Comparison of command shells

Revision as of 08:05, 13 May 2025 by 24.16.145.80 (talk) (typo fix)
(diff) ← Previous revision | Latest revision (diff) | Newer revision → (diff)

Template:Short description Template:Further Template:More citations needed Template:Use dmy dates

File:Bash screenshot.png
Screen shot of a terminal showing various Bash commands and resulting output.

This article catalogs comparable aspects of notable operating system shells.

General characteristicsEdit

Template:Sticky header Template:Sort-under

Interactive featuresEdit

Template:Sticky header Template:Sort-under

Background executionEdit

Background execution allows a shell to run a command without user interaction in the terminal, freeing the command line for additional work with the shell. POSIX shells and other Unix shells allow background execution by using the & character at the end of command.

CompletionsEdit

Template:Main article

Completion features assist the user in typing commands at the command line, by looking for and suggesting matching words for incomplete ones. Completion is generally requested by pressing the completion key (often the Template:Keypress key).

Command name completion is the completion of the name of a command. In most shells, a command can be a program in the command path (usually $PATH), a builtin command, a function or alias.

Path completion is the completion of the path to a file, relative or absolute.

Wildcard completion is a generalization of path completion, where an expression matches any number of files, using any supported syntax for file matching.

Variable completion is the completion of the name of a variable name (environment variable or shell variable). Bash, zsh, and fish have completion for all variable names. PowerShell has completions for environment variable names, shell variable names and — from within user-defined functions — parameter names.

Command argument completion is the completion of a specific command's arguments. There are two types of arguments, named and positional: Named arguments, often called options, are identified by their name or letter preceding a value, whereas positional arguments consist only of the value. Some shells allow completion of argument names, but few support completing values.

Bash, zsh and fish offer parameter name completion through a definition external to the command, distributed in a separate completion definition file. For command parameter name/value completions, these shells assume path/filename completion if no completion is defined for the command. Completion can be set up to dynamically suggest completions by calling a shell function.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> The fish shell additionally supports parsing of man pages to extract parameter information that can be used to improve completions/suggestions. In PowerShell, all types of commands (cmdlets, functions, script files) inherently expose data about the names, types and valid value ranges/lists for each argument. This metadata is used by PowerShell to automatically support argument name and value completion for built-in commands/functions, user-defined commands/functions as well as for script files. Individual cmdlets can also define dynamic completion of argument values where the completion values are computed dynamically on the running system.

Command historyEdit

Template:Main article Users of a shell may find themselves typing something similar to what they have typed before. Support for command history means that a user can recall a previous command into the command-line editor and edit it before issuing the potentially modified command.

Shells that support completion may also be able to directly complete the command from the command history given a partial/initial part of the previous command.

Most modern shells support command history. Shells which support command history in general also support completion from history rather than just recalling commands from the history. In addition to the plain command text, PowerShell also records execution start- and end time and execution status in the command history.

Mandatory argument promptEdit

Template:Further Mandatory arguments/parameters are arguments/parameters which must be assigned a value upon invocation of the command, function or script file. A shell that can determine ahead of invocation that there are missing mandatory values, can assist the interactive user by prompting for those values instead of letting the command fail. Having the shell prompt for missing values will allow the author of a script, command or function to mark a parameter as mandatory instead of creating script code to either prompt for the missing values (after determining that it is being run interactively) or fail with a message.

Automatic suggestionsEdit

Template:Main article

Shells featuring automatic suggestions display optional command-line completions as the user types. The PowerShell and fish shells natively support this feature; pressing the Template:Keypress key inserts the completion.

Implementations of this feature can differ between shells; for example, PowerShell<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and zsh<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> use an external module to provide completions, and fish derives its completions from the user's command history.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

Directory history, stack or similar featuresEdit

Template:Further Shells may record a history of directories the user has been in and allow for fast switching to any recorded location. This is referred to as a "directory stack". The concept had been realized as early as 1978<ref>Template:Cite book</ref> in the release of the C shell (csh).

Command line interpreters 4DOS and its graphical successor Take Command Console also feature a directory stack.

Implicit directory changeEdit

A directory name can be used directly as a command which implicitly changes the current location to the directory.

This must be distinguished from an unrelated load drive feature supported by Concurrent DOS, Multiuser DOS, System Manager and REAL/32, where the drive letter L: will be implicitly updated to point to the load path of a loaded application, thereby allowing applications to refer to files residing in their load directory under a standardized drive letter instead of under an absolute path.<ref name="DRI_1987_CDOS_User">Template:Cite book</ref>

AutocorrectionEdit

File:Zsh autocompletion and autocorrection demo.gif
Zsh autocompletion and autocorrection demo for a telnet program.

When a command line does not match a command or arguments directly, spell checking can automatically correct common typing mistakes (such as case sensitivity, missing letters). There are two approaches to this; the shell can either suggest probable corrections upon command invocation, or this can happen earlier as part of a completion or autosuggestion.

The tcsh and zsh shells feature optional spell checking/correction, upon command invocation.

Fish does the autocorrection upon completion and autosuggestion. The feature is therefore not in the way when typing out the whole command and pressing enter, whereas extensive use of the tab and right-arrow keys makes the shell mostly case insensitive.

The PSReadLine<ref name="PSReadLine"/> PowerShell module (which is shipped with version 5.0) provides the option to specify a CommandValidationHandler ScriptBlock which runs before submitting the command. This allows for custom correcting of commonly mistyped commands, and verification before actually running the command.

Progress indicatorEdit

A shell script (or job) can report progress of long running tasks to the interactive user.

Unix/Linux systems may offer other tools support using progress indicators from scripts or as standalone-commands, such as the program "pv".<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> These are not integrated features of the shells, however.

Colored directory listingsEdit

JP Software command-line processors provide user-configurable colorization of file and directory names in directory listings based on their file extension and/or attributes through an optionally defined <syntaxhighlight lang="text" class="" style="" inline="1">%COLORDIR%</syntaxhighlight> environment variable.

For the Unix/Linux shells, this is a feature of the Template:Mono command and the terminal.

Text highlightingEdit

The command line processors in DOS Plus, Multiuser DOS, REAL/32 and in all versions of DR-DOS support a number of optional environment variables to define escape sequences allowing to control text highlighting, reversion or colorization for display or print purposes in commands like TYPE. All mentioned command line processors support %$ON% and %$OFF%. If defined, these sequences will be emitted before and after filenames. A typical sequence for <syntaxhighlight lang="text" class="" style="" inline="1">%$ON%</syntaxhighlight> would be <syntaxhighlight lang="text" class="" style="" inline="1">\033[1m</syntaxhighlight> in conjunction with ANSI.SYS, <syntaxhighlight lang="text" class="" style="" inline="1">\033p</syntaxhighlight> for an ASCII terminal or <syntaxhighlight lang="text" class="" style="" inline="1">\016</syntaxhighlight> for an IBM or ESC/P printer. Likewise, typical sequences for <syntaxhighlight lang="text" class="" style="" inline="1">%$OFF%</syntaxhighlight> would be <syntaxhighlight lang="text" class="" style="" inline="1">\033[0m</syntaxhighlight>, <syntaxhighlight lang="text" class="" style="" inline="1">\033q</syntaxhighlight>, <syntaxhighlight lang="text" class="" style="" inline="1">\024</syntaxhighlight>, respectively. The variables %$HEADER% and %$FOOTER% are only supported by COMMAND.COM in DR-DOS 7.02 and higher to define sequences emitted before and after text blocks in order to control text highlighting, pagination or other formatting options.

For the Unix/Linux shells, this is a feature of the terminal.

Syntax highlightingEdit

Template:Main article A defining feature of the fish shell is built-in syntax highlighting, As the user types, text is colored to represent whether the input is a valid command or not (the executable exists and the user has permissions to run it), and valid file paths are underlined.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

An independent project offers syntax highlighting as an add-on to the Z Shell (zsh).<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> This is not part of the shell, however.

PowerShell provides customizable syntax highlighting on the command line through the PSReadLine<ref name="PSReadLine"/> module. This module can be used with PowerShell v3.0+, and is bundled with v5.0 onwards. It is loaded by default in the command line host "powershell.exe" since v5.0.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

Take Command Console (TCC) offers syntax highlighting in the integrated environment.

Context sensitive helpEdit

Template:Main article

4DOS, 4OS2, 4NT / Take Command Console and PowerShell (in PowerShell ISE) looks up context-sensitive help information when Template:Keypress is pressed.

Zsh provides various forms of configurable context-sensitive help as part of its Template:Mono widget, Template:Mono command, or in the completion of options for some commands.

The fish shell provides brief descriptions of a command's flags during tab completion.

Programming featuresEdit

Template:Sort-under

Shell Functions Exception handling Search & replace
on variable substi­tutions
Template:Verth Template:Verth Math function library Linear arrays or lists Template:Verth Template:Verth Template:Verth Pseudo­random number generation Bytecode
Bourne shell 1977 version Template:No Template:Yes Template:No Template:No Template:No Template:No Template:No Template:No Template:No Template:Yes Template:No Template:No
Bourne shell current version Template:Yes Template:Yes Template:No Template:Yes<ref group="nb" name="ReferenceB"/> Template:No Template:No Template:No Template:No Template:No Template:Yes Template:No Template:No
POSIX shell Template:Yes Template:Yes Template:No Template:Yes Template:No Template:No Template:No Template:No Template:No Template:Yes Template:No Template:No
bash (v4.0) Template:Yes Template:Yes Template:Yes
Template:Small
Template:Yes Template:No Template:No Template:Yes Template:Yes Template:No Template:Yes Template:Yes
Template:Small
Template:No
csh Template:No Template:No Template:Yes
Template:Small
Template:Yes Template:No Template:No Template:Yes Template:No Template:No Template:Yes Template:No Template:No
tcsh Template:Partial Template:No Template:Yes
Template:Small
Template:Yes Template:No Template:No Template:Yes Template:No Template:No Template:Yes Template:No Template:No
Hamilton C shell Template:Yes Template:No Template:Yes
Template:Small
Template:Yes Template:Yes Template:Yes Template:Yes Template:No Template:No Template:Yes Template:Yes Template:No
Scsh Template:Yes ? Template:Yes
Template:Small
? ? ? Template:Yes ? Template:Yes Template:Yes Template:Yes
Template:Small
Template:Yes
Template:Small
ksh (ksh93t+) Template:Yes Template:Yes Template:Yes
Template:Small
Template:Yes Template:Yes Template:Yes Template:Yes Template:Yes Template:No Template:Yes Template:Yes
Template:Small
Template:Yes
Template:Small
pdksh Template:Yes Template:Yes Template:No Template:Yes Template:No Template:No Template:Yes Template:No Template:No Template:Yes Template:Yes
Template:Small
Template:No
zsh Template:Yes Template:Yes Template:Yes
Template:Small
Template:Yes Template:Yes Template:Yes
Template:Small
Template:Yes Template:Yes Template:No Template:Yes Template:Yes
Template:Small
Template:Yes
Template:Small
ash Template:Yes Template:Yes (via Template:Mono) Template:No Template:Yes
Template:Small
Template:No Template:No Template:No Template:No Template:No Template:Yes Template:No Template:No
CCP Template:No ? Template:No Template:No ? ? Template:No Template:No Template:No Template:No Template:No Template:No
COMMAND.COM Template:No Template:Partial (only Auto-fail (via Template:Mono (or Template:Mono in some versions of DR-DOS)) Template:No Template:No Template:No Template:No Template:No Template:No Template:No Template:No Template:No Template:No
OS/2 CMD.EXE Template:No Template:No Template:No ? Template:No Template:No ? Template:No Template:No Template:No Template:No Template:No
Windows CMD.EXE Template:Yes
Template:Small
Template:No Template:Yes
Template:Small
Template:Yes
Template:Small
Template:No Template:No Template:Yes
Template:Small
Template:No Template:No Template:No Template:Yes
Template:Small
Template:No
4DOS Template:Yes Template:Yes
Template:Small
Template:Yes
Template:Small
Template:Yes
Template:Small
? ? Template:Yes
Template:Small
Template:No Template:No Template:Yes Template:Yes
Template:Small
Template:Yes
Template:Small
4OS2 ? ? ? ? ? ? ? ? Template:No Template:Yes Template:Yes (Template:Mono function) ?
TCC (formerly 4NT) Template:Yes Template:Yes
Template:Small
Template:Yes
Template:Small
Template:Yes
Template:Small
? ? Template:Yes
Template:Small
? Template:No Template:Yes Template:Yes (Template:Mono function) Template:Yes (via Template:Mono command)
PowerShell Template:Yes Template:Yes (Try-Catch-Finally) Template:Yes
Template:Small
Template:Yes Template:Yes Template:Yes<ref>The .NET System.Math class defines mathematical functions that can be used through the shortcut Template:Mono, e.g. Template:Mono for the sinus function.[1]</ref> Template:Yes Template:Yes Template:Yes<ref>{{#invoke:citation/CS1|citation CitationClass=web

}}</ref>

Template:Yes Template:Yes Template:Yes
rc Template:Yes Template:Yes Template:No Template:Yes ? ? Template:Yes ? Template:No Template:Yes Template:No Template:No
BeanShell Template:Yes Template:Yes ? Template:Yes ? ? Template:Yes Template:Yes Template:No Template:Yes Template:Yes Template:Yes
VMS DCL Template:Yes Template:Yes Template:No Template:Yes Template:No Template:Yes Template:Yes Template:No Template:No Template:No Template:No Template:No
fish Template:Yes Template:Yes Template:Yes Template:Yes Template:Yes Template:Yes Template:Yes Template:No Template:No Template:Yes Template:Yes
Template:Small
Template:No

String processing and filename matchingEdit

Template:Sort-under

Shell String processing Alternation (Brace expansion) Pattern matching (regular expressions built-in) Pattern matching (filename globbing) Globbing qualifiers (filename generation based on file attributes) Recursive globbing (generating files from any level of subdirectories)
Bourne shell 1977 version ? Template:No Template:No Template:Yes
Template:Small
Template:No Template:No
Bourne shell recent version Template:Partial (prefix and suffix stripping in variable expansion) Template:No Template:No Template:Yes
Template:Small
Template:No Template:No
POSIX shell Template:Partial (prefix and suffix stripping in variable expansion) Template:No Template:No Template:Yes
Template:Small
Template:No Template:No
bash (v4.0) Template:Partial (prefix and suffix stripping in variable expansion) Template:Yes Template:Yes Template:Yes
Template:Small
Template:No Template:Yes (Template:Mono)
csh Template:Yes
Template:Small
Template:Yes Template:No Template:Yes Template:No Template:No
tcsh Template:Yes
Template:Small
Template:Yes Template:Yes Template:Yes Template:No Template:No
Hamilton C shell Template:Yes
Template:Small
Template:Yes Template:No Template:Yes Template:No Template:Yes
Template:Small
Scsh ? ? Template:Yes Template:Yes Template:No Template:No
ksh (ksh93t+) Template:Partial (prefix, suffix stripping and string replacement in variable expansion) Template:Yes<ref name="Apress">Template:Cite book</ref> Template:Yes Template:Yes
Template:Small
Template:No Template:Yes (with Template:Mono, no following of symlinks)
pdksh ? Template:Yes<ref name="Apress"/> Template:No Template:Yes Template:No Template:No
zsh Template:Yes (through variable processing: e.g. substring extraction, various transformations via parameter expansion) Template:Yes Template:Yes Template:Yes
Template:Small
Template:Yes Template:Yes (Template:Mono or Template:Mono to follow symlinks)
ash ? ? Template:No Template:Yes Template:No Template:No
CCP Template:No Template:No Template:No Template:No Template:No Template:No
COMMAND.COM Template:No Template:No Template:No Template:Yes
Template:Small
Template:No Template:No
OS/2 CMD.EXE Template:No Template:No Template:No Template:Yes
Template:Small
Template:Partial (only in Template:Mono command) Template:No
Windows CMD.EXE Template:Partial (only through Template:Mono and Template:Mono) Template:No Template:No Template:Yes
Template:Small
Template:Partial (only in Template:Mono command) Template:Yes (via Template:Mono command, or, where available, indirectly via Template:Mono subdir option)
4DOS Template:Yes (through variable functions Template:Mono, extended environment variable processing, various string commands and Template:Mono and Template:Mono) Template:No Template:No Template:Yes
Template:Small
Template:Yes (via Template:Mono attribute and Template:Mono description options and Template:Mono size, Template:Mono time, Template:Mono date, and Template:Mono file exclusion ranges) Template:Yes (via Template:Mono command, or indirectly via Template:Mono command or, where available, Template:Mono subdir option)
4OS2 ? Template:No Template:No ? ? ?
TCC (formerly 4NT) Template:Yes (through variable functions Template:Mono, extended environment variable processing, various string commands and Template:Mono and Template:Mono) Template:No Template:Yes Template:Yes
Template:Small
Template:Yes (via Template:Mono attribute and Template:Mono description options and Template:Mono size, Template:Mono time, Template:Mono date, Template:Mono owner, and Template:Mono file exclusion ranges) Template:Yes (via Template:Mono command, or indirectly via Template:Mono command or, where available, Template:Mono subdir option)
PowerShell Template:Yes
Template:Small
Template:Partial Template:Yes
Template:Small
Template:Yes
Template:Small
? ?
rc ? ? Template:No Template:Yes Template:No Template:No
BeanShell ? ? Template:Yes ? ? ?
VMS DCL Template:Yes Template:No Template:No Template:Yes Template:No Template:Yes (via Template:Mono)
fish Template:Yes
Template:Small
Template:Yes Template:Yes
Template:Small
Template:Yes
Template:Small
Template:No Template:Yes (Template:Mono)

Inter-process communicationEdit

Shell Pipes Command substitution Process substitution Subshells TCP/UDP connections as streams Keystroke stacking
Bourne shell Template:Yes Template:Yes Template:No Template:Yes Template:No Template:N/A<ref group="nb" name="xautomation">xautomation and xdotool can be used to generate keystrokes under X Window System; or a program can be run in a pseudoterminal to be able to control it (as with the Template:Mono tool).</ref>
POSIX shell Template:Yes Template:Yes Template:No Template:Yes Template:No Template:N/A<ref group="nb" name="xautomation"/>
bash (v4.0) Template:Yes Template:Yes Template:Yes
Template:Small
Template:Yes Template:Yes
Template:Small
Template:N/A<ref group="nb" name="xautomation"/>
csh Template:Yes Template:Yes Template:No Template:Yes Template:No Template:N/A<ref group="nb" name="xautomation"/>
tcsh Template:Yes Template:Yes Template:No Template:Yes Template:No Template:N/A<ref group="nb" name="xautomation"/>
Hamilton C shell Template:Yes Template:Yes Template:No Template:Yes Template:No ?
Scsh Template:Yes ? ? ? Template:Yes Template:N/A<ref group="nb" name="xautomation"/>
ksh (ksh93t+) Template:Yes Template:Yes
Template:Small
Template:Yes
Template:Small
Template:Yes Template:Yes
Template:Small
Template:N/A<ref group="nb" name="xautomation"/>
pdksh Template:Yes Template:Yes Template:No Template:Yes Template:No Template:N/A<ref group="nb" name="xautomation"/>
zsh Template:Yes Template:Yes Template:Yes Template:Yes Template:Yes
Template:Small
Template:N/A<ref group="nb" name="xautomation"/>
ash Template:Yes Template:Yes Template:No Template:Yes Template:No Template:N/A<ref group="nb" name="xautomation"/>
CCP Template:No Template:No Template:No Template:No Template:No Template:No
COMMAND.COM Template:Yes Template:No Template:No Template:Partial (only under DR-DOS multitasker via Template:Mono) Template:No Template:No
OS/2 CMD.EXE Template:Yes Template:No Template:No ? Template:No Template:No
Windows CMD.EXE Template:Yes Template:Yes
Template:Small
Template:No Template:Yes
Template:Small
Template:No Template:No
4DOS Template:Yes Template:Yes
Template:Small
? Template:Partial (via Template:Mono and Template:Mono, or via Template:Mono, Template:Mono and Template:Mono and Template:Mono) Template:No Template:Yes (via Template:Mono and Template:Mono)<ref name="4DOS_8.00_HELP">Template:Cite book</ref>
4OS2 Template:Yes ? ? ? Template:No Template:Yes (via Template:Mono)
TCC (formerly 4NT) Template:Yes Template:Yes
Template:Small
? Template:Partial (via Template:Mono and Template:Mono) Template:Yes (via Template:Mono, Template:Mono, Template:Mono, Template:Mono, Template:Mono, Template:Mono and Template:Mono, client only) Template:Yes (via Template:Mono)
PowerShell Template:Yes Template:Yes Template:No Template:Yes Template:Yes ?
rc Template:Yes Template:Yes Template:Yes
Template:Small
Template:Yes Template:No ?
BeanShell Template:No ? ? ? Template:Yes ?
VMS DCL Template:Yes Template:Yes Template:No Template:Yes
Template:Small
Template:Yes
Template:Small
Template:No
fish Template:Yes Template:Yes (Template:Mono) Template:No Template:No Template:No Template:N/A<ref group="nb" name="xautomation"/>

Keystroke stackingEdit

In anticipation of what a given running application may accept as keyboard input, the user of the shell instructs the shell to generate a sequence of simulated keystrokes, which the application will interpret as a keyboard input from an interactive user. By sending keystroke sequences the user may be able to direct the application to perform actions that would be impossible to achieve through input redirection or would otherwise require an interactive user. For example, if an application acts on keystrokes, which cannot be redirected, distinguishes between normal and extended keys, flushes the queue before accepting new input on startup or under certain conditions, or because it does not read through standard input at all. Keystroke stacking typically also provides means to control the timing of simulated keys being sent or to delay new keys until the queue was flushed etc. It also allows to simulate keys which are not present on a keyboard (because the corresponding keys do not physically exist or because a different keyboard layout is being used) and therefore would be impossible to type by a user.

Security featuresEdit

Template:Importance section Template:Sort-under

Shell Secure (password) prompt File/directory passwords Execute permission Restricted shell subset Safe data subset
Bourne shell Template:Some<ref group="nb" name="tty">The shell can use the Template:Mono utility to suppress echoing of typed characters to the screen. This requires multiple steps: 1. reading the current echo state, 2. switching echo off, 3. reading the input, 4. switching echo state back to the original state.</ref> ? Template:N/A<ref group="nb" name="hashbang">The execute permission is enforced by a separate program, the program loader, by refusing to invoke the interpreter (possibly a shell) specified by the script's hashbang. The interpreter does not enforce the execute permission if invoked directly as the program loader would, with the file as an argument; this only requires read permission, as does piping the file as input to the interpreter, in which case the interpreter cannot see the execute permission.</ref> Template:Yes Template:No
POSIX shell Template:Some<ref group="nb" name="tty"/> ? Template:N/A<ref group="nb" name="hashbang"/> Template:No Template:No
bash (v4.0) Template:Yes ? Template:N/A<ref group="nb" name="hashbang"/> Template:Yes Template:No
csh Template:Some<ref group="nb" name="tty"/> ? Template:N/A<ref group="nb" name="hashbang"/> Template:Yes Template:No
tcsh Template:Some<ref group="nb" name="tty"/> ? Template:N/A<ref group="nb" name="hashbang"/> Template:Yes Template:No
Hamilton C shell Template:No Template:No Template:No Template:No Template:No
Scsh Template:Some<ref group="nb" name="tty"/> ? Template:N/A<ref group="nb" name="hashbang"/> Template:No Template:No
ksh (ksh93t+) Template:Some<ref group="nb" name="tty"/> ? Template:N/A<ref group="nb" name="hashbang"/> Template:Yes Template:No
pdksh Template:Some<ref group="nb" name="tty"/> ? Template:N/A<ref group="nb" name="hashbang"/> Template:Yes Template:No
zsh Template:Yes ? Template:N/A<ref group="nb" name="hashbang"/><ref group="nb" name="xperm-complete">The zsh and fish shells also honor the execute permission for command completion.</ref> Template:Yes Template:No
ash Template:Some<ref group="nb" name="tty"/> ? Template:N/A<ref group="nb" name="hashbang"/> Template:Yes Template:No
CCP Template:No Template:No Template:No Template:No Template:No
COMMAND.COM Template:Partial (only under DR-DOS, prompts for password if file/directory is protected) Template:Partial (only under DR-DOS via Template:Mono syntax)<ref group="nb" name="drpwd">Under DR-DOS the password separator for file and directory passwords is a semicolon. This is also supported under 4DOS for as long as the command does not support include lists. Under 4DOS, the password separator must be doubled for all commands supporting include lists in order to distinguish passwords from include lists. Commands not supporting include lists accept both forms. DR-DOS 7.02 and higher optionally accept a doubled semicolon as well, so that doubled semicolons work under both COMMAND.COM and 4DOS regardless of the command executed.</ref> Template:Partial (only under DR-DOS, if files are password-protected for read and/or execute permission)<ref group="nb" name="drexec">DR-DOS supports file passwords for read/write/delete and optionally execute permissions. Files are not protected by default, but the system can be set up so that f.e. batch scripts require a password to read.</ref> Template:No Template:No
OS/2 CMD.EXE Template:No Template:No Template:No Template:No Template:No
Windows CMD.EXE Template:No Template:No Template:No Template:No Template:No
4DOS Template:Yes (via Template:Mono or Template:Mono)<ref group="nb" name="input/p">Template:Mono and Template:Mono echoes back asterisks for each typed character.</ref> Template:Partial (only under DR-DOS via Template:Mono syntax)<ref group="nb" name="drpwd"/> Template:Partial (only under DR-DOS, if files are password-protected for read and/or execute permission)<ref group="nb" name="drexec"/> Template:No Template:No
4OS2 ? Template:No Template:No Template:No Template:No
TCC (formerly 4NT) Template:Yes (via Template:Mono, Template:Mono or Template:Mono)<ref group="nb" name="input/p"/> Template:No Template:No Template:No Template:No
PowerShell Template:Yes<ref group="nb">Template:Mono reads a string of characters from the input device into an encrypted string, one character at a time thus ensuring that there is no memory image of the clear text which could be gleaned from scanning memory, or from crash dumps, memory dumps, paging files, log files or similar.</ref> Template:No Template:No<ref group="nb">PowerShell script files (Template:Mono files) are by default associated with the Notepad editor, not with the PowerShell execution engine. Invoking a Template:Mono file will launch Notepad rather than executing the script.</ref> Template:Yes<ref group="nb">Startup scripts per computer/user can import modules and expose a subset the commands/functions available in the modules.</ref> Template:Yes<ref>{{#invoke:citation/CS1|citation CitationClass=web

}}</ref>

rc Template:Some<ref group="nb" name="tty"/> ? Template:N/A<ref group="nb" name="hashbang"/> Template:Yes<ref>{{#invoke:citation/CS1|citation CitationClass=web

}}</ref>

Template:No
BeanShell ? ? ? ? ?
VMS DCL Template:Yes Template:No Template:Yes Template:Yes Template:No
fish Template:Yes ? Template:N/A<ref group="nb" name="hashbang"/><ref group="nb" name="xperm-complete"/> Template:Yes ?

Secure promptEdit

Some shell scripts need to query the user for sensitive information such as passwords, private digital keys, PIN codes or other confidential information. Sensitive input should not be echoed back to the screen/input device where it could be gleaned by unauthorized persons. Plaintext memory representation of sensitive information should also be avoided as it could allow the information to be compromised, e.g., through swap files, core dumps etc.<ref name="encryptmemory">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

The shells bash, zsh and PowerShell offer this as a specific feature.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Shells which do not offer this as a specific feature may still be able to turn off echoing through some other means. Shells executing on a Unix/Linux operating system can use the Template:Mono external command to switch off/on echoing of input characters.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> In addition to not echoing back the characters, PowerShell's <syntaxhighlight lang="text" class="" style="" inline="1">-AsSecureString</syntaxhighlight> option also encrypts the input character-by-character during the input process, ensuring that the string is never represented unencrypted in memory where it could be compromised through memory dumps, scanning, transcription etc.

Execute permissionEdit

Some operating systems define an execute permission which can be granted to users/groups for a file when the file system itself supports it.

On Unix systems, the execute permission controls access to invoking the file as a program, and applies both to executables and scripts. As the permission is enforced in the program loader, no obligation is needed from the invoking program, nor the invoked program, in enforcing the execute permissionTemplate:Snd this also goes for shells and other interpreter programs. The behaviour is mandated by the POSIX C library that is used for interfacing with the kernel. POSIX specifies that the exec family of functions shall fail with EACCESS (permission denied) if the file denies execution permission (see Template:Man).

The execute permission only applies when the script is run directly. If a script is invoked as an argument to the interpreting shell, it will be executed regardless of whether the user holds the execute permission for that script.

Although Windows also specifies an execute permission, none of the Windows-specific shells block script execution if the permission has not been granted.

Restricted shell subsetEdit

Several shells can be started or be configured to start in a mode where only a limited set of commands and actions is available to the user. While not a security boundary (the command accessing a resource is blocked rather than the resource) this is nevertheless typically used to restrict users' actions before logging in.

A restricted mode is part of the POSIX specification for shells, and most of the Linux/Unix shells support such a mode where several of the built-in commands are disabled and only external commands from a certain directory can be invoked.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

PowerShell supports restricted modes through session configuration files or session configurations. A session configuration file can define visible (available) cmdlets, aliases, functions, path providers and more.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

Safe data subsetEdit

Scripts that invoke other scripts can be a security risk as they can potentially execute foreign code in the context of the user who launched the initial script. Scripts will usually be designed to exclusively include scripts from known safe locations; but in some instances, e.g. when offering the user a way to configure the environment or loading localized messages, the script may need to include other scripts/files.<ref>Template:Cite book</ref> One way to address this risk is for the shell to offer a safe subset of commands which can be executed by an included script.

NotesEdit

Template:Reflist

ReferencesEdit

Template:Reflist

External linksEdit

|CitationClass=web }}

Template:Unix shells