On 11/15/2010 12:27 PM, John Haxby wrote:
On 15 November 2010 12:36, Richard W Jerrido <[email protected] <mailto:[email protected]>> wrote: On 12 November 2010 22:46, Srija <[email protected] <mailto:[email protected]> <mailto:[email protected] <mailto:[email protected]>>> wrote: The problem is, if an user login , as himself , he can't change TMOUT parameter until he changes the shell. If the user changes the shell , it can be modified. You can declare readonly variables bash using the following: [u...@somehost ~]$ TMOUT=900 [u...@somehost ~]$ readonly TMOUT [u...@somehost ~]$ export TMOUT or [u...@somehost ~]$ declare -rx TMOUT=900 Then trying to change the value of TMOUT gives the following: [u...@somehost ~]$ export TMOUT=150 -bash: TMOUT: readonly variable For system-wide effect, it would be advisable to set the above in a file in /etc/profile.d/ such as /etc/profile.d/auto_logout.sh. Note, that this would only apply to Bourne-compatible shells, so you'd also need to do something similar if you have any csh users. It doesn't solve the problem: $ declare -tx TMOUT=900 $ TMOUT=1000 bash: TMOUT: readonly variable $ exec bash $ TMOUT=1000 $ printenv TMOUT 1000 You can't make the read-only status of a variable persist across an exec. As I said before, you could make it harder to circumvent by putting the command in /etc/bashrc, but unless I'm mistaken that doesn't get called used a user's ~/.bashrc specifically sources it. jch
You are correct. You cannot (AFAIK) make the read-only status persist across an exec. But you can ensure (to a certain extent) that the TMOUT variable gets defined again. That is why I suggested placing the commands in an /etc/profile.d/ file as this gets sourced by both /etc/profile and /etc/bashrc. Granted, this method isn't perfect as it doesn't stop an enterprising user from running exec bash --noprofile --norc and blowing this whole theory out of the water. But as long as one understands its limitations, it works fairly well.
_______________________________________________ rhelv5-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/rhelv5-list
