/usr/bin/pg - without shell access

[Fred Martin_1]

HP-UX 10.20...I run a database application which makes use of the /usr/bin/pg command, to display text files. Some of the unix-savvy users may discover that they can use ! to drop out of the software and get unix access.

Is there a way to disable this in /usr/bin/pg, or is there a supported replacement?

[A. Clay Stephenson · Accepted solution]

Hi Fred,

HP-UX 11.x's version of pg has the -r option which removes the shell escape. You could then just make a wrapper and you are done. Unfortunately, not available in 10.20.

Regards, Clay

[James R. Ferguson]

Hi Fred:

One way around this is to make the application the default shell in /etc/passwd. Then, if the user is doing 'pg' (or 'more', etc.) and they attempt to "shell-out", they will simply spawn another instance of the application.

...JRF...

[A. Clay Stephenson]

Hi again Fred,

I put my thinking cap on and I have another idea. You could replace /usr/bin/pg with the less command (binary) available from:
http://gatekeep.cs.utah.edu/hppd/hpux/Gnu/less-358/
If you then set an environment var LESSSECURE=1
(in /etc/profile) the shell escape is removed.

Actually less is quite handy in that your users could then move bidirectionally within the text file.


Food for thought,
Clay