UNIX/Linux shell 脚本是否可以“退出”？并注销当前用户？
我们这里遇到了一个奇怪的问题。不幸的是，我不能随意在此处发布代码，因为它属于供应商，但希望可以提供足够的信息，这样就没有必要了。
如果这里有人可以明确地说“bob”是否可以执行“some_script.sh”，并让它从中途退出他的 su'd 会话并让脚本的其余部分继续，那么很多事情都可以解释作为用户“pete”（最初是冒充“bob”），
我相当确定这是不可能的，但是还有人知道吗？
需要记住的事情：
- scriptA.sh 执行多个其他进程（串行），这些进程对数据库进行更改
- 假设这些是 01.sql 到 10.sql。
- 它通过使用适当的参数执行“sqlplus”来实现此目的。
- “sqlplus”二进制文件可供用户“bob”使用，但不能用于用户“pete”。
- 用户 pete 当前已 su 为用户“bob”，因为 pete 的 PATH 上没有 sqlplus。
- 我们在脚本/数据库中看到的输出表明“01.sql”已成功执行，但其他部分则未成功执行 - 它们因“sqlplus 命令未找到”错误而失败。
干杯，
We're having a strange issue here. Unfortunately I'm not at liberty to post the code here because it belongs to the vendor, but hopefully can provide enough info so that isn't necessary.
Much could be explained if someone here could definitively say whether or not it is possible for 'bob' to execute "some_script.sh", and have it exit out of his su'd session MID-WAY and have the remainder of the script continue as user 'pete' (who originally su'd to impersonate 'bob')
I'm fairly certain that this is not possible, but is there anyone out there that knows otherwise?
Things to keep in mind:
- scriptA.sh executes multiple other processes (serially) which make changes to a database
- lets assume that these are 01.sql through to 10.sql.
- It does this by executing 'sqlplus' with appropriate arguments.
- The 'sqlplus' binary is available to user 'bob', but NOT user 'pete'.
- User pete is currently su'd into user 'bob', because pete doesn't have sqlplus on his PATH.
- The output we saw in the script/database suggested that the '01.sql' was executed successfully, but not the others - they failed with a 'sqlplus command not found' error.
Cheers,
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
根据您提供的信息，“不。这是不可能的。”
如果用户“pete”
su访问“bob”，他会创建一个新的 shell 作为“bob”。从该新 shell 启动的任何进程都以“bob”身份运行。任何脚本，如果以“bob”身份运行，都无法将其用户/UID 更改为“pete”。任何以“bob”启动的进程都无法更改其用户/UID（可执行文件上缺少 setuid 位）。更有可能的是，脚本的一部分正在修改 shell 环境并更改其 PATH 或脚本中的某些其他错误。
From the information you've given, "No. It is not possible."
If user 'pete'
su's to 'bob', he creates a new shell as 'bob'. Any processes started from that new shell are run as 'bob'. Any script, if run as 'bob', cannot change it's user/UID to 'pete'. Any processes started as 'bob' cannot change their user/UID (absent setuid bit on the executable).It's far more likely that part of the script is modifying the shell environment and changing its PATH or some other error within the script.
使用脚本尝试切换 UID 注定会失败。根据定义，需要共享登录的权限系统是不安全的。
按预期方式使用 AIX 权限系统。如果您需要 bob 的凭据来执行任务，则拥有一个 Sandipan 可以执行的程序，该程序将仅针对需要 bob 凭据的任务提升到 bob 权限。
这就是最小权限原则，也是处理这项工作的方法。共享密码是一种糟糕的黑客行为，它会鼓励更糟糕的黑客行为。
Using a script to attempt to switch UIDs is doomed to failure. A permissions system that requires shared logins is – by definition – insecure.
Use the AIX permissions system the way it was intended. If you need bob's credentials to perform a task then have a program that Sandipan can execute which will elevate to bob permissions for only that which needs bob's credentials.
This is the Principle of Least Privilege and is how to handle the job. Shared passwords are a bad hack that encourages worse hacks.