Prevent command from running in zsh

Question

In bash I can do:

#!/bin/bash
validate() {
    if [[ "$BASH_COMMAND" == whoami ]]; then
        return 1
    else
        return 0
    fi
}
set -T
trap 'validate' DEBUG
shopt -s extdebug

so that if I run whoami nothing happens.

How can I achieve the same in zsh ? I've looked at preexec but I couldn't find much information in the documentation

Would it not be easier (in bash too) to use whoami () { false; }? — Kusalananda, Feb 22 '24 at 13:14
@Kusalananda, actually in zsh (and most Bourne-like shells, bash being an exception), whoami() false would be enough. In Korn-like shells including bash and zsh, you can also do whoami() ((0)) — Stéphane Chazelas, Feb 22 '24 at 13:53
Related How to display text for non-interactive login shell. What is with people wanting to hijack whoami these days? — Stéphane Chazelas, Feb 22 '24 at 14:28
@StéphaneChazelas whoami was only for illustration purposes. it was the first command I could think of — Foo, Feb 22 '24 at 17:15

score 5 · Accepted Answer · answered Feb 22 '24 at 13:15

5

You can also use the DEBUG trap to skip a command in zsh, but the mechanism to indicate skipping is different: you need to set the err_exit option.

function validate {
    if [[ "$ZSH_DEBUG_CMD" == whoami ]]; then
        setopt err_exit
    fi
}
trap 'validate' DEBUG

answered Feb 22 '24 at 13:15

Gilles 'SO- stop being evil'

829,060

1

Note that one can always work around it by running \whoami or "whoami" or command whoami or env whoami or sh -c whoami or /usr/bin/whoami... – Stéphane Chazelas Feb 22 '24 at 13:55
1

@StéphaneChazelas Or $(base64 -d <<<d2hvYW1pCg==). A blacklist can't be a security measure, and even a whitelist is hard. – Gilles 'SO- stop being evil' Feb 22 '24 at 13:59

Prevent command from running in zsh

1 Answers1