[colug-432] bash pipe + read?

Rob Funk rfunk at funknet.net
Mon Nov 16 10:51:57 EST 2015


Rick Hornsby wrote:
> I've written a shell script that's meant to be run similar to how you install
> rvm[1] using curl:
> 
> $ curl http://somehost/myscript.sh | sudo bash -s devel

If you do this, at least make it https rather than http, so that
you're not vulnerable to DNS hijacking.

> Alternatively, I could make the user do
> 
> $ wget http://somehost/myscript.sh; chmod 755 myscript.sh; ./myscript.sh

Simpler:
  $ wget http://somehost/myscript.sh; bash ./myscript.sh

> But that seems far less elegant than curl ... | bash

But at least with that solution the user doesn't assume that you
expect them to run it without reading it.



More information about the colug-432 mailing list