Question

I would like to start an octave session within a restricted bash shell, or rbash, and thus restrict a user to their home directory.

The rbash works as expected, and the user is unable to use the cd command.

>prompt:~/$ /bin/bash -r
>bash-3.2$ pwd
  /home/user1
>bash-3.2$ cd /
>bash: cd: restricted
>bash-3.2$ 

When octave is started, the user is then able to cd to any directory.

>bash-3.2$ octave --silent
octave-3.4.0:1> pwd
   ans = /home/user1
octave-3.4.0:2> cd /
octave-3.4.0:3> pwd
   ans = /

Is there a way to disable the user account within octave in the way that rbash does?

Thanks.

Answer 1

The easiest is probably a chroot-environment for Octave (chroot(2) / chroot(1)) for your Octave sub-process to isolate users from accessing real /.

Alternatively, you can replace the libc Octave is linked against with one that restricts the chdir(2) library call to directories that are allowed (see LD_PRELOAD).