How Linux Restricted Shell (rbash) Limits Users

A restricted shell, commonly implemented as rbash, is a specialized mode of the GNU Bash shell designed to establish a controlled execution environment on Linux systems. By disabling specific built-in shell capabilities—such as changing directories, modifying critical environment variables, and executing commands outside designated directories—the operating system prevents unauthorized system navigation and command execution. This article explains how the Linux operating system enforces these constraints, how administrators configure them, and the critical security factors involved in maintaining an effective rbash environment.

Invocation and Detection of Restricted Mode

Linux initiates restricted mode in one of two primary ways:

1. Direct Invocation: Executing the standard Bash binary with the -r flag (bash -r).
2. Binary or Symlink Naming: Running Bash through a symbolic link named rbash (e.g., /bin/rbash -> /bin/bash).

When Bash launches, it inspects argument zero (argv[0]). If the command name starts with rbash, or if the -r flag is present, Bash sets an internal flag that locks down specific operational features before executing any user input.

Core Restrictions Enforced by rbash

Once restricted mode is active, the shell disables operations that would typically allow a user to explore or manipulate the underlying operating system:

• Directory Navigation: The cd (change directory) command is disabled. Users cannot leave the working directory assigned to them upon login.
• Path-Based Execution: Users cannot run commands containing a slash (/). This stops users from bypassing the restricted environment by typing absolute paths (like /bin/sh or /usr/bin/python) or relative paths (like ../../bin/ls).
• Environment Variable Protection: Users cannot unset or modify core environment variables, specifically PATH, SHELL, ENV, and BASH_ENV. This prevents users from redirecting the shell to lookup binaries in unauthorized directories.
• Redirection Restrictions: Redirection operators that write to files (>, >|, >>, and <>) are disabled. This stops users from overwriting startup files or writing malicious scripts to disk.
• Shell Function and Option Lockdown: The set +r or set +o restricted commands cannot be used to disable restricted mode from within the shell session.

Configuration and the Confinement Workflow

To confine a user, a system administrator typically assigns /bin/rbash as the user's default shell in /etc/passwd. Confinement is managed through the user's PATH configuration:

1. Custom Binary Directory: The administrator creates a dedicated, secure directory (such as /home/username/bin).
2. Selective Command Availability: The administrator symlinks only safe, approved binaries into that directory (e.g., clear, who, or custom scripts).
3. Environment Lockdown: In the user's read-only .bash_profile or .bashrc, the administrator sets PATH=$HOME/bin and exports it.

Because rbash users cannot use slashes in commands and cannot modify PATH, they can only execute the specific programs present in /home/username/bin.

Security Limitations and Escape Vectors

While rbash restricts shell built-ins, it does not provide kernel-level isolation, sandboxing, or the complete filesystem virtualization of a chroot jail or container. The security of rbash relies entirely on the binaries placed in the user's PATH.

If a permitted binary provides an internal shell escape or file-editing capability—such as vim, less, more, man, find, or scripting interpreters like python or perl—the user can spawn an unrestricted subshell (/bin/sh) from within that application, effectively bypassing all rbash constraints. Consequently, administrators must audit every binary made accessible to a restricted user.