0

I'm a computer science student on Mac OSX El Capitan. My friend made it so that my computer runs say 'heil hitler' whenever I login to a new instance of Terminal. Needless to say, I need to get rid of it. For now, I have renamed /usr/bin/say to /usr/bin/0say to keep it from going off in public. I have checked ~/.bash_profile, ~/.bashrc, ~/.login, /etc/bashrc. Are there other files automatically run at bash login?

Beyond that, how can I find out what config file is actually calling a given command?

3 Answers 3

0

Use the set command, man page here. Specifically:

  • set -x to show commands after expansion, just before execution

  • set -v to show commands as they are read in, before expansion

For example, insert set -xv at the top of your ~/.profile and you will see everything your terminal is doing after that line. You may want to capture that output (or copy-paste from Terminal into a text document) and do something like grep -B 4 hitler to give you an idea of where it is.

1
  • Thank you for your reply. Doing set -xv showed me that there was a large number of empty lines being run between my ~/.bash_profile and the say 'heil hitler'. Turns out my friend had hidden it after a bunch of new lines in my ~/.bash_profile.
    – Dumonu
    Dec 10, 2016 at 23:07
1

Several investigation techniques come to mind:

  • In addition to the shell init files you looked at, check ~/.profile, ~/.bash_login, and /etc/profile.

  • For the per-user init files, try disabling them by renaming; if removing one particular file keeps it from running say, then you know it's something in that file. You can also put a return command partway through an init file to see if the call to say is before or after that point.

  • You can add set -x in an init file, and it'll make the shell print out commands as it executes them; makes tracing execution easy.

  • Brute force search your home folder: grep -r hitler ~

0

It looks like you've already solved the problem but I would have also checked my Terminal shortcut. It could have been replaced with any number of script shortcuts, AppleScript being the most likely, to perform this prank.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .