diff --git a/CWRU/CWRU.chlog b/CWRU/CWRU.chlog index 798f0eb6..4ae6b56d 100644 --- a/CWRU/CWRU.chlog +++ b/CWRU/CWRU.chlog @@ -6160,3 +6160,10 @@ general.c - posix_vars: add posix_glob_backslash to the table - posix_initialize: set posix_glob_backslash to 1 when turning on posix mode + + 6/21 + ---- +doc/{bash.1,bashref.texi} + - pathname expansion: note that under some circumstances the shell + will invoke the matching engine for words with unquoted backslashes + - posixglob: document the new shell option and its effects diff --git a/POSIX b/POSIX index f3f4a0b7..b0727fcc 100644 --- a/POSIX +++ b/POSIX @@ -173,62 +173,66 @@ The following list is what's changed when 'POSIX mode' is in effect: option, so numeric arguments to 'shift' that exceed the number of positional parameters will result in an error message. - 45. When the 'alias' builtin displays alias definitions, it does not + 45. Enabling POSIX mode has the effect of setting the 'posixglob' + option, which affects how unquoted backslashes are treated during + filename expansion (*note Filename Expansion::). + + 46. When the 'alias' builtin displays alias definitions, it does not display them with a leading 'alias ' unless the '-p' option is supplied. - 46. When the 'set' builtin is invoked without options, it does not + 47. When the 'set' builtin is invoked without options, it does not display shell function names and definitions. - 47. When the 'set' builtin is invoked without options, it displays + 48. When the 'set' builtin is invoked without options, it displays variable values without quotes, unless they contain shell metacharacters, even if the result contains nonprinting characters. - 48. When the 'cd' builtin is invoked in LOGICAL mode, and the pathname + 49. When the 'cd' builtin is invoked in LOGICAL mode, and the pathname constructed from '$PWD' and the directory name supplied as an argument does not refer to an existing directory, 'cd' will fail instead of falling back to PHYSICAL mode. - 49. When the 'cd' builtin cannot change a directory because the length + 50. When the 'cd' builtin cannot change a directory because the length of the pathname constructed from '$PWD' and the directory name supplied as an argument exceeds PATH_MAX when all symbolic links are expanded, 'cd' will fail instead of attempting to use only the supplied directory name. - 50. The 'pwd' builtin verifies that the value it prints is the same as + 51. The 'pwd' builtin verifies that the value it prints is the same as the current directory, even if it is not asked to check the file system with the '-P' option. - 51. When listing the history, the 'fc' builtin does not include an + 52. When listing the history, the 'fc' builtin does not include an indication of whether or not a history entry has been modified. - 52. The default editor used by 'fc' is 'ed'. + 53. The default editor used by 'fc' is 'ed'. - 53. The 'type' and 'command' builtins will not report a non-executable + 54. The 'type' and 'command' builtins will not report a non-executable file as having been found, though the shell will attempt to execute such a file if it is the only so-named file found in '$PATH'. - 54. The 'vi' editing mode will invoke the 'vi' editor directly when + 55. The 'vi' editing mode will invoke the 'vi' editor directly when the 'v' command is run, instead of checking '$VISUAL' and '$EDITOR'. - 55. When the 'xpg_echo' option is enabled, Bash does not attempt to + 56. When the 'xpg_echo' option is enabled, Bash does not attempt to interpret any arguments to 'echo' as options. Each argument is displayed, after escape characters are converted. - 56. The 'ulimit' builtin uses a block size of 512 bytes for the '-c' + 57. The 'ulimit' builtin uses a block size of 512 bytes for the '-c' and '-f' options. - 57. The arrival of 'SIGCHLD' when a trap is set on 'SIGCHLD' does not + 58. The arrival of 'SIGCHLD' when a trap is set on 'SIGCHLD' does not interrupt the 'wait' builtin and cause it to return immediately. The trap command is run once for each child that exits. - 58. The 'read' builtin may be interrupted by a signal for which a trap + 59. The 'read' builtin may be interrupted by a signal for which a trap has been set. If Bash receives a trapped signal while executing 'read', the trap handler executes and 'read' returns an exit status greater than 128. - 59. Bash removes an exited background process's status from the list + 60. Bash removes an exited background process's status from the list of such statuses after the 'wait' builtin is used to obtain it. There is other POSIX behavior that Bash does not implement by default diff --git a/RBASH b/RBASH index 9478fc64..ad23f8d9 100644 --- a/RBASH +++ b/RBASH @@ -35,3 +35,15 @@ When a command that is found to be a shell script is executed (*note Shell Scripts::), 'rbash' turns off any restrictions in the shell spawned to execute the script. +The restricted shell mode is only one component of a useful restricted +environment. It should be accompanied by setting 'PATH' to a value that +allows execution of only a few verified commands (commands that allow +shell escapes are particularly vulnerable), leaving the user in a +non-writable directory other than his home directory after login, not +allowing the restricted shell to execute shell scripts, and cleaning the +environment of variables that cause some commands to modify their +behavior (e.g., 'VISUAL' or 'PAGER'). + +Modern systems provide more secure ways to implement a restricted +environment, such as 'jails', 'zones', or 'containers'. + diff --git a/doc/bash.0 b/doc/bash.0 index 3a78deff..a31c5bb9 100644 --- a/doc/bash.0 +++ b/doc/bash.0 @@ -1932,27 +1932,29 @@ EEXXPPAANNSSIIOONN PPaatthhnnaammee EExxppaannssiioonn After word splitting, unless the --ff option has been set, bbaasshh scans - each word for the characters **, ??, and [[. If one of these characters - appears, then the word is regarded as a _p_a_t_t_e_r_n, and replaced with an - alphabetically sorted list of filenames matching the pattern (see PPaatt-- - tteerrnn MMaattcchhiinngg below). If no matching filenames are found, and the - shell option nnuullllgglloobb is not enabled, the word is left unchanged. If - the nnuullllgglloobb option is set, and no matches are found, the word is - removed. If the ffaaiillgglloobb shell option is set, and no matches are - found, an error message is printed and the command is not executed. If - the shell option nnooccaasseegglloobb is enabled, the match is performed without - regard to the case of alphabetic characters. When a pattern is used - for pathname expansion, the character ````..'''' at the start of a name or - immediately following a slash must be matched explicitly, unless the - shell option ddoottgglloobb is set. The filenames ````..'''' and ````....'''' must - always be matched explicitly, even if ddoottgglloobb is set. In other cases, - the ````..'''' character is not treated specially. When matching a path- - name, the slash character must always be matched explicitly by a slash - in the pattern, but in other matching contexts it can be matched by a - special pattern character as described below under PPaatttteerrnn MMaattcchhiinngg. - See the description of sshhoopptt below under SSHHEELLLL BBUUIILLTTIINN CCOOMMMMAANNDDSS for a - description of the nnooccaasseegglloobb, nnuullllgglloobb, ffaaiillgglloobb, and ddoottgglloobb shell - options. + each word for the characters **, ??, [[, and, under certain circumstances + (e.g., when it appears in the expansion of an unquoted shell variable, + depending on the setting of the ppoossiixxgglloobb shell option), \\. If one of + these characters appears, then the word is regarded as a _p_a_t_t_e_r_n, and + replaced with an alphabetically sorted list of filenames matching the + pattern (see PPaatttteerrnn MMaattcchhiinngg below). If no matching filenames are + found, and the shell option nnuullllgglloobb is not enabled, the word is left + unchanged. If the nnuullllgglloobb option is set, and no matches are found, + the word is removed. If the ffaaiillgglloobb shell option is set, and no + matches are found, an error message is printed and the command is not + executed. If the shell option nnooccaasseegglloobb is enabled, the match is per- + formed without regard to the case of alphabetic characters. When a + pattern is used for pathname expansion, the character ````..'''' at the + start of a name or immediately following a slash must be matched + explicitly, unless the shell option ddoottgglloobb is set. The filenames + ````..'''' and ````....'''' must always be matched explicitly, even if ddoottgglloobb + is set. In other cases, the ````..'''' character is not treated specially. + When matching a pathname, the slash character must always be matched + explicitly by a slash in the pattern, but in other matching contexts it + can be matched by a special pattern character as described below under + PPaatttteerrnn MMaattcchhiinngg. See the description of sshhoopptt below under SSHHEELLLL + BBUUIILLTTIINN CCOOMMMMAANNDDSS for a description of the nnooccaasseegglloobb, nnuullllgglloobb, ffaaiill-- + gglloobb, and ddoottgglloobb shell options. The GGLLOOBBIIGGNNOORREE shell variable may be used to restrict the set of file names matching a _p_a_t_t_e_r_n. If GGLLOOBBIIGGNNOORREE is set, each matching file @@ -2457,15 +2459,17 @@ AARRIITTHHMMEETTIICC EEVVAALLUUAATTIIOONN to 0. A shell variable need not have its _i_n_t_e_g_e_r attribute turned on to be used in an expression. - Constants with a leading 0 are interpreted as octal numbers. A leading - 0x or 0X denotes hexadecimal. Otherwise, numbers take the form - [_b_a_s_e_#]n, where the optional _b_a_s_e is a decimal number between 2 and 64 - representing the arithmetic base, and _n is a number in that base. If - _b_a_s_e_# is omitted, then base 10 is used. When specifying _n, the digits - greater than 9 are represented by the lowercase letters, the uppercase - letters, @, and _, in that order. If _b_a_s_e is less than or equal to 36, - lowercase and uppercase letters may be used interchangeably to repre- - sent numbers between 10 and 35. + Integer constants follow the C language definition, without suffixes or + character constants. Constants with a leading 0 are interpreted as + octal numbers. A leading 0x or 0X denotes hexadecimal. Otherwise, + numbers take the form [_b_a_s_e_#]n, where the optional _b_a_s_e is a decimal + number between 2 and 64 representing the arithmetic base, and _n is a + number in that base. If _b_a_s_e_# is omitted, then base 10 is used. When + specifying _n, if a non-digit is required, the digits greater than 9 are + represented by the lowercase letters, the uppercase letters, @, and _, + in that order. If _b_a_s_e is less than or equal to 36, lowercase and + uppercase letters may be used interchangeably to represent numbers + between 10 and 35. Operators are evaluated in order of precedence. Sub-expressions in parentheses are evaluated first and may override the precedence rules @@ -5776,6 +5780,12 @@ SSHHEELLLL BBUUIILLTTIINN CCOOMMMMAANNDDSS If set, bbaasshh allows patterns which match no files (see PPaatthhnnaammee EExxppaannssiioonn above) to expand to a null string, rather than themselves. + ppoossiixxgglloobb + If set, bbaasshh makes words containing unquoted backslashes + after expansion eligible for pathname expansion, even if + they don't contain any other unquoted pattern charac- + ters. This option is enabled by default, and is enabled + when _p_o_s_i_x _m_o_d_e is enabled. pprrooggccoommpp If set, the programmable completion facilities (see PPrroo-- ggrraammmmaabbllee CCoommpplleettiioonn above) are enabled. This option is @@ -6182,4 +6192,4 @@ BBUUGGSS -GNU Bash 5.0 2019 May 20 BASH(1) +GNU Bash 5.0 2019 June 21 BASH(1) diff --git a/doc/bash.1 b/doc/bash.1 index d79f3a65..f25be103 100644 --- a/doc/bash.1 +++ b/doc/bash.1 @@ -5,12 +5,12 @@ .\" Case Western Reserve University .\" chet.ramey@case.edu .\" -.\" Last Change: Wed Jun 19 11:22:28 EDT 2019 +.\" Last Change: Fri Jun 21 10:26:44 EDT 2019 .\" .\" bash_builtins, strip all but Built-Ins section .if \n(zZ=1 .ig zZ .if \n(zY=1 .ig zY -.TH BASH 1 "2019 June 19" "GNU Bash 5.0" +.TH BASH 1 "2019 June 21" "GNU Bash 5.0" .\" .\" There's some problem with having a `@' .\" in a tagged paragraph with the BSD man macros. @@ -3546,8 +3546,11 @@ option has been set, scans each word for the characters .BR * , .BR ? , -and -.BR [ . +.BR [ , +and, under certain circumstances (e.g., when it appears in the expansion of +an unquoted shell variable, depending on the setting of the \fBposixglob\fP +shell option), +.BR \e . If one of these characters appears, then the word is regarded as a .IR pattern , @@ -10199,6 +10202,14 @@ files (see above) to expand to a null string, rather than themselves. .TP 8 +.B posixglob +If set, +.B bash +makes words containing unquoted backslashes after expansion eligible for +pathname expansion, even if they don't contain any other unquoted pattern +characters. This option is enabled by default, and is enabled when +\fIposix mode\fP is enabled. +.TP 8 .B progcomp If set, the programmable completion facilities (see \fBProgrammable Completion\fP above) are enabled. diff --git a/doc/bash.html b/doc/bash.html index 2483695c..66260274 100644 --- a/doc/bash.html +++ b/doc/bash.html @@ -3,7 +3,7 @@
| BASH(1) | 2019 May 20 | BASH(1) + | BASH(1) | 2019 June 21 | BASH(1) |
|---|
+Integer constants follow the C language definition, without suffixes or +character constants. Constants with a leading 0 are interpreted as octal numbers. A leading 0x or 0X denotes hexadecimal. Otherwise, numbers take the form [base#]n, where the optional base @@ -5743,6 +5749,7 @@ is a decimal number between 2 and 64 representing the arithmetic base, and n is a number in that base. If base# is omitted, then base 10 is used. When specifying n, +if a non-digit is required, the digits greater than 9 are represented by the lowercase letters, the uppercase letters, @, and _, in that order. If base is less than or equal to 36, lowercase and uppercase @@ -12924,6 +12931,16 @@ files (see above) to expand to a null string, rather than themselves. +
| GNU Bash 5.0 | 2019 May 20 | BASH(1) + | GNU Bash 5.0 | 2019 June 21 | BASH(1) |
|---|