Set PATH in .bashrc depending on shell

Question

I have a user switcher that has different use-cases. It's PATH should depend on whether the current shell is restricted or not. Thus I've added to the end of /home/switcher/.bashrc:

[[ $- == *r* ]] && PATH='' && echo 'restricted' || echo 'unrestricted' 

Yet it doesn't work as expected when switching users:

root@host:~$ sudo -u switcher rbash
unrestricted
switcher@host:~$ echo $PATH
/home/switcher/bin:/usr/local/bin:/usr/bin:/bin
switcher@host:~$ echo $- $SHELL
himrBHs /usr/sbin/nologin

This tells me that .bashrc was in fact executed but apparently outside rbash. What am I missing here? What do I need to change so that PATH='' is set when executing rbash but not in bash?

Note that having different users for the different use-cases unfortunately isn't an option for me.

Answer 1

My tests show that r appears in $- after rbash reads ~/.bashrc, as if the shell was not restricted during processing the file. This corresponds to what the manual says about restrictions:

These restrictions are enforced after any startup files are read.

One of the restrictions is the inability to change PATH. Since you do want to change PATH, it's actually good for your case the restrictions are enforced later. It seems r in $- indicates that the shell is effectively restricted at the moment. You want to detect if it's going to be effectively restricted. You cannot use $- for this.

There is a mechanism designed deliberately for what you need to do. It's in shopt [emphasis mine]:

restricted_shell

The shell sets this option if it is started in restricted mode […]. The value may not be changed. This is not reset when the startup files are executed, allowing the startup files to discover whether or not a shell is restricted.

Use it like this:

shopt -q restricted_shell && PATH='' && echo 'restricted' || echo 'unrestricted'

Or better:

if shopt -q restricted_shell; then
   PATH=''
   echo 'restricted'
else
   echo 'unrestricted'
fi

The latter is better because the second echo depends only on the exit status from shopt. For comparison: in the former snippet (and in your original code) failing first echo would trigger the second echo. With echos this seems marginal, irrelevant or harmless, but if you add more commands then a line with many && and || may surprise you if one of them fails unexpectedly.

Also note that printing anything from .bashrc will break scp and similar software (even printing to stderr may), unless your .bashrc is smart enough.