Is possible to create a script that disallows the command rm in linux ?
3 Answers
You could create your own shell that mimics the command-line and sends all normal input to the actual command-line except for rm commands.
I wouldn't be surprised if there's a more elegant solution though.
-
Actually no. As far I can see, this is the only way - and you must be VERY restrictive in what you allow the user to do in this shell. No access to a compiler, for instance. Of course no access to other shells or programs which can implicitly execute commands. In fact, it would be a shell where you offer just a very limited amount of features. You can allow sudo as long as you make sure that the commands executed via sudo don't violate these security restrictions. Feb 8, 2017 at 8:48
you could add a alias in your .bashrc
alias rm='rm -i'
this will force you to confirm each time you rm a file unless you run rm -f
and if you alias like this:
alias rm='echo "command rm is forbidden"'
this will forbid the rm command
Note that alias will only prevent you from a miss-typing. not a system security fasten, if you really want user to have root privilege to run rm command:
$which rm
-rwxr-xr-x 1 root root 64424 Jan 20 22:46 /bin/rm
$sudo chomd 744 /bin/rm
that will force the user to be root to run rm
command.
Technically you can't disable root to delete files on your system, because root can do anything, but if user gain the privilege through sudo
(which is not the real user root but gain privilege temporarily) there are ways to disable specific command from running even by sudo through the sudo config file check this post
-
you mean you want to forbid user to run
rm
even with asudo
(which will gain a root privilege) ? Feb 8, 2017 at 4:18 -
-
in that case, you should follow the post I give to restrict commands via
sudo
config fle. Feb 8, 2017 at 5:43
for a specific user you can do like this
Lshell is configured via an INI file. By default, it holds a whitelist of allowed commands, but it can be easily configured to prohibit user from using a specific command.
This configuration (default conf /etc/lshell.conf) prohibits user foo from using mkdir:
[foo]
allowed = 'all' - ['mkdir', 'bash', 'sh', 'csh', 'dash', 'env']
File.unlink()
, and various other method for deleting file. I think this is XY problem. what the actual problem are you facing ?