Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Run unknown shell script with a line-by-line confirmation prompt

gist.github.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#41

Post by barbazoo »

dumpsterdiver wrote: post #30
dataflow wrote: post #29

Earlier quoted context omitted.

> You should never run shell scripts without reading them first, ever. That is so irresponsible. Do you run on Gentoo? and presumably read the millions of lines of code your machine is running on? People have been downloading and running executables almost pretty much as as the internet has been around... and the world is still going 'round.

I understand your point, but there is a big difference between running a 20 year old program written in C and running a shell script that someone with one or two years of experience hacked out in ten minutes. To answer your question, I do fuzz many of the GNU utilities that I use regularly, and I have discovered vulnerabilities that way. Of course it is unreasonable to read all of the code that runs in our operating…

Plus the risk associated with running Linux or any of the executables is orders of magnitude lower than copy/pasting and running a bash script one found on the internet.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#42

Post by renewiltord »

jjnoakes wrote: post #18
klyrs wrote: post #13

Earlier quoted context omitted.

One complication is that websites can hijack your copy buffer, and the text you paste isn't the text you copied. I avoid this by pasting into an editor, not directly into a shell.

Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.

Realistically, I copy all sorts of commands from all sorts of sites. Some fool has a blog saying "Run `kubectl blahblah -o yaml`" and I copy `kubectl blahblah -o yaml` but he can then inject nonsense in it so when I paste it something else runs.

Fortunately, my terminal emulator doesn't run on paste.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#43

Post by renewiltord »

dumpsterdiver wrote: post #40
Skunkleton wrote: post #37

Earlier quoted context omitted.

You are on HN. Most of us are software engineers. You aren't telling us something we don't know.

If that were true, then why did this post reach the front page of Hacker News? As Larry Wall stated, the three virtues of a programmer are: Laziness, impatience, and hubris. Tools like this embody all three.

There are a hundred reasons to use this script and your responses merely lack imagination:

* Ancient script written by people at the company no longer here that may encode a bunch of assumptions and lots of dead code

* Personal script that is not to the level of full production

* Run untrusted script in a constrained environment to see at what stage it does something ugly - this will bypass obfuscation based on adding lots of dead code

That's like 3 things I already thought of while writing this comment. In like the 90 s it took me to compose this. These ostentatiously dramatic comments of yours aren't that interesting. Hopefully coming generations of engineers will look at your comments and be like "I wish I wasn't like that".

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#44

Post by cookiengineer »

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly.

This script wants to modify:

- /usr/local/program/*

- /etc/program/*

- $HOME/.program

Do you want to execute this? [Yes/No]

..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#45

Post by mlyle »

cookiengineer wrote: post #44

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly. This script wants to modify: - /usr/local/program/* - /etc/program/* - $HOME/.program Do you want to execute this? [Yes/No] ..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

Very difficult to do in any kind of robust way. A script can run all kinds of things and use myriad forms of obfuscation, causing all kinds of obscure side effects.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#46

Post by qiqitori »

opk wrote: post #2

You can also do this with bashdb which is possibly also a more robust solution.

Seconded. It's crazy that so few people seem to know about bashdb. I don't know of many other languages that are commonly used without using a debugger.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#47

Post by cookiengineer »

mlyle wrote: post #45
cookiengineer wrote: post #44

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly. This script wants to modify: - /usr/local/program/* - /etc/program/* - $HOME/.program Do you want to execute this? [Yes/No] ..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

Very difficult to do in any kind of robust way. A script can run all kinds of things and use myriad forms of obfuscation, causing all kinds of obscure side effects.

When trying OPs code out, I had all the "linux binaries" in mind, aka all the shitty self-unpacking installers that concat their binaries and dump it in /tmp before executing it.

(you know, like proprietary drivers almost always do)

It would be a huge improvement for sysadmins if a linter could be run in advance of executing a shell script, and use chroot and other sandboxing like creating a user without net cap rights etc in case it found something potentially malicious.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#49

Post by slaymaker1907 »

protomyth wrote: post #12

It would be interesting to have a shell that allowed transactions like a database and could list what files have been affected while in the transaction.

PowerShell technically does, though I think it is deprecated. It also seems to be less of a security feature and more a tool for keeping the system stable.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#50

Post by scaladev »

klyrs wrote: post #13
barbazoo wrote: post #4

> Useful for running unknown scripts Or just, you know, read them before you run them.

One complication is that websites can hijack your copy buffer, and the text you paste isn't the text you copied. I avoid this by pasting into an editor, not directly into a shell.

Open your shell prompt, press ^X^E, paste the script into the opened editor. Check it for anything malicious, save and exit (or exit without saving if you don't want to execute it). The shell will execute the script.
Post reply on HN