2 ms·

Or "I don't run UNIXes that default to bash, or hide it under /bin/sh, etc." Unfortunately, bash shows up in surprising places, including default Solaris insta

by quesera 12y ago

Or "I don't run UNIXes that default to bash, or hide it under /bin/sh, etc." Unfortunately, bash shows up in surprising places, including default Solaris installs nowadays. On OSX and Solaris, I've chmod'ed 0000 /bin/bash with no apparent ill effect so far. I'll put more effort into establishing its acceptability as a solution tomorrow. BSDs won't have bash unless someone has gone out of their way to install it, which can be undone straightforwardly. But it could be a long night for our Linux brethren and sistren. Good luck, and remember to stay hydrated. :) EDIT: obviously, don't chmod 0000 your login shell! Fix that first. Make sure whatever you switch to isn't a symbolic or hard link to bash.

bodyfour 12y ago
> On OSX and Solaris, I've chmod'ed 0000 /bin/bash with no apparent ill effect so far. In the case of OSX, /bin/sh is also bash. For some reason they are separate binaries (at least on my laptop running 10.9.5) but they're both really bash inside: $ ls -ld /bin/sh /bin/bash -r-xr-xr-x 1 root wheel 1228240 Sep 21 21:37 /bin/bash -r-xr-xr-x 1 root wheel 1228304 Sep 21 21:37 /bin/sh $ /bin/sh --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc. $ /bin/bash --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc. So even if you chmod bash to 0 you could still be exposed by anything that uses /bin/sh -- system(), popen(), most shell scripts, etc (ETA: as I've mentioned elsewhere in this thread most people running OSX probably aren't badly impacted since they're not running CGI-based web software or other high-risk activity. I'm just pointing out that your bash-ectomy of OSX isn't as complete as you think it was)
- quesera 12y ago
  Yikes, yes. Thanks for pointing that out! There might be more of an impact than expected on OSX, too -- no telling what Apple does with their system services. We've seen mention of dhcp-client and CUPS. The latter, at least, could also be an issue on OSX.

by quesera 12y ago

bodyfour 12y ago

> On OSX and Solaris, I've chmod'ed 0000 /bin/bash with no apparent ill effect so far. In the case of OSX, /bin/sh is also bash. For some reason they are separate binaries (at least on my laptop running 10.9.5) but they're both really bash inside: $ ls -ld /bin/sh /bin/bash -r-xr-xr-x 1 root wheel 1228240 Sep 21 21:37 /bin/bash -r-xr-xr-x 1 root wheel 1228304 Sep 21 21:37 /bin/sh $ /bin/sh --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc. $ /bin/bash --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc. So even if you chmod bash to 0 you could still be exposed by anything that uses /bin/sh -- system(), popen(), most shell scripts, etc (ETA: as I've mentioned elsewhere in this thread most people running OSX probably aren't badly impacted since they're not running CGI-based web software or other high-risk activity. I'm just pointing out that your bash-ectomy of OSX isn't as complete as you think it was)

quesera 12y ago
Yikes, yes. Thanks for pointing that out! There might be more of an impact than expected on OSX, too -- no telling what Apple does with their system services. We've seen mention of dhcp-client and CUPS. The latter, at least, could also be an issue on OSX.