🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.editors
Article #73

Limiting shell escapes and :r, :w and :e in a screen editor

#73
From: David Ljung
Date: Wed, 04 Nov 1992 23:25
51 lines
2293 bytes

Okay..   Here is my question, and it seems to
relate to a question someone asked about vi and shell escapes.

I need a simple, vi-like screen editor, possibly vi itself, that
has the following security precautions:

no shell escapes
no :r or :w or :e of other files..  unless I can limit the files
to a certain path

I do not have su capabilities.

a .exrc file would be okay, because it could be made so that it can't
be removed.

The environment this is going to be run in, and the reason I need
it setup as such is this:

the users will telnet to a machine at a port and be given a shell

from this shell they can uses limited versions of certain commands,
such as cd, rm, tar, compress, etc..   where the args to the commands
are checked to make sure they stay within a certain path...

I want them to be able to use a screen editor, preferably vi, but they
can't execute shell commands or be able to read or write files, because
then they could do things like write over the files of the person who
is running the shell process.

I am willing to use a simple editor that can have its source changed,
any suggestions ther?

Or is there a way to do it in vi, perhaps using .exrc?  And is there
a way to specify the .exrc file when running vi?

Mail would be appreciated, ljung@cae.wisc.edu

Thanks,

------------------------------------------------------------------  (__)  ----
David Ljung                   314 N. Broom St. #3A                  oo )
Spawning Cow! Productions     Madison, WI. 53703               moo. |_/\
                              (608) 257-COWS                ljung@cae.wisc.edu

"The reasonable man adapts himself to the world,
 the unreasonable one persists in trying to adapt the world to himself.
 Therefore, all progress depends upon the unreasonable man."
		-George Bernard Shaw
------------------------------------------------------------------------------
Technical Details
Message-ID: <1992Nov4.172505.10613@doug.cae.wisc.edu>
Path: arc1-ca.pugleaf.net!sparky!uunet!caen!saimiri.primate.wisc.edu!doug.cae.wisc.edu!ljung

Show Full Headers
Complete Article Headers
Newsgroups: comp.editors
Path: arc1-ca.pugleaf.net!sparky!uunet!caen!saimiri.primate.wisc.edu!doug.cae.wisc.edu!ljung
From: ljung@cae.wisc.edu (David Ljung)
Subject: Limiting shell escapes and :r, :w and :e in a screen editor
Organization: Spawning Cow! Productions
Date: 4 Nov 92 17:25:04 CST
Message-ID: <1992Nov4.172505.10613@doug.cae.wisc.edu>
Lines: 51