RBASH(1)

💖 RBASH — the girlies' guide to restricted bash 💖

okay so bestie, welcome to the rbash manual page, straight out of the General Commands Manual section. That's the manual name btw, not a vibe — every page in this section says it. And rbash? It stands for restricted bash, and for the full tea you gotta go read bash(1). This page is just the restricted-flavour deluxe edition. 🎀

---

✨ NAME ✨

rbash — restricted bash, see bash(1)

That's it. That's the whole name section. Short and iconic. 💅

---

🔒 RESTRICTED SHELL 🔒

So here's the deal, queen. If bash gets started with the name rbash, or if you hand it the -r option at invocation, the shell becomes restricted. A restricted shell is what you use when you want an environment that's, like, more controlled than the standard shell — training wheels but make it security. 🦋

It behaves identically to bash, no cap, with the one exception that the following things are disallowed or just straight up not performed:

• Changing directories with cd. (no wandering off bestie, stay put 🫶)
• Setting or unsetting the values of SHELL, PATH, HISTFILE, ENV, or BASH_ENV. (hands off, those are not yours to touch)
• Specifying command names containing /.
• Specifying a filename containing a / as an argument to the . builtin command.
• Using the -p option to the . builtin command to specify a search path.
• Specifying a filename containing a slash as an argument to the history builtin command.
• Specifying a filename containing a slash as an argument to the -p option to the hash builtin command.
• Importing function definitions from the shell environment at startup.
• Parsing the values of BASHOPTS and SHELLOPTS from the shell environment at startup.
• Redirecting output using the >, >|, <>, >&, &>, and >> redirection operators. (no sneaky writing to files, we see you 👀)
• Using the exec builtin command to replace the shell with another command.
• Adding or deleting builtin commands with the -f and -d options to the enable builtin command.
• Using the enable builtin command to enable disabled shell builtins.
• Specifying the -p option to the command builtin command.
• Turning off restricted mode with set +r or shopt -u restricted_shell. Like, absolutely not. The whole point is that it stays on. 💀

Timing matters, bestie: these restrictions are enforced after any startup files are read. So the startup files get their moment, and then the lock clicks shut. 🔐

One more lil plot twist: when a command that turns out to be a shell script gets executed, rbash turns off any restrictions in the shell that's spawned to run that script. So the script itself runs unrestricted — it's giving "the rules apply to you, not to the script." 🌈

---

👀 SEE ALSO 👀

• bash(1)

Yeah that's the only one. Go read it, it's the whole lore. 📖

---

And that's the page, gorgeous. Sending you off with the receipts: this was Bash-5.2, dated 2021 November 22. 🌸 Stay restricted, stay slay. 💖✨🎀