我从 这个 shell 脚本rel="nofollow">此网站。
对于 bash 脚本来说，它大得令人怀疑。所以我用文本编辑器打开它并注意到
代码后面有很多无意义的字符。
我担心使用 chmod +x jd.sh 来正确执行脚本。您能告诉我如何识别它是否安全或如何在系统中设置它的有限权限吗？
谢谢
I downloaded this shell script from this site.
It's suspiciously large for a bash script. So I opened it with text editor and noticed
that behind the code there is a lot of non-sense characters.
I'm afraid of giving the script execution right with chmod +x jd.sh. Can you advise me how to recognize if it's safe or how to set it's limited rights in the system?
thank you
发布评论
评论（3）
“无义字符”表示直接包含在 SH 文件中的二进制文件。该脚本将使用文件本身作为文件存档并根据需要复制/提取文件。对于 SH 安装人员来说，这并不奇怪。 （编辑：例如，makeself）
与其他软件一样，几乎不可能决定是否运行脚本是“安全”的。
The "non-sense characters" indicate binary files that are included directly into the SH file. The script will use the file itself as a file archive and copy/extract files as needed. That's nothing unusual for an SH installer. (edit: for example, makeself)
As with other software, it's virtually impossible to decide wether or not running the script is "safe".
不要运行它！该网站在我工作的地方被屏蔽，因为众所周知它会提供恶意软件。
现在，至于验证代码，如果不完全隔离它（技术上很困难，但如果没有已知漏洞，虚拟机可能会起作用）并运行它来观察它的实际作用，那么实际上是不可能的。使用第三方软件时，适当的不信任总是有用的，但当然没有人有时间验证他们运行的所有软件，甚至是其中的一小部分。这将需要数千年（更可能是数百万年）的工作时间，并且会发现足够多的错误，让开发人员再忙一千年。通常您能做的最好的事情就是仅运行由您至少在某种程度上信任的人创建或至少推荐的软件。信任必须根据您自己的标准来确定，但这里有一些对我来说对软件有利的因素：
Don't run it! That site is blocked where I work, because it's known to serve malware.
Now, as to verifying code, it's not really possible without isolating it completely (technically difficult, but a VM might serve if it has no known vulnerabilities) and running it to observe what it actually does. A healthy dose of mistrust is always useful when using third-party software, but of course nobody has time to verify all the software they run, or even a tiny fraction of it. It would take thousands (more likely millions) of work years, and would find enough bugs to keep developers busy for another thousand years. The best you can usually do is run only software which has been created or at least recommended by someone you trust at least somewhat. Trust has to be determined according to your own criteria, but here are some which would count in the software's favor for me:
虽然脚本的来源似乎不值得信赖（IP 地址？），但这个可能仍然是合法的。使用 shell 脚本，可以在末尾附加二进制内容，从而构建一种安装程序。几年前，Sun 就以这种形式发布了 Solaris 的 JDK。但我不知道情况是否仍然如此。
如果你想无风险地测试它，我会在 VirtualBox（免费虚拟机软件）中安装 Linux，在那里运行脚本，看看它会做什么。
附录看看它的作用：UNIX 上有多种工具可用于分析二进制程序，例如 strace、ptrace、ltrace。可能还有趣的是使用 chroot 运行脚本。这样您就可以轻松找到已安装的所有文件。
但最终这可能会产生更多不易检查的二进制文件（任何防病毒软件开发人员可能都会告诉您）。因此，如果您根本不信任源，请不要运行它。或者，如果您必须运行它，请在虚拟机中执行它，至少它不会造成太大损坏或访问您的任何数据。
While the source of the script does not seem trustworthy (IP address?), this might still be legit. With shell scripts it is possible to append binary content at the end and thus build a type of installer. Years ago, Sun would ship the JDK for Solaris in exactly that form. I don't know if that's still the case, though.
If you wanna test it without risk, I'd install a Linux in a VirtualBox (free virtual-machine software), run the script there and see what it does.
Addendum on see what it does: There's a variety of tools on UNIX that you can use to analyze a binary program, like strace, ptrace, ltrace. What might also be interesting is running the script using chroot. That way you can easily find all files that are installed.
But at the end of the day this will probably yield more binary files which are not easy to examine (as probably any developer of anti-virus software will tell you). Therefore, if you don't trust the source at all, don't run it. Or if you must run it, do it in a VM where at least it won't be able to do too much damage or access any of your data.