0

Assume the Linux root sets a trap on some signal in /etc/bash.bashrc, say:

trap 'rm -f ~/tmpfile' EXIT

root does not want any other user to mess up with this trap. So, he wants to make the trap "read only," such that no user can change it. Is this possible in bash?

1 Answer 1

1

This is not possible using bash (without modifying the source). A user's shell is run in userspace under that user's account, and therefore he has full control of the process. Even if you would change the source of bash, the user would theoretically still be able to upload another bash binary (or overwrite the existing bash's memory) and avoid the limitation.

Proper security/restriction enforcement can only be done on system calls and other kernel-related processes.

1
  • Thanks for the quick response, although I think bash can be (or could have been) equipped with such protection. For instance, one can mark environment variables as read-only, where no subsequent change is possible: superuser.com/q/493793/48606. Apr 2, 2014 at 23:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .