How to allow only certain commands to run in the console?

Question

linux

There was a task in which you need to create a user and allow him to run only! one application in the console.
I tried to slip him curl instead of a shell, but the option is not suitable, since it is necessary for a person to be able to execute a command with parameters in the console.
Other commands must be disabled.
I know about chroot, but there may be other solutions.
Thank you.

Answer 1

In general, "he-asked-myself-answer." The lshell
shell does a good job of solving this problem . The main disadvantage of using chroot to solve this problem is that for the user placed in it, it is required to build a (albeit minimal) environment. That is, you need to duplicate some data, keep track of updates, etc. Lshell is a user shell that allows the user to execute only certain commands and go to specified directories. The config is very simple and understandable, so I figured it out in 10 minutes and already tested this bundle.
After installing the package from the standard Debian repository, you need to slip lshell as a shell to the user and add user parameters to the config, where you need to specify a list of allowed commands, and optionally add directories.

Answer 2

Chroot makes the most sense.
You can change the permissions on all binaries in /usr/bin and similar places so that the user has read permission only for curl. But this is too sweeping a crutch, as I think.

Answer 3

Iron Bars Shell is a restricted Unix shell. The user can not step out of, nor
access files outside the home directory. It is written in C for Linux. No
libraries used. It is small, fast, secure. Two ascii configuration files for
more control.
www: ibsh.sourceforge.net

Answer 4

ACL / chroot will still be more reliable so that you do not have to update - mount --bind . And then you know curl file:///etc/passwd, and anything can happen.