I have written a shell script for automating some of our repetitive activities. I want all my colleagues to use my script and do the activities automatically by just running the script.
But I do not want them to see the code. Is there a way we can generate something like an executable from the script, so that they have access only to the executable and they cannot see the source code.
I do not want to give just the execute permission. If I do that then I need to store the script in one common place. Since the script needs to be run in many servers then I need to copy the script in all the servers which is duplication and maintanence is difficult and every body will try to change the script.
Instead, I want to generate an executable and give that to my colleagues so that they can run it wherever they want and I alone can maintain the source code.
I have been using shc compiler from long time, now I am moving to another version or different OS where it is not working as expected.
I have shc working pretty well in Solaris 8 , On Solaris 10, I am unable to make/compile shc
make shc on Solaris 10 :
$ make shc
gcc -Wall -O6 -pedantic shc.c -o shc
In file included from /usr/include/sys/signal.h:34,
from /usr/include/signal.h:26,
from shc.c:94:
/usr/include/sys/siginfo.h:259: error: parse error before "ctid_t"
/usr/include/sys/siginfo.h:292: error: parse error before '}' token
/usr/include/sys/siginfo.h:292: error: ISO C forbids data definition with no type or storage class
/usr/include/sys/siginfo.h:294: error: parse error before '}' token
/usr/include/sys/siginfo.h:294: error: ISO C forbids data definition with no type or storage class
/usr/include/sys/siginfo.h:390: error: parse error before "ctid_t"
/usr/include/sys/siginfo.h:392: error: conflicting types for `__proc'
/usr/include/sys/siginfo.h:261: error: previous declaration of `__proc'
/usr/include/sys/siginfo.h:398: error: conflicting types for `__fault'
/usr/include/sys/siginfo.h:267: error: previous declaration of `__fault'
/usr/include/sys/siginfo.h:404: error: conflicting types for `__file'
/usr/include/sys/siginfo.h:273: error: previous declaration of `__file'
/usr/include/sys/siginfo.h:420: error: conflicting types for `__prof'
/usr/include/sys/siginfo.h:287: error: previous declaration of `__prof'
/usr/include/sys/siginfo.h:424: error: conflicting types for `__rctl'
/usr/include/sys/siginfo.h:291: error: previous declaration of `__rctl'
/usr/include/sys/siginfo.h:426: error: parse error before '}' token
/usr/include/sys/siginfo.h:426: error: ISO C forbids data definition with no type or storage class
/usr/include/sys/siginfo.h:428: error: parse error before '}' token
/usr/include/sys/siginfo.h:428: error: ISO C forbids data definition with no type or storage class
/usr/include/sys/siginfo.h:432: error: parse error before "k_siginfo_t"
/usr/include/sys/siginfo.h:437: error: parse error before '}' token
/usr/include/sys/siginfo.h:437: error: ISO C forbids data definition with no type or storage class
In file included from /usr/include/signal.h:26,
from shc.c:94:
/usr/include/sys/signal.h:85: error: parse error before "siginfo_t"
In file included from shc.c:94:
/usr/include/signal.h:111: error: parse error before "siginfo_t"
/usr/include/signal.h:113: error: parse error before "siginfo_t"
*** Error code 1
make: Fatal error: Command failed for target `shc'
The other issue which is not compile issue is on Linux Platform ( Red Hat 2.6 kernel 2.6.9-55.0.2.ELsmp)
I am able to compile shc and comiple my shell scripts using shc without any issues. When my script is running and I do
ps -ef |grep myscript
It is kind of showing whole script in Linux ( That is defeating purpose using shell script compile)
I have tried to contact author few times as well but could not contact so not sure whether his email id got changed.
The particular issue is that you want to do something different to what the tool was originally intended for.
If you pause for a moment and think about it, all of the procedural programming languages are functionally equivalent, and only differ in syntax. So something you can do in shell, you can do in perl, you can do in C.
You've just got to broaden your horizons a bit.
If you do choose to get a shell script compiler, then you are opening yourself (and your employers) up to a maintenance headache.
So, sometimes the answers to questions are not exactly what you wish to hear.
Life is like that...
Porter,
I am not the orginal guy who created this thread in first place. His intention was not to look into code by some colleages but in our case, it is not the intention.
We use some Oracle monitoring scripts which logs on to oracle database with username/password
We don't want to let everybody see username/password and also don't want to hardcode password in shell script also even though users might have read permissions for script and hence we have used shc.
We don't put locks in our home to challenge that an experieced thief can't break the lock, it is just for normal folks who sometimes could change their mind :).
Any way, thanks for your input.
-------------------------------------------------------
There was some other issues which we have even though make shc was okay.
$ ./shc -r -l "" -f pru.sh
pru.sh.x.c:246:24: sys/ptrace.h: No such file or directory
pru.sh.x.c: In function `untraceable':
pru.sh.x.c:274: error: `PTRACE_ATTACH' undeclared (first use in this function)
pru.sh.x.c:274: error: (Each undeclared identifier is reported only once
pru.sh.x.c:274: error: for each function it appears in.)
./shc: Error 0
In order to corrrect this issue, we need to modify shc.c and remove
include <sys/ptrace.h> since ptrace.h does not exists in Solaris 10
and
changed
mine = !ptrace(PTRACE_ATTACH, pid, 0, 0);",
To
mine = !ptrace(10, pid, 0, 0);",
and again make shc
It works okay.
I am writing this here since who knows some body may find this useful and looking for suggestions.
If you pass the password in as either a command line argument or an environment variable then anyone who can run "ps" can see the password to the database. :rolleyes:
If you use the ksh93 shell, there is a command named shcomp that will convert a script into an intermediate machine independent form. ksh93 detects this format whenever it runs a script and execute directly from this intermediate format.
No way, that's where my utility comes in picture. We don't pass Password iin command line or store in profile.
We have Password file ( encrypted) which gets read with this code and decrypted on fly using openssl ( You don't see anything on ps or envionment variables)
$ getSQLPLUS SID system
Login using system@SID successful using tnsnames
SQL*Plus: Release 10.2.0.3.0 - Production on Tue Dec 11 17:11:59 2007
Copyright (c) 1982, 2006, Oracle. All Rights Reserved.
I have known about shcomp but never tried it. I could not find shcomp in my system , possibly, we don't have ksh93 or some package is not installed. How do I know whether I have ksh93 ?
Finally found the solution for issue
Driver Development - where is ctid_t defined? (Solaris 10)
The fix is to build a fresh set of gcc "fixed" headers:
# cd /opt/sfw/gcc-3/lib/gcc-lib/i386-pc-solaris2.9/3.3.2/install-tools/
Then create an interface, i would suggest a web interface, where all your colleagues who are authorized to run the script will click a button and the script will run.
1) you don't need to give anybody your script. you implement the scripts on the servers which it will run from
2) you don't need to obfuscate your script.
3) of course, you must have sound security infrastructure set up for your servers, ie proper access controls, proper configurations of files, etc etc
$0.02
