How to prevent a file being execute by sh ?

[Kennethyap]

Dear Experts,
I hv a file, how to disable the file being using execute using sh ?

kenneth...

[A. Clay Stephenson]

Essentially, if a user has access to the shell and permission to the file, you can't. If this program is a true executable (i.e not simply a script) then all the user needs is the execute bit set. If this is a shell script then at least the read bit must be set as well -- and in this case the execute bit makes it possible to directly execute the script rather than having to execute it as "sh myscript.sh".

Now, the way to prevent this is to make the file executable only by members of a certain group and to then disable the other execute and/or read bits. Another approach is to really restrict the permissions and then only allow execution under the control of sudo.

[Kennethyap]

Can it add any script or line in to that file to prevent using sh to execute ?

[Peter Nikitka]

Hi,

of course you can put a statement

exit 0

at the beginning of this script or flag it
#!/bin/false

but this would make the script useless and to refuses changes back would require restricting access rights - which better fit for simply disallowing execution and reading without having to change the content of the script.

If you really do not want to have a script executed, crypt it or better remove it.

mfG Peter

[TKeller]

You could add a few more checks to your script (assuming it's a shell script in my examples).

The only real method I can think of is to add a LOGNAME and PPID (with according awk checks) check (both should match and someone didn't just change their LOGNAME variable to whatever your script would allow).

Other than simplistic checks like that, which can be bypassed, I'd take the advice of the previous posters.

[Bill Hassell]

Is this a script that is only to be run by ksh or some other shell? If so, you are missing the interpreter line at the beginning of the script:

#!/usr/bin/ksh

All scripts should have this line. Otherwise, when you run a script without the directive, the current shell (whatever it is) will run the script.

[Kenan Erdey]

hi;

shell=`ps -fp $$|tail -1|awk '{print $(NF-1)}'`
if [ "$shell" = "sh" ]
then
exit
fi

[Raj D. · Accepted solution]

Kennethyap,

Just wondering why do you need this kind of settings. You can use restricted shell rsh , and can use # chmod ugo-x filename to remove the executaion flag.


Cheers,
Raj.