Nitpicking the shell history scene in ‘Tron: Legacy’

[Simon Tatham, 2026-05-28] Introduction Spoilers The screenshot Text transcript What can we observe from this screenshot? Summary Footnote Introduction In the 2010 film Tron: Legacy, there's a scene where the main character Sam Flynn sits down at a computer in his father’s study, and types some commands to try to figure out what Flynn senior had last been working on, before mysteriously disappearing. When I first watched the film (conveniently, already on DVD), I paused it so that I could have a close look at the text on the computer screen. What can I say? I’m that kind of geek. The Tron film series as a whole is based on some completely ludicrous premises about how computers work. So I wasn’t expecting realism; more likely I thought it would be hilarious fake-computerese nonsense made up entirely by movie people. In fact I saw an almost plausible Unix shell transcript, whose contents made sense in the context of the film plot – albeit with a couple of nits that jumped out at me immediately. This year, I remembered that scene, and thought it might make a good learning exercise for a junior colleague: let’s look at that still image together and see how much we can understand about it. Can we find all the outright errors? Disregarding things we’ve definitely decided are errors, what can we infer from the rest of it about the computer system and what the Flynns (both of them) are doing with it? I hoped this might be fun, interesting, and/or educational. It succeeded at all three, beyond my hopes! Instead of the half hour I’d guessed, we spent a whole day on it, on and off (exchanging Slack messages, in between other work), and squeezed a lot more juice out of it than I’d realised was there to be squozen. By the end of the exercise, I’d decided one of my own initial complaints was wrong (but found another to replace it), and I’d learned some new things myself. And I ended up more impressed than I’d started, with whoever constructed that screenshot. So, since it ended up being that much fun, here’s a writeup, so that if you’re the same kind of geek as me, you can share the enjoyment!

Spoilers This article will include a minor spoiler for a thing that happens in the film. But it won’t be anything you couldn’t easily have guessed was going to appear somewhere in the film, just from having watched the original 1982 film that this is a sequel to, Tron itself. In any case, even Tron: Legacy is 16 years old by now and another Tron film has come out since, so if you care about spoilers for it at all, you’ve probably already seen it. More to the point, when I set this exercise to my colleague, it was intended as an educational puzzle – the point was to work out the answers, not just hear them in the form of a lecture. So I’m going to take care not to spoil that puzzle. In this article I’ll present all the answers I have, but they’re below a <details> fold, so you can examine the transcript yourself before clicking through, and see how much you can get from it yourself. The screenshot Of course I have to start by showing a still image from the film. My understanding (though I am not a lawyer) is that this should be justifiable under copyright law1I’m sitting in the UK as I write this. Under UK law, I believe this should constitute fair dealing: the purpose is quotation for criticism and review, and this single screen capture is in no way an alternative to paying to see the original film. The film comes from the USA, and under USA law I think it similarly constitutes fair use: it’s for non-profit educational purposes, the amount of the full work used is extremely small, and the effect on the value of the full work negligible.1. However, of course, I don’t have the resources to defend myself in a serious fight against Disney, so if they should demand that I take the image down, I’ll have no choice but to do so. The smears in front of the text, and the uneven background colour behind it, are because the screen is a reflective desk surface which had a thick layer of dust all over it until a moment ago; just before Sam sat down, we saw him wipe some of the dust off. When Sam arrived, the main shell window on the right was empty. Everything shown in it here is commands he typed himself just now, and the computer’s responses to those commands.

Text transcript I’ve typed this out by hand so that you don’t have to: here’s a text transcript of the session in that main shell window. $ whoami flynn $ uname -a SolarOS 4.0.1 Generic_50203-02 sun4m i386 Unknown.Unknown $ login -n root Login incorrect login: backdoor No home directory specified in password file! Logging in with home=/ # bin/history 488 cd /opt/LLL/controller/laser/ 489 vi LLLSDLaserControl.c 490 make 491 make install 492 ./sanity_check 493 ./configure -o test.cfg 494 vi test.cfg 495 vi ~/last_will_and_testament.txt 496 cat /proc/meminfo 497 ps -a -x -u 498 kill -9 2207 499 kill 2208 500 ps -a -x -u 501 touch /opt/LLL/run/ok 502 LLLSDLaserControl -ok 1 # What can we observe from this screenshot? If you’re up for trying this exercise yourself, have a good look at the image above, and see what you can see. When you’re ready, click through the cut below, and you’ll see a list of topics to think about. If those give you useful hints, you’ve got another chance to think harder about each one, before you open each topic in turn to see the thoughts we had about it. Topic list The command that prints the shell history This was the very first thing that jumped out at me when I first watched this film and paused the DVD. Sam requests the shell history by running bin/history instead of just history. Why? I can’t see any possible way that makes sense on real Unix. Shell history is stored in data structures inside the shell process itself, so the history command must be a shell builtin, in order to read out those structures. Even if you only wanted to read out the version of the history stored in a disk file, the name and location of that file varies with the shell and its configuration, so an external command that did that would still be very difficult to get right.

My conclusion at the time – and it still seems fairly plausible to me now – is that this is revealing the technique the filmmakers used to present their fake plot-related shell history. (Like an accidental visible wire, in wire-fu.) I think this shell session was generated by typing commands into a real, carefully configured, Unix machine, and bin/history was a simple shell script that prints that history in place of whatever more boring thing existed in the real shell. (Note, in particular, that the history doesn’t end with the command bin/history! When you run a real shell history command, generally the output ends with the very history command you just typed, because it’s been inserted into the history list before the history list is read back out.) Supposing I’m right, this could have been done better, by wrapping the history shell builtin with an alias or function. Then the user could have typed plain history, and it still could have been made to produce this carefully constructed output. (The same argument doesn’t apply to other commands Sam types in this session, like uname, because those aren’t shell builtins: they’re found on PATH, so you can override them by putting your own directory earlier on PATH. So my guess is that whoever set up this scene knew how to do that, but didn’t know how to do aliases.) The account setup on the computer The first thing Sam sees is a shell prompt, not a login prompt: Flynn had left himself logged in. So he starts by running whoami, to determine who he was logged in as. The computer prints flynn, presumably an unprivileged user account. That’s no good – Sam knows he’s going to need to be root to investigate properly. He tries to log in as root, but fails, so he tries backdoor instead, which succeeds. A natural question is: if root and backdoor are separate accounts, isn’t he about to list the shell history from the wrong one? Surely Flynn was logged in as root to do whatever he was doing. But we can see that the backdoor account has user id 0, the same as root, because after Sam successfully logs in as backdoor, the shell prompt is a # instead of a $. That typically happens when the shell detects that it’s running as the root uid. So backdoor and root share a uid, and so it’s reasonable to guess that they share a home directory and shell history too.

We also see that backdoor’s home directory is taken by login to be the VFS root, /, because nothing better is specified in /etc/passwd. So presumably the shell just read a history file from the VFS root: something like /.bash_history, or at least /.something_history (I don’t think there’s much evidence of exactly what shell this is). It’s fairly plausible that root also has its home directory set to /; that’s not the default on Linux, which gives root a proper home directory of its own, but it was certainly pretty common on proprietary Unixes I used in the 1990s. So that all hangs together: Flynn ran those commands as root, and by a slightly roundabout route, Sam might indeed have logged in to an account that can list them in a natural way. (I’m also a bit suspicious of the use of login to switch user from within an existing login session; one would expect perhaps su? To do this job, /bin/login would need to be setuid, and it certainly isn’t on Linux – it expects to be invoked by programs like getty or (historically) telnetd, which are already root when they run it. Perhaps Solaris (or SolarOS) is different? But it seems unlikely.) Finally, why is there a backdoor account anyway? Normally you make one of those if you have access to a system but are worried that someone will try to take that access away from you (and are unscrupulous). A hacker worried their original entry route will be closed off, or one of the people with root on a system, worrying that the other(s) will take their access away. In this case, it’s Flynn’s own machine; who was he expecting to lock him out of it, to need a back door to get back in? We could simply appeal to Scriptwriters’ Shortcuts: sometimes systems have back doors, so you can assume there is one if the plot requires it, and nobody needs to provide an in-world explanation. But we mostly haven’t had to use that kind of non-answer in this exercise, so I’d rather not. I think a perfectly good in-world explanation is that Sam made the back door, without his dad’s knowledge.