When the basename of the command used to invoke zsh starts with the letter
`r
' or the `-r
' command line option is supplied at invocation, the
shell becomes restricted. Emulation mode is determined after stripping the
letter `r
' from the invocation name. The following are disabled in
restricted mode:
cd
builtin
PATH
, path
, MODULE_PATH
,
module_path
, SHELL
, HISTFILE
, HISTSIZE
, GID
, EGID
,
UID
, EUID
, USERNAME
, LD_LIBRARY_PATH
,
LD_AOUT_LIBRARY_PATH
, LD_PRELOAD
and LD_AOUT_PRELOAD
parameters
/
hash
exec
builtin command to replace the shell with another
command
jobs -Z
to overwrite the shell process' argument and
environment space
ARGV0
parameter to override argv[0]
for external
commands
set +r
or unsetopt
RESTRICTED
These restrictions are enforced after processing the startup files. The
startup files should set up PATH
to point to a directory of commands
which can be safely invoked in the restricted environment. They may also
add further restrictions by disabling selected builtins.
Resctricted mode can also be activated any time by setting the
RESTRICTED
option. This immediately enables all the restrictions
described above even if the shell still have not processed all startup
files.
Go to the first, previous, next, last section, table of contents.