Background: We have a lab of Macintosh computers, all running 10.10.3 currently, that are for classroom instruction. Students typically use their own login/password via Active Directory to log in to these machines, however guest(anonymous) access is also available. Traditionally we have never previously allowed students to open/use Terminal.app as the room was used primarily for art, but recently the machines are being used for science and instructors have requested CLI access. Students are not admins and would not be able to use sudo.
Is it safe to remove the restriction preventing students from opening Terminal.app and allow students full access to the bash shell? Are we being over cautious? If not, what types of risks would we be exposed to/need to address prior to allowing such access?