Restricted shell

🚧 UNDER CONSTRUCTION 🚧

• Related issue: #31
• The Restricted Shell
• https://en.wikipedia.org/wiki/Restricted_shell#Weaknesses_of_a_restricted_shell: "The restricted shell is not secure."
• Bash Startup Files
• Re: Restricted Bash - Not so restrictive (in 4.2 as well)
• 📖 Classic Shell Scripting 15.2. Restricted Shell
  • "To keep the user from overwriting ~/.profile, it is not enough to make the file read-only by the user. Either the home directory should not be writable by the user, or the commands in ~/.profile should cd to a different directory."

chsh(1) — Linux manual page:

An account with a restricted login shell may not change her login shell. For this reason, placing /bin/rsh in /etc/shells is discouraged since accidentally changing to a restricted shell would prevent the user from ever changing her login shell back to its original value.

https://github.com/shadow-maint/shadow/blob/77eb67d4a83600febf326b4551949ce5e71e5a34/src/chsh.c#L124-L136:

/*
 * is_restricted_shell - return true if the shell is restricted
 *
 */
static bool is_restricted_shell (const char *sh)
{
 /*
 * Shells not listed in /etc/shells are considered to be restricted.
 * Changed this to avoid confusion with "rc" (the plan9 shell - not
 * restricted despite the name starting with 'r'). --marekm
 */
 return !shell_is_listed (sh);
}

• Some Environment Variables are Dangerous: IFS
  • AIX IFS Vulnerability
  • Restricted Accounts And Vi(m) Tricks in Linux And Unix also has examples of IFS
• rbash handles SHELL, PATH, HISTFILE, ENV and BASH_ENV
  • ⚠️ Although it does not seem apply for startup files!
• VISUAL & PAGER
  • 📖 Sudo Mastery, 2nd Edition Chapter 8: Managing Pagers
• Bash Variables
• Having PermitUserEnvironment no in your sshd_config is probably a good idea
• CVE-2023-4911: Looney Tunables – Local Privilege Escalation in the glibc’s ld.so
• Toward safer GNU C Library tunable handling
• See "secure-execution mode" in LD.SO(8)

• Running rbash -c /bin/bash naturally doesn't work, but rbash -c bash will work when bash is in PATH.
• pam_env etc. needs to dictate the PATH so that the user never has "regular" PATH e.g. from Bash itself
  • sshd_config needs to have UsePAM yes
  • i️ Setting PATH to /usr/local/rbin seems to break Ansible

Bash's builtin PATH:

• https://github.com/bminor/bash/blob/master/variables.c#L552
• https://github.com/bminor/bash/blob/6794b5478f660256a1023712b5fc169196ed0a22/config-top.h#L63-L67

Debian has /etc/skel/.profile, which modifies PATH as such:

# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ] ; then
 PATH="$HOME/bin:$PATH"
fi
# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/.local/bin" ] ; then
 PATH="$HOME/.local/bin:$PATH"
fi

• Escaping Restricted Linux Shells
  • "Some restricted shells will start by running some files in an unrestricted mode before the restricted shell is applied. If your .bash_profile is executed in an unrestricted mode and it's editable, you'll be able to execute code and commands as an unrestricted user."
• env
• find (-exec)
• Learning the vi Editor: Shell escape
• If we do not typeset -r PATH in /etc/profile in Debian, it is possible to modify it e.g. from $HOME/.profile
• CVE-2016-9401
• Restricted Accounts And Vi(m) Tricks in Linux And Unix
• GTFOBins
• Restricted Shell (rbash, rzsh) Bypass
• Linux Restricted Shell Bypass

• patch 9.0.2070: [security] disallow setting env in restricted mode
  • #13394
  • https://huntr.com/bounties/b0a2eda1-459c-4e36-98e6-0cc7d7faccfe
• < 9.2.0141 :perldo/:perl
• < 9.2.0156 perleval() and rubyeval()
• < 9.2.0176 External diff is allowed in restricted mode (#19696)
  • rvim -c 'set shell=/bin/bash' -c 'set diffopt-=internal' -c 'set shellredir=;/usr/bin/id>/dev/shm/proof.txt\ #>%s' -c 'e /etc/issue' -c 'diffsplit /etc/issue.net' -c 'qa!'
• < 9.2.0177 Vim9: Can set environment variables in restricted mode (#19705)
• < 9.2.0188 Can set environment variables in restricted mode (#19704)
• Command injection via newline in glob() affects Vim < 9.2.0202 (#19746)
  • CVE-2026-33412
  • Neovim PR
• < 9.2.0198 cscope: can escape from restricted mode
• Setting certain variables can help escape rvim. See Should P_SECURE be set to options in restricted mode? #19698.

https://github.com/vim/vim/commit/3849992b16011e36a5cb5be4b127f843389b96fd:

commit 3849992b16011e36a5cb5be4b127f843389b96fd (tag: v7.4.1777)
Author: Bram Moolenaar <Bram@vim.org>
Date: Fri Apr 22 20:46:52 2016 +0200
 patch 7.4.1777
 Problem: Newly added features can escape the sandbox.
 Solution: Add checks for restricted and secure. (Yasuhiro Matsumoto)

• Use rvim instead of vim
  • And rview instead of view
• LESSSECURE

• pam_env enforces PATH when the user's shell is /bin/rbash with the help of pam_succeed_if
  • It needs to come after the "regular" calls to pam_env in the stack so to overwrite PATH if it's being set earlier to something else (e.g. a "normal" PATH)
• A limited amount of (hopefully safe) tools is copied into /usr/local/rbin/

Various safeguards and enforcements are implemented into /etc/profile:

• This takes the assumption that the user is not able to initiate the shell with --noprofile. This also requires that rbash itself is not in the restricted PATH.
• Making known dangerous variables read-only as early as possible
• Enforcing pager into less with LESSSECURE enabled and VISUAL into rvim
• The directory is changed to /var/empty as instructed in various documentations ("changing the current directory to a non-writable directory other than $HOME after login")
  • 💡 I really don't understand the point, as the user is able to create/edit files in other directories with rvim anyway
• User's own startup files (e.g. ~/.profile) are still modifiable and they are executed during login, but the restrictions from /etc/profile should be effective at that point already

⚠️ Do note, that this doesn't affect stuff like procmail, so the user is still able to execute arbitrary stuff from ~/.procmailrc.

No guarantees. Test it, hack it and make sure it's as safe as you might assume from the description above.