all.

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

Dennis Handly — Sat, 20 Jan 2007 06:23:06 GMT

This is not MPE/iX where the CI is in bed with the kernel and can get away with only execute permission.

As mentioned by others, you need read permission.

Re: Setting Execute-Only Permission on a Unix Shell Script for Group & Others

A. Clay Stephenson — Sat, 20 Jan 2007 20:47:44 GMT

You have to realize that a shell script is not a true executable; the actual executable in the case is /usr/bin/sh and it (as would any other binary executable) executes without the read bit being set. But in order to execuate an interpreted script (e.g shell script, Perl script, etc.) the read bit must be set.