ron@men1.UUCP (Ron Flax) (02/09/85)
Does anyone know of a way to pipe a file to more and disallow a user from
invoking a subshell while More is running?
Here's the senario, I have a menu that allows certain users to have root access
to several functions (unjamming the print queue, archiving & restoring files,
etc). One of the options is to allow the user to get a listing of a tape
archive to the screen (piped through More) which of course allows the user to
type a '!sh<return>' and viola! a root shell.
Is there a hidden option to more? Or another version or maybe an alias name,
like page to make more act a little differently?
As always thanks in advance!
Ron@men1 (Ron Flax)
MTACCS Engineering Network
..!{seismo,umcp-cs}!{prometh,cal-unix}!men1!ron
"The opinions expressed herein are mine only if you agree with them."dave@lsuc.UUCP (David Sherman) (02/11/85)
That's easy. Just muck up the environment variable SHELL and
export it to the instance of "more". Try typing
SHELL=/bin/echo more /etc/passwd
to see what I mean.
--
{utzoo pesnta nrcaero utcs}!lsuc!dave
{allegra decvax ihnp4 linus}!utcsrgv!lsuc!davegeoff@desint.UUCP (Geoff Kuenning) (02/12/85)
In article <362@men1.UUCP> ron@men1.UUCP (Ron Flax) writes: >Here's the senario, I have a menu that allows certain users to have root access >to several functions (unjamming the print queue, archiving & restoring files, >etc). One of the options is to allow the user to get a listing of a tape >archive to the screen (piped through More) which of course allows the user to >type a '!sh<return>' and viola! a root shell. How about piping the listing into su real-user-id -c "more" -- Geoff Kuenning Unix Consultant ...!ihnp4!trwrb!desint!geoff