1

Is it possible to restrict the user from changing some set of environment variables?

I have have a script that sets PATH to point at a specific build of some software, and puts the user in a new bash session. I'm wondering if it's possible to make PATH (and a handful of other variables) unchangeable for that session of bash, forcing them to exit if they'd like to start changing the parts of their environment that would affect how the software runs.

1 Answer 1

3

This will do what you want:

readonly PATH
3
  • 2
    I'm not sure that that would help. The users could always reexececute bash again. Or run another shell. Or ... Maybe a chroot environment would be better.
    – maxelost
    Jan 21, 2011 at 16:28
  • Agreed, if the PATH isn't set appropriately to start with, then the user can get around the restriction - how important this is depends on the exact use case. As you say, chroot is worth investigating, as is setting the shell to rbash ("bash -r") to restrict what the user can do. Jan 21, 2011 at 16:47
  • In this case, it's just an extra check to avoid mistakes. Depending on what the user specifies, their PATH points to a handful of bin/ dirs (and LD_LIBRARY_PATH to a handful of lib/ dirs, etc.). I'm trying to reduce that chances that after they run my script to "use environment X" they change something important taking them out of the selected "software quarantine." Jan 21, 2011 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .