There are restricted versions of the Bourne and Korn shells - rsh(1) and rksh(1) - that prohibit changing directory with cd, setting the value of $PATH, using command names containing slashes, and redirecting output using > and >>.