blog.6admin.io
guest@6admin.io:~$
bash, security, shc

Compiling a shell script with shc

A shell script is text readable by everyone: cat script.sh shows the code, any passwords, the business logic. shc (shell script compiler) transforms the script into a binary: the script is compiled into C, the C is compiled into an ELF binary and the text source is no longer readable.

The principle

shc -f script.sh

shc generates two files:

  • script.sh.x : the executable ELF binary
  • script.sh.x.c : the generated C source (delete after compiling)

The binary script.sh.x runs like the original script, but the shell code is not readable in the binary.

What shc does NOT do

shc is not encryption. It is obfuscation. The binary contains the shell script in clear text (XORed with a key) and the key is in the binary. strings script.sh.x reveals nothing because the XOR masks the text, but a debugger (gdb) reveals everything: the script is decoded in memory before execution and at that moment, it is readable in /proc/pid/mem or in a core dump.

shc protects against cat script.sh, not against gdb script.sh.x. If a password is in the script, shc does not protect it. If the business logic is in the script, shc visually masks it, not cryptographically.

The options

shc -f script.sh -o script_bin     # custom output name
shc -f script.sh -r                # relaxation (allowed on different machines)
shc -f script.sh -T                # traceable (anti-strace off)
shc -f script.sh -e 31/12/2008 -m "Expired"  # expiration

The -e option makes the binary expire on a given date: the binary refuses to run after the date. It is a form of DRM (bypassable by changing the system clock, but functional for basic use).

The legitimate use case

The legitimate use case of shc is not security: it is deployment. A shell script that must be executed by an operator who should not see the code (by contract, not by technical security) can be shc-compiled. The operator runs the binary and the code is not readable in cat.

The password in the script? Do not put it in the script. Use sudo, use environment variables, use a password manager. shc does not protect secrets, it masks the code.