Re: HELP : preventing users from escaping to shell (!sh)

In article <3s8dvf$rbs@nezsdc.fujitsu.co.nz>, [deleted for brevity] > 2: write our our rsystem() function [int rsystem(char*)] to > replace Informix's in the 4gl library. The 4GL "RUN" statement > translates to a call to rsystem(), and our rsystem() guarantees > that /bin/sh instead of $SHELL is used to run the command > passed to it as an argument. You may be able to have rsystem() > simply call system() to achieve this. The programmer can then > use RUN like normal, and it will always work. Alternatively > give this function a new name and change all your existing 4gl > RUN statements to be calls to this function. > The only thing I don't like about that is the use of the system() call. I'd recommend the use of a fork()/exec() combination, since the issue here is security. I'll leave the explanation out for brevity. See "Advanced Programming in the UNIX Environment" by Stevens for a detailed explanation as to why. -Chris -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Christopher Nielsen UCA&L Systems and Network Administrator Buffalo, NY (enkhyl@computel.com) #include <stddisclmer.h>