[Hugh Grierson: Re: HELP : preventing users from escaping to shell (!sh)]

From: Hugh Grierson <hugh@nezsdc.fujitsu.co.nz> }In article <hM8fGY+.meyer412@delphi.com>, }Richard Meyer <meyer412@delphi.com> wrote: }> The Unix system we are using at work has a security problem. We have a }> class of user which requires access to the Informix database. Informix allows }> the users to escape to the shell. We don't want this. Informix suggested }> setting the users shell variable to "" and exporting that before invoking }> the application. }> }> This only works if the application does not try to invoke another shell. }> In that case the application does not work properly. I've played around with }> different variations of this solution, but to no avail. }> }> Has anybody solved this problem before? If so what is the solution? }I assume your applications are Informix-4GL, since you mention them }trying to invoke another shell. } }Our solution was as follows: } } 1: set $SHELL to an empty string in the users' profiles } } 2: write our our rsystem() function [int rsystem(char*)] to ...deleted .... } 3: write a shell escape function which should be used in place } of the RUN statement in 4gl when the programmer wants to allow ....deleted.... -- }Hugh Grierson hugh@fujitsu.co.nz Nuke Chirac We also need a solution to this problem, but do not use 4gl, simply sperforming forms. The users can get out of the forms or the isql menus with !. We also cannot set SHELL to "" because many of the menus run shell commands. Is there another solution? We are running 4.0 version, so nothing from the newer versions please. someday, maybe.....(dream...) Ann