---
name: "jk_lsh"
section: "8"
platform: "linux"
package: "jailkit"
version: "2.23-2+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/jk_lsh"
---

# jk\_lsh(8)

a shell that limits the binaries it will execute

## NAME

jk\_lsh - a shell that limits the binaries it will execute

## SYNOPSIS

**jk\_lsh -c command**

## DESCRIPTION

The jailkit limited shell jk\_lsh is not an interactive shell. jk\_lsh will only execute commands that are passed during startup (e.g. /bin/sh -c command) and will deny to start all but explicitly allowed commands. All other commands, or regular shell access are denied. This can be used to restrict an account to a specific use. For example, jk\_lsh can be used to make rsync-, cvs-, sftp- or scp-only accounts, or even an account that can start firefox or opera but nothing else.

The allowed actions are read from  */etc/jailkit/jk\_lsh.ini* If you run jk\_lsh inside a changed root jail, make sure jk\_lsh.ini is present inside that chroot jail.

## LIMITATIONS

Some shells can process complex commandlines, such as command1 && command2, or kill \`ps \|grep foo\`. The limited shell jk\_lsh cannot do anything like that, another shell should be used if you want enable such features. It is not planned to include this in any future version.

## OPTIONS

jk\_lsh can do word expansion such as \*.txt expanding to each file that ends with .txt. This is very useful when running rsync or scp with jk\_lsh. Option allow\_word\_expansion should be set to 1 in order to allow this.

jk\_lsh can also set environment variables. This is a comma separated list with key=value pairs.

Options can be set for a specific user, for the primary group of a user, or for all users in section DEFAULT.

## EXAMPLE

An example config file for user test or group test is shown below

```

[DEFAULT]
executables = /usr/bin/scp, /usr/lib/sftp-server, /usr/bin/rsync
paths = /usr/bin/, /usr/lib
allow_word_expansion = 1
[test]
executables = /usr/bin/scp, /usr/lib/sftp-server
paths = /usr/bin/, /usr/lib
allow_word_expansion = 0
umask = 002
[group test]
executables = /usr/bin/rsync
paths = /usr/bin/
allow_word_expansion = 1
environment=TERM=linux,FOO=bar
```

If user test has primary group test, however, he can not execute rsync in the above example. First the user section is checked, and only if no user section is found the primary group section is looked for, and only if no group section is found, the DEFAULT section is looked for. If no section is found, jk\_lsh aborts.

The  **executables** entry specifies all executables that jk\_lsh will execute. The  **paths** entry specifies in which directories jk\_lsh will look for these executables if no path is specified. The PATH environment variable is ignored by jk\_lsh. The  **allow\_word\_expansion** if set to 1, will make jk\_lsh do word expansion (\*, ?, ~, $) using **[wordexp(3)](/wordexp/3.md)** which is very useful for remote commands like  *rsync server:./\* .* or *scp server:somedir/\* /tmp/* **umask** if you want a specific umask

The common way to use jk\_lsh is to use it as default shell for those restricted accounts. It is recommended to run these accounts inside a changed root using  **[jk\_chrootsh(8)](/jk_chrootsh/8.md)**

## FILES

*/etc/jailkit/jk\_lsh.ini* */etc/passwd* *JAIL/etc/jailkit/jk\_lsh.ini* *JAIL/etc/passwd*

## DIAGNOSTICS

jk\_lsh logs errors to syslog, so check your log files. If you run jk\_lsh inside a changed root, you have to have a /dev/log in that changed root. See  **[jk\_socketd(8)](/jk_socketd/8.md)** for more information how to do this.

## SEE ALSO

**jailkit(8)** **[jk\_check(8)](/jk_check/8.md)** **[jk\_chrootlaunch(8)](/jk_chrootlaunch/8.md)** **[jk\_chrootsh(8)](/jk_chrootsh/8.md)** **[jk\_cp(8)](/jk_cp/8.md)** **[jk\_init(8)](/jk_init/8.md)** **[jk\_jailuser(8)](/jk_jailuser/8.md)** **[jk\_lsh(8)](/jk_lsh/8.md)** **jk\_procmailwrapper(8)** **[jk\_socketd(8)](/jk_socketd/8.md)** **[jk\_uchroot(8)](/jk_uchroot/8.md)** **[jk\_update(8)](/jk_update/8.md)** **[chroot(2)](/chroot/2.md)**

## COPYRIGHT

Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Olivier Sessink

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.