How does a C program using popen(3) to interact with system compare with bash shell?

Question

Are there any limitations using a C 'shell emulator' in this way for a user to send commands to the kernel (in linux)? As an afterthought question, if you set a user to not have shell access, what stops them using something like this to interact with the kernel? (by say running the program from shell_exec via php)?

(by restricting the user, I mean in /etc/passwd) Thanks

Answer 1

Okay, there are several issues here.

First off, popen isn't terrifically satisfactory as a way to emulate a shell, because you won't be able to create your own pipelines and you'll constantly be fighting permissions and things like that.

Second, popen doesn't protect you particularly against malicious commands anyway.

What you really want is to use a restricted shell .

Update

In answer to your second question, pretty much nothing. Which is why you should use that with great care.