[thirdparty/bash.git] / RBASH

6.10 The Restricted Shell
=========================

If Bash is started with the name 'rbash', or the '--restricted' or '-r'
option is supplied at invocation, the shell becomes restricted.  A
restricted shell is used to set up an environment more controlled than
the standard shell.  A restricted shell behaves identically to 'bash'
with the exception that the following are disallowed or not performed:

   * Changing directories with the 'cd' builtin.
   * Setting or unsetting the values of the 'SHELL', 'PATH', 'ENV', or
     'BASH_ENV' variables.
   * Specifying command names containing slashes.
   * Specifying a filename containing a slash as an argument to the '.'
     builtin command.
   * Specifying a filename containing a slash as an argument to the '-p'
     option to the 'hash' builtin command.
   * Importing function definitions from the shell environment at
     startup.
   * Parsing the value of 'SHELLOPTS' from the shell environment at
     startup.
   * Redirecting output using the '>', '>|', '<>', '>&', '&>', and '>>'
     redirection operators.
   * Using the 'exec' builtin to replace the shell with another command.
   * Adding or deleting builtin commands with the '-f' and '-d' options
     to the 'enable' builtin.
   * Using the 'enable' builtin command to enable disabled shell
     builtins.
   * Specifying the '-p' option to the 'command' builtin.
   * Turning off restricted mode with 'set +r' or 'set +o restricted'.

These restrictions are enforced after any startup files are read.

When a command that is found to be a shell script is executed (*note
Shell Scripts::), 'rbash' turns off any restrictions in the shell
spawned to execute the script.
Commit	Line	Data
95732b49 JA	1	6.10 The Restricted Shell
95732b49 JA	2	=========================
7117c2d2	3
a0c0a00f	4	If Bash is started with the name 'rbash', or the '--restricted' or '-r'
7117c2d2 JA	5	option is supplied at invocation, the shell becomes restricted. A
7117c2d2 JA	6	restricted shell is used to set up an environment more controlled than
a0c0a00f	7	the standard shell. A restricted shell behaves identically to 'bash'
7117c2d2 JA	8	with the exception that the following are disallowed or not performed:
7117c2d2 JA	9
a0c0a00f CR	10	* Changing directories with the 'cd' builtin.
	11	* Setting or unsetting the values of the 'SHELL', 'PATH', 'ENV', or
	12	'BASH_ENV' variables.
7117c2d2	13	* Specifying command names containing slashes.
a0c0a00f	14	* Specifying a filename containing a slash as an argument to the '.'
7117c2d2	15	builtin command.
a0c0a00f CR	16	* Specifying a filename containing a slash as an argument to the '-p'
a0c0a00f CR	17	option to the 'hash' builtin command.
7117c2d2 JA	18	* Importing function definitions from the shell environment at
7117c2d2 JA	19	startup.
a0c0a00f	20	* Parsing the value of 'SHELLOPTS' from the shell environment at
7117c2d2	21	startup.
a0c0a00f	22	* Redirecting output using the '>', '>\|', '<>', '>&', '&>', and '>>'
7117c2d2	23	redirection operators.
a0c0a00f CR	24	* Using the 'exec' builtin to replace the shell with another command.
	25	* Adding or deleting builtin commands with the '-f' and '-d' options
	26	to the 'enable' builtin.
	27	* Using the 'enable' builtin command to enable disabled shell
7117c2d2	28	builtins.
a0c0a00f CR	29	* Specifying the '-p' option to the 'command' builtin.
a0c0a00f CR	30	* Turning off restricted mode with 'set +r' or 'set +o restricted'.
7117c2d2 JA	31
	32	These restrictions are enforced after any startup files are read.
	33
	34	When a command that is found to be a shell script is executed (*note
a0c0a00f	35	Shell Scripts::), 'rbash' turns off any restrictions in the shell
7117c2d2 JA	36	spawned to execute the script.
7117c2d2 JA	37