Setting Execute-Only Permission on a Unix Shell Script for Group & Others

[Ravi S. Banda]

How do I set Execute-Only Permission on a Unix Shell Script for Group & Others?

I would like the group and "others" to be able to just execute my shell script, but not be able to read the shell script.

Could you tell me how I could accomplish it?
Thanks!

[Sandman!]

# chmod go-r-w+x filename

[Rick Garland]

chmod 111 $FILE
would give perms of --x--x--x for the file
Nobody could read/write the file (except root, of course)

[Ravi S. Banda]

But, then, I cannot execute the file because I don't have read permissions on the file. I just tried after reading the reply from you.

cat /etc/lp/interface/myshell.sh
cat: Cannot open /etc/lp/interface/myshell.sh: Permission denied

The above is what I need but:

./myshell.sh
./myshell.sh: Cannot find or open the file.

But, I want to be able to execute.

Thanks!

[James R. Ferguson]

Hi Ravi:

You can't. Shell scripts must be *readable* and executable to be executable (unless you are the root user). The shell interpreter (as specified on the "she-bang" line) must be able to read the file to interpret and execute it.

Regards!

...JRF...

[Jeff_Traigle]

While you can set the permissions that way, it won't work. Shell scripts must be read to be executed. See the results:

jtraigle$ ls -l test.sh
-rwx--x--x 1 root sys 35 Jan 18 15:39 test.sh
jtraigle$ ./test.sh
/usr/bin/sh: ./test.sh: Cannot find or open the file.

[Rick Garland]

My mistake - I was working as root

[Ravi S. Banda]

So, there's no solution?

ps: When I run the script, I login as a non-root user.

Thanks!

[Patrick Wallek]

Correct. The script MUST be readable to be executed.

[Patrick Wallek]

A good article on shell script security:
http://searchopensource.techtarget.com/tip/0,289483,sid39_gci1216976,00.html

There is a package called SHC that may be of some use to you. I have not used it, but rather just found it via google.

SHC 2.4a
http://hpux.connect.org.uk/hppd/hpux/Shells/shc-2.4a/

[Jeff_Traigle]

Well, no direct solution with permissions.

You could configure sudo to take care of it by allowing certain users to execute the script as the scripts owner and set the script permissions to read and execute only for the owner.

[TwoProc]

The program "sudo" would be a nice facilitator for this requirement. Using the sudo tool, you could give execute access to a single .sh script file(or more if needed), but the permission could be set so that the intended user could never read it,only run it.

Of course, you'd have to go through the time & effort to set up "sudo" on the server - but it is useful for many things, and therefore it would pay you back for your effort(s) over time anyway.

[TwoProc]

Ugh,

I just noticed Jeff's posting re: sudo. Excuse the posting.

[Ravi S. Banda]

points submitted. Thanks, all.

[Dennis Handly]

This is not MPE/iX where the CI is in bed with the kernel and can get away with only execute permission.

As mentioned by others, you need read permission.

[A. Clay Stephenson]

You have to realize that a shell script is not a true executable; the actual executable in the case is /usr/bin/sh and it (as would any other binary executable) executes without the read bit being set. But in order to execuate an interpreted script (e.g shell script, Perl script, etc.) the read bit must be set.