Home / ubuntu / Questions / 1526978
Accepted
WesternGun
Asked: 2024-09-16 21:00:06 +0800 CST

Bash 5 - ghost function: removed but still available in Bash cache - exploit? bug?

  • 772

GNU Bash version 5.1, WSL, Ubuntu 22.04.3 LTS.

$ bash -version
bash -version
GNU bash, version 5.1.16(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
  1. Edit .bashrc, create function foo:
foo() {
    echo 'GHOST'
}

save and exit

  1. Source .bashrc:
. .bashrc

Now foo is a valid function:

type foo
foo is a function
foo ()
{
    echo 'GHOST'
}

  1. Call foo(), it will print GHOST

  2. Edit .bashrc, remove the function, source again

  3. foo as a function still available for calling and type.

  4. Restart a terminal window, it now stops existing.

  5. Of course it also happens when you rename a function; and you keep calling the old version while repeating it pressing UP to use the one in history.

Bug? Feature? Exploit?

bash

1 Answers

  1. Best Answer

    Neither a bug nor a feature nor an exploit but simply a logical result of how things work. Sourcing .bashrc isn't anything special or magic. It doesn't re-create your shell setup or reset your session. It is no different to sourcing any other file, .bashrc is just the default name for the shell initialization file but even that can be changed by using bash --rcfile whatever or by setting BASH_ENV for non-interactive shells.

    So when you source .bashrc, that doesn't remove anything, it simply adds to what you already have. It's like reading a book: after you ahve read one book, reading another book doesn't remove what you have learned in the first one, it simply adds to it. The only real difference is that in the case of bash, anything in the new sourced file that contradicts something in the old will overwrite the old. If, therefore, instead of deleting foo() you added a different foo() function, then this new one would overwrite the old one.

    This isn't any form of caching, by the way. You just have a running process and tell it to import new stuff. The new stuff gets imported, anything that has the same name in the new stuff will be reset to the new values, anything not mentioned in the new stuff won't be touched.

    • 2