this post was submitted on 28 Jun 2023
16 points (100.0% liked)

Linux

48372 readers
1340 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
16
Bash script analysis (self.linux)
submitted 1 year ago* (last edited 1 year ago) by Agility0971 to c/[email protected]
13 comments fedilink hide all child comments
 

I wonder is there any program that can take a bash script as input and print out all bash commands it will run? A program that would unroll loops, expand environment variables and generally not perform any destructive action nor call any external binaries. It's like a dry run of sorts.

Edit: I've created a script that updates ufw rules. I wanted to use multiple IP addresses as a range and multiple interfaces like this:

ufw add limit in on eth0,eth1 from 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16 to any port 22 comment "allow SSH on LAN"

but ufw does not support setting multiple interfaces and multiple interfaces comma separated like ports so I created a script instead.

# ...
lan_ip_range=('172.16.0.0/12' '10.0.0.0/8' '192.168.0.0/16')
for ip_lan in "${lan_ip_range[@]}"; do
	# SSH
	ufw add limit in on eth0 from "$ip_lan" to any port 22 comment "allow SSH on LAN"
	ufw add limit in on eth1 from "$ip_lan" to any port 22 comment "allow SSH on LAN"
# ...
	done

I want to make sure it does what I expect it to do. so expected output should be something like this:

ufw add limit in on eth0 from 172.16.0.0/12 to any port 22 comment "allow SSH on LAN"
ufw add limit in on eth0 from 10.0.0.0/8 to any port 22 comment "allow SSH on LAN"
ufw add limit in on eth0 from 192.168.0.0/16 to any port 22 comment "allow SSH on LAN"
top 9 comments
sorted by: hot top controversial new old
[–] [email protected] 10 points 1 year ago* (last edited 1 year ago) (2 children)

Found this over on Stackoverflow

You could try running the script under Kornshell. When you execute a script with ksh -D, it reads the commands and checks them for syntax, but doesn't execute them. Combine that with set -xv, and you'll print out the commands that will be executed.

You can also use set -n for the same effect. Kornshell and BASH are fairly compatible with each other. If it's a pure Bourne shell script, both Kornshell and BASH will execute it pretty much the same.

You can also run ksh -u which will cause unset shell variables to cause the script to fail. However, that wouldn't have caught the catless cat of a nonexistent file. In that case, the shell variable was set. It was set to null.

Of course, you could run the script under a restricted shell too, but that's probably not going to uninstall the package.

That's the best you can probably do.

[–] [email protected] 7 points 1 year ago* (last edited 1 year ago) (2 children)

I agree that's probably the best you can do, but if it just printing the statements it sees and not actually running them, the behavior when it is run could be very different. For example:

touch a_file
if test -f a_file; then 
  rm -rf / 
fi

To do what OP is asking for would require running inside a sandbox.

[–] [email protected] 3 points 1 year ago

yeah i think a sandbox would be the best solution.

Depending on what script OP is trying to run it would be best to just "rebuild" the potentially affected part of your system inside a VM and see what happens.

[–] Agility0971 2 points 1 year ago* (last edited 1 year ago)

I've updated the question so you can see what I'm trying to do. If I would do it in a sandbox then a simple docker container should do, but it would be nice to see a "compiled" version of the script. I could imagine a program that runs the shell script in a containerized environment and if it does not find the program it just echoes it in stead of printing an error or something?

[–] [email protected] 2 points 1 year ago

This is great—I've somehow never noticed set -n before. Very helpful.

[–] [email protected] 8 points 1 year ago* (last edited 1 year ago) (1 children)

It would depend. Bash allows for command substitution, so it's possible that there are commands in a script where you would only know what they would do by running other lines in the script.

Edit: also, this is treading dangerously close to the Halting Problem. Imagine for a moment that you succeeded in creating such a program, written in Bash. Now imagine you gave this program its own source code as input. What would you expect it to tell you?

[–] [email protected] 6 points 1 year ago

This is not close to the halting problem, it is harder than the halting problem. ;-)

[–] saucyloggins 1 points 1 year ago (1 children)

This is way over complicating the issue. Just replace the actual commands you’re worried about with printf. You can even format it so it prints the exact command you WOULD run.

If you want to get fancy with add a flag to you script like —test or —execute or something where it either prints what it’s going to run or actually executes them.

[–] Agility0971 2 points 1 year ago

yes, I could do that but If I ever would check some other script this way, a script I didn't write my self, then I would need to edit that as well. I'm now thinking of something like a container that runs a script and replaces command not found errors with an echo of the command in question.

load more comments
view more: next ›