# man > rush.rc(5) [_RUSH.RC_(5)](https://www.chedong.com/phpMan.php/man/RUSH.RC/5/markdown) Rush User Reference [_RUSH.RC_(5)](https://www.chedong.com/phpMan.php/man/RUSH.RC/5/markdown) ## NAME rush.rc - configuration rules for remote user shell ## DESCRIPTION The file **/etc/rush.rc **contains a set of rules that the [**rush**(8)](https://www.chedong.com/phpMan.php/man/rush/8/markdown) shell uses in order to deter‐ mine whether the user is allowed to execute the requested command and to set up the environ‐ ment for its execution. Empty lines are ignored. Lines beginning with a pound sign are comments and are ignored as well. Except for comments and empty lines, each line of the configuration file consists of the key‐ word and optional value, and constitutes a _statement_. Exceedingly long lines may be split across multiple physical lines, by ending each line with a backslash immediately followed by a newline. Statements fall into two major classes: _section_ and _regular_ statements. A _sec‐_ _tion_ statement serves as a container for one or more regular statements that pursue the same goal, thus playing the role of a chapter in a book. A _regular_ statement modifies a certain aspect of the program's behavior. The overall file structure is as follows: **rush 2.0** **global** _keyword_ _value_ ... **rule _**A_ _keyword_ _value_ ... **rule _**B_ _keyword_ _value_ ... A configuration file must begin with a **rush **statement indicating the version of the syntax this file uses. Current versions of **rush **implement syntax version 2.0. In the absence of the initial **rush **statement, the program will treat the configuration file as written in lega‐ cy configuration syntax (see ** **for details). There are two section statements: **global **and **rule**. The **global **section contains statements configuring the behavior of the program in general. There can be as many **global **statements in the configuration as you consider necessary, each of them affecting the material up to the next **global **statement, or end of the file, whichever occurs first. Examples of statements that can be used in a **global **section are: **debug**, which sets the debug verbosity level, **message**, which configures error messages, etc. See the **global **section for the full list. One or more **rule **statements constitute the core of the configuration. Each **rule **statement provides a recipe for serving a specific class of input commands. When **rush **is invoked with a specific command, it will scan the configuration file looking for a rule that matches the requested command line. If such a rule is found, it will be applied. Commands that don't match any rule will be rejected. A **rule **statement may be followed by a _tag_, an arbitrary sequence of non-whitespace characters serving as a label for this rule. This sequence will be used in diagnostic messages to iden‐ tify this rule. In the absence of user-supplied tag, the default one will be generated, con‐ sisting of the **# **symbol followed by the ordinal number of the rule in the configuration file (started with 1). To match a particular command, each rule should contain the **match **statement. Its argument is a conditional expression that can contain comparison and boolean operators. The operands can refer to the command line using shell-like variables: **$command **to refer to the entire command line, **$#**, referring to the number of arguments in the command line (the command itself being counted as one of the arguments), **$0 **meaning the command name, and **$1**, **$2**, etc., referring to the particular command line arguments (arguments past the ninth one can be accessed as, e.g. **${10}**). For example, the following rule: rule match $command == "ls" will match only the **ls **command without arguments. The **~ **(tilde) operator denotes regular expression matching. For example, the following rule matches **ls **command, optionally preceded with any path prefix: rule match $0 ~ "^(.*/)?ls$" **Match **expressions can contain terms of arbitrary complexity. Consider the following example: rule match $0 ~ "^(.*/)?ls$" && $# == 2 \ && $1 !~ "^(/|/etc)$" This rule will match any **ls **command having exactly one argument, unless that argument is **/ **or **/etc**. Notice the use of the **!~ **operator to denote the negated regular expression matching, and the use of backslash to split a single expression across two physical lines. Variables are referenced using the same syntax as in shell. For example, **${1:-/bin} **expands to the value of the first parameter, if it is supplied, or to the string "/bin" otherwise. For details. see the section **REFERENCE: VARIABLE EXPANSION**. Although important, the **match **statement is not mandatory in a **rule **statement. If it is ab‐ sent, the rule will match any command line. This is normally used in _fall-through_ rules. A fall-through rule applies modifications to the command environment. After applying such rule, the scanning resumes at the rule that follows it. Fall-through rules are marked with the **fall-through **statement. ### set A rule can modify the command line and environment in which it will be executed. The **set** statement is provided for altering the command line or its parts. It takes three arguments: the variable name or index, the operator and the value. For example, the statement: set command = "/bin/sftp-server -u 002" replaces the entire command line. To replace particular arguments, use the **[_**N_] syntax, where _N_ is the index of the argument in the command line. For example, to set the first argument: set [1] = "/tmp" The part to the right of the equals sign can contain a transformation, i.e. a string followed by the **~ **operand and a _s-expression_ of the form **s/_**regexp_**/_**replacement_**/**[_flags_]. Parenthesized groups in _regexp_ can be referred to in _replacement_ using the backreference construct **\_**N_, where _N_ is the 1-based ordinal number of the group. For example, the following statement sets the second argument to the directory part of the first one: set [2] = "$1" ~ "s/(.*)\\//\\1/" Two points are worth noticing. First, the left operand of **~ **undergoes variable expansion. Secondly, the right-hand side operand is quoted and therefore each backslash in it has to be escaped. The special operator **=~ **is used if the resulted value is assigned to the same variable that served as its argument. For example, the two statements below are equivalent: set [1] =~ "s/(.*)\\//\\1/" set [1] = "$1" ~ "s/(.*)\\//\\1/" Parenthesized groups matched by the most recent **set **statement remain available for use in the statements that follow it in the rule. To refer to the group from the recent matching, use the following construct: **%_**N_. For example, the following two statements set the first argu‐ ment to the directory part, and second argument to the base name of the original **$1 **value: set [1] =~ "s/(.*)\\/(.*)/\\1/" set [2] = %2 The **set **statement operates not only on positional arguments and built-in variables, but also on arbitrary user-defined variables. A user-defined variable springs into existence when it first appears as a left-hand side argument to the **set **statement. The name of the variable must follow the usual rules for variable names: it must begin with an alphabetical character or underscore and contain only letters, digits and underscores. References to user-defined variables follow the same syntax as for built-in ones. The following example uses temporary variable **temp **to swap two arguments: set temp = $1 set [1] = $2 set [2] = $temp ### unset Variable definitions can be removed using the **unset **statement. It takes variable name or po‐ sitional argument index as its argument: unset temp When index is given, the corresponding positional argument is removed and all arguments to the right of it are shifted one position left to occupy the released slot. For example, giv‐ en the command line scp -d -v -t /incoming the statement unset 1 will reduce it to scp -v -t /incoming ### delete The **delete **statement provides a generalization of **unset **for positional arguments. It takes one or two argument indexes as arguments. When used with one index, it provides the same functionality as **unset**. When two indices are given, it deletes all arguments between those indices (inclusive). For example, the statement delete 1 2 will change the command line from the above example to scp -t /incoming Using negative indices, one can indicate arguments counting from right to left. Thus, the following will delete all arguments starting from the third: delete 3 -1 ### remopt Whereas **delete **and **unset **remove arguments at given positions, the **remopt **statement allows you to remove specific _command_ _line_ _options_ from the command line. This is useful to ensure no potentially harmful options can be passed by the user. The statement takes one or two argu‐ ments. First argument supplies the short option letter. For example, the following removes all occurrences of the **-A **option: remopt A If there is a long-option equivalent, it can be supplied as the second argument. For exam‐ ple, if **--all **is an alias for **-A**, the above statement would be rewritten as: remopt A all Notice, that the initial dash or double-dash is omitted from both the short and long option designation. When looking for long option in the command line, **remopt **will recognize its possible abbrevi‐ ations. In the example above, eventual occurrences of **--al **will be removed as well. If the option takes an argument, follow the first argument by a colon. For example, to re‐ move occurrences of the options **-r **along with its arguments write remopt r: The long option equivalent can be specified as well, e.g.: remopt r: root This will recognize all possible ways of option usage in the command line, such as: **-r ARG**, ### -rARG --root=ARG --root ARG -afr ARG will be removed, so that the modified command line will remain valid. Short option appearing in a cluster will be recognized, .e.g **-afr ARG **will be replaced by **-af**. Finally, if the op‐ tion takes an optional argument, follow its short letter by two colons, as in: remopt r:: root ### insert Arguments can also be inserted at arbitrary positions. The **insert **statement is provided for this purpose. Its syntax is similar to **set**: **insert [_**N_**] = _**value_ and **insert [_**N_**] = _**value_ **~ s/_**regex_**/_**replace_**/** where _N_ is the position where to insert the new argument. All arguments starting from _N_th will be shifted one position to the right, and the _value_ will be stored in the _N_th slot. In the second form, the value to be inserted is computed by applying the replacement expression to _value_. **REFERENCE: LEXICAL STRUCTURE** A _statement_ consists of a keyword and arguments, separated by any amount of whitespace. Ar‐ guments can be one of the following: _Identifiers_ Identifiers begin with a letter and consist of letters, digits, underscores and dash‐ es. They serve as keywords and variable names. _Decimal_ _numbers_ A sequence of decimal digits, optionally preceded by a minus or plus sign. _Unquoted_ _strings_ An unquoted string is any contiguous sequence of any characters, except newlines, whitespace and the following special characters: **\**, **"**, **!**, **=**, **<**, **>**, **(**, **)**, **{**, **}**, **[**, **]**, **$**, **%**, **&**, **|**, **~**, **#**. _Quoted_ _strings_ A quoted string is a sequence of characters enclosed in double-quotes. Quoted strings are subject to backslash interpretation, backreference interpretation and variable ex‐ pansion. During _backslash_ _interpretation_, the _escape_ _sequences_ are recognized and replaced as per table below: _Sequence_ _Replaced_ _with_ \a Audible bell character (ASCII 7) \b Backspace character (ASCII 8) \f Form-feed character (ASCII 12) \n Newline character (ASCII 10) \r Carriage return character (ASCII 13) \t Horizontal tabulation character (ASCII 9) \v Vertical tabulation character (ASCII 11) \\ A single backslash \" A double-quote. \% Percent sign In addition, the sequence **\_**newline_ is removed from the string. This allows one to split long strings over several physical lines. During the _backreference_ _interpretation_, references to parenthesized groups in regular expression are replaced with the actual content of the corresponding group in the most recently matched string. A reference is **%{_**N_**} **where _N_ is a decimal number. If _N_ is one digit, curly braces can be omitted: **%_**N_ If the **% **character resulted from previous backslash interpretation, no backreference interpretation occurs. Strings used in the left-hand side of a comparison expression are subject to variable expansion. This is discussed later. _Backreferences_ The construct **%{_**N_**} **is replaced with the substring that matched the _N_th parenthesized subgroup in a most recently performed regular expression match. If _N_ is one digit, curly braces can be omitted. _Variable_ _references_ Variable references consist of a **$ **sign, followed by the positional argument number or variable name, optionally enclosed in curly braces. Positional arguments greater than 9 must be enclosed in curly braces. The variable name must follow the rules for valid identifiers: it must begin with a letter and consist of letters, digits and under‐ scores. Variable name in curly braces can be followed by **-**, **=**, **?**, or **+**, optionally preceded by **: **as summarized in the table below: _Reference_ _Meaning_ ${_VAR_:-_WORD_} Use Default Values ${_VAR_:=_WORD_} Assign Default Values ${_VAR_:?_WORD_} Display Error if Null or Unset ${_VAR_:+_WORD_} Use Alternate Value where _WORD_ stands for any valid token as described in this section. See the section **REFERENCE: VARIABLE EXPANSION**, for a detailed discussion of these forms and their meaning. _Comparison_ _and_ _boolean_ _operators_ && Boolean AND || Boolean OR ! Boolean negation == Equality (string or numeric) != Inequality (string or numeric) < Less than <= Less than or equal to > Greater than >= Greater than or equal to ~ Regexp matching !~ Negated regexp matching in Membership in set of strings group Membership in UNIX group = Assignment =~ Regular expression substitution **REFERENCE: VARIABLE EXPANSION** Most statements in the configuration file undergo variable expansion prior to their use. During variable expansion, references to variables in the string are replaced with their ac‐ tual values. A variable reference has two basic forms: $V ${V} where _V_ is either the name of the variable (request, environment, or user-defined), or the index of the positional variable. The notation in curly braces serves several purposes. First, it is obligatory if _V_ is an index of the positional variable that is negative or greater than 9. Secondly, it should be used if the variable reference is immediately fol‐ lowed by an alphanumeric symbol, which will otherwise be considered part of it (as in **${home}dir**). Finally, this form allows for specifying the action to take if the variable is undefined or expands to an empty value. The following special forms are recognized: **${_**VARIABLE_**:-_**WORD_**}** _Use_ _Default_ _Values_. If _VARIABLE_ is unset or null, the expansion of _WORD_ is substitut‐ ed. Otherwise, the value of _VARIABLE_ is substituted. **${_**VARIABLE_**:=_**WORD_**}** _Assign_ _Default_ _Values_. If _VARIABLE_ is unset or null, the expansion of _WORD_ is as‐ signed to the variable. The value of _VARIABLE_ is then substituted. **${_**VARIABLE_**:?_**WORD_**}** _Display_ _Error_ _if_ _Null_ _or_ _Unset_. If _VARIABLE_ is null or unset, the expansion of _WORD_ (or a message to that effect if _WORD_ is not present) is output to the current logging channel. Otherwise, the value of _VARIABLE_ is substituted. **${_**VARIABLE_**:+_**WORD_**}** _Use_ _Alternate_ _Value_. If _VARIABLE_ is null or unset, nothing is substituted, otherwise the expansion of _WORD_ is substituted. **REFERENCE: STATEMENTS** There are three global statements, two of which can contain multiple substatements: ### rush 2.0 Declares the version of the syntax this configuration file is written in. This must be the first statement in the configuration file. If this statement is missing, the configuration file will be treated as _legacy_ _configuration_ _file_ from previous versions of **GNU rush**. For the discussion of the legacy configuration file, please refer to ****. **global **Defines global settings. **rule **[_TAG_] Contains a set of rules for a certain class of input command lines. ### global Introduces global settings. This statement is followed by one or more substatements. Global settings end at the nearest **rule **statement that follows. They remain in effect until the next **global **statement is encountered which alters them. The following statements may appear in this section. **expand-undefined _**BOOL_ Controls how undefined variables are expanded. If _BOOL_ is **true**, references to unde‐ fined variables are replaced with empty values. If it is **false **(the default), an er‐ ror message is issued and program terminates. Any of the following values can be used as a synonym for **true**: **yes**, **on**, **t**, **1**. The following values can be used as synonyms for **false**: **no**, **off**, **nil**, **0**. **debug _**NUM_ Set debugging level. The bigger _NUM_ is, the more verbose is the logging. The debug‐ ging information is reported via **syslog **at facility **authpriv**, priority **debug**. **sleep-time _**NUM_ Set the time in seconds to sleep before exiting on error. This statement is intended as a measure against brute-force attacks. Default sleep time is 5 seconds. **message _**CLASS_ _TEXT_ Define a textual message which is returned to the remote party if an error of the giv‐ en _CLASS_ occurs. Valid classes are: **usage-error** This error is reported when **rush **has been invoked improperly. The default text is: **"You are not permitted to execute this command."** **nologin-error** A message which is returned if there is no such user name in the password data‐ base. Defaults to: **"You are not permitted to execute this command."** **config-error** Define a textual message which is returned if the configuration file contained er‐ rors. Default is: **"Local configuration error occurred."** **system-error** Define a textual message which is returned if a system error occurs. Default is: **"A system error occurred while attempting to execute command."** **regexp _**FLAG_ [_FLAG_...] Configure the type of regular expressions to be used by subsequent **match**, **set**, and **in‐** **sert **statements. Each _FLAG_ is a word specifying a regular expression feature. It can be preceded by a plus sing to enable this feature (this is the default), or by the mi‐ nus sign to disable it. Valid flags are: **extended** Use POSIX Extended Regular Expression syntax when interpreting regex. This is the default. **basic **Use basic regular expressions. Equivalent to **-extended**. **icase **or **ignore-case** Do not differentiate case. Subsequent regex matches will be case insensitive. **include-security _**FLAG_ [_FLAG_...] Configure the security checks for include files. Valid flags are: **all **Enable all checks. **owner **The file must be owned by root. **iwgrp **or **groupwritablefile** Forbid group writable files. **iwoth **or **worldwritablefile** Forbid world writable files. **dir_iwgrp **or **groupwritabledir** Forbid files that reside in group writable directories. **dir_iwoth **or **worldwritabledir** Forbid files that reside in world writable directories. **link **Forbid symbolic links to files residing in group or world writable directories. Each of the above keywords can be prefixed by **no**, which reverses its meaning. The special keyword **none **disables all checks. **acct-umask _**MASK_ Set umask used when accessing accounting database files. Default value is 022. **acct-dir-mode _**MODE_ Set mode bits for the accounting directory. The argument is the mode in octal. **acct-file-mode _**MODE_ Set mode bits for the **wtmp **and **utmp **files. ### rule Defines a rule. This is a block statement, which means that all statements located between it and the next **rule **statement (or end of file, whichever occurs first) modify the definition of that rule. The syntax is: rule **TAG** Optional **TAG **argument supplies the identifier for that rule. It is used in diagnostic mes‐ sages. If tag is missing, **rush **will supply a default one, which is constructed by concate‐ nating the **# **character and the ordinal number of rule in the configuration file, in decimal notation. Rule numbering starts from 1. A rule can contain the following statements: **match _**EXPR_ Defines conditions that decide whether the rule matches the particular request. The _EXPR_ argument is a comparison expression. It can be a simple comparison expression or a boolean expression involving several other expressions. A simple expression is either a comparison or a membership test. A comparison has the general syntax _lhs_ _op_ _rhs_ where _lhs_ and _rhs_ are operands and _op_ is the operation. The _lhs_ is either a string (quoted or unquoted), or a variable reference. The _rhs_ is a string or number. Prior to evaluating simple expression, its _LHS_ undergoes variable expansion. In contrast, the _RHS_ operand is always treated verbatim. The comparison operator _OP_ is one of the following: == Equality (string or numeric) != Inequality (string or numeric) < Less than <= Less than or equal to > Greater than >= Greater than or equal to ~ Regexp matching !~ Negated regexp matching Two membership tests are available. The **in **test has the form _LHS_ **in **( _STRING_ ... ) and evaluates to true if _LHS_ matches one of the strings in parentheses. _LHS_ undergoes variable expansion and backreference interpretation prior to comparison. The **group **test has the following syntax: **group _**GRP_ It returns true if the requesting user is a member of the group _GRP_. Several groups can be given in parentheses: **group (_**GRP_ ...**)** in which case the test return true if the user is a member of at least one of the men‐ tioned groups. Compound boolean expression combine one or more expressions using logical operators && Boolean AND || Boolean OR ! Boolean negation **set _**NAME_ **= _**VALUE_ Sets the variable _NAME_ to _VALUE_, which undergoes backreference interpretation and variable expansion. **set [_**N_**] = _**VALUE_ Sets the command line argument _N_ to _VALUE_ **set _**NAME_ **= _**VALUE_ **~ _**S-EXPR_ Applies the [**sed**(1)](https://www.chedong.com/phpMan.php/man/sed/1/markdown)-like search-and-replace expression **S-EXPR **to _VALUE_ and assigns the result to the variable **NAME**. Both **VALUE **and **S-EXPR **are subject to variable expansion and backreference interpretation. **set [_**N_**] = _**VALUE_ **~ _**S-EXPR_ Similar to the above, but assigns the result to the _N_th command line argument. **set _**NAME_ **=~ _**S-EXPR_ This is a shortcut for **set _**NAME_ **= $_**NAME_ **~ _**S-EXPR_ i.e. it applies the search-and-replace expression _S-EXPR_ to the current value of the variable _NAME_ and stores the resulting string as its new value. **set [_**N_**] =~ _**S-EXPR_ A shortcut for **set [_**N_**] = $_**N_ **~ _**S-EXPR_ The _S-EXPR_, is a sed replace expression of the form: **s/_**REGEXP_**/_**REPLACE_**/**[_FLAGS_] where **REGEXP **is a regular expression, _REPLACE_ is a replacement for each part of the input that matches _REGEXP_ and optional _FLAGS_ are flag letters that control the substitution. Both _REGEXP_ and _REPLACE_ are described in [**sed**(1)](https://www.chedong.com/phpMan.php/man/sed/1/markdown)**.** As in **sed**, you can give several replace expressions, separated by semicolons. The supported _FLAGS_ are: **g **Apply the replacement to all matches to the _REGEXP_, not just the first. **i **Use case-insensitive matching. **x _**REGEXP_ is an extended regular expression. _NUMBER_ Only replace the _NUMBER_th match of the _REGEXP_. Notice, that the POSIX standard does not specify what should happen when you mix the **g **and _NUMBER_ modifiers. **Rush **follows the GNU **sed **implementation in this regard, so the interaction is defined to be: ignore matches before the _NUMBER_th, and then match and replace all matches from the _NUMBER_th on. Also notice, that usually _S-EXPR_ is a quoted string, and as such it is subject to backslash interpretation. It is therefore important to properly escape backslashes, especially in the _REPLACE_ part. E.g. set bindir = $program ~ "s/(.*)\\//\\1/" **insert [_**N_**] = _**VALUE_ Shift command line arguments starting from the _N_th one position to the right and store _VALUE_ in the _N_th slot. _VALUE_ is subject to variable expansion and backreference inter‐ pretation. **insert [_**N_**] = _**VALUE_ **~ _**S-EXPR_ Shift command line arguments starting from the _N_th one position to the right, apply _S-_ _EXPR_ to _VALUE_ and store the result in the _N_th slot. Both _S-EXPR_ and _VALUE_ are subject to variable expansion and backreference interpretation. **unset _**NAME_ Unset the variable _NAME_. **unset _**N_ Unset the positional argument _N_ (an integer number greater than 0), shifting the re‐ maining arguments one position left. This is the same as **delete _**N_. **remopt _**SOPT_ Remove from the command line all occurrences of the short option described by _SOPT_. The _SOPT_ argument is the short option letter, optionally followed by a colon if that option takes a mandatory argument, or by two colons if it takes an optional argument. **remopt _**SOPT_ _LOPT_ Same as the above. _LOPT_ supplies the long option equivalent for the short option de‐ scribed by _SOPT_. **delete _**N_ Delete **N**th argument. **delete _**I_ _J_ Delete arguments between _I_ and _J_, inclusive. **map _**NAME_ _FILE_ _DELIM_ _KEY_ _KN_ _VN_ This statement uses file lookup to find a new value for the variable _NAME_. The _FILE_ argument supplies the name of the _map_ _file_. It must begin with **/ **or **~/**. Before use, the file permissions and ownership are checked using the criteria supplied in the **in‐** **clude-security **statement (see the **global **section). The map file consists of _records_, separated by newline characters. Each record, in turn, consists of fields, separated by characters listed in the _DELIM_ argument. If it contains a space character, then fields may be delimited by any amount of whitespace characters (spaces and/or tabulations). Otherwise, exactly one character delimits fields. Fields within a record are numbered starting from 1. The **map **action operates as follows. First, variable expansion and backreference in‐ terpretation is performed on the _KEY_ argument. The result will be used as actual lookup key. Then, _FILE_ is scanned for a record whose _KN_th field matches the lookup key. If such a record is found, the value of its _VN_th field is assigned to the vari‐ able. Otherwise, if _DEFAULT_ is supplied, it is assigned to the variable. Otherwise, the variable remains unchanged. **map [_**N_**] _**FILE_ _DELIM_ _KEY_ _KN_ _VN_ _DEFAULT_ Same as above, but the result of the lookup is assigned to _N_th argument. The following statements modify command execution environment: **clrenv **Clear the environment. **keepenv _**NAME_ ... Retain the listed variables. This statement should be used in conjunction with **clrenv**. Argument is a whitespace delimited list of variables to retain. Each element in the list can be either a variable name, or a shell-style globbing pattern, in which case all variables matching that pattern will be retained, or a variable name followed by an equals sign and a value, in which case it will be retained only if its actual value equals the supplied one. For example, to retain only variables with names beginning with 'LC_': keepenv "LC_*" **setenv _**NAME_ **= _**VALUE_ Set the environment variable _NAME_. The _VALUE_ argument is subject to variable expan‐ sion and backreference interpretation. For example, to modify the 'PATH' value: setenv PATH = "$PATH:/opt/bin" **unsetenv _**NAME_ ... Unset environment variables. See **keepenv **for a discussion of arguments. **evalenv _**STRING_ Performs backslash interpretation, backreference interpretation and variable expansion on _STRING_ and discards the result. This statement is similar to the shell's "colon" statement. The following statements are _system_ _actions_. They provide interface to the operating system. **umask _**MASK_ Set the umask. The _MASK_ must be an octal value not greater than 0777. The default umask is 022. **newgrp _**GROUP-ID_ Change the current group ID to _GROUP-ID_, which is either a numeric value or a name of an existing group. **newgroup _**GROUP-ID_ Alias to the above. **chroot _**DIR_ Change the root directory to _DIR_. The argument is subject to tilde and variable ex‐ pansions and backreference interpretation. During tilde expansion, a tilde at the start of string is replaced with the absolute pathname of the user's home directory. **chdir _**DIR_ Change to the directory _DIR_. The argument is subject to tilde and variable expansions and backreference interpretation. If both **chdir **and **chroot **are specified, **chroot **is applied first. **limits _**RES_ Impose limits on system resources, as defined by _RES_. The argument consists of _com‐_ _mands_, optionally separated by any amount of whitespace. A command is a single com‐ mand letter followed by a number, that specifies the limit. The command letters are case-insensitive and coincide with those used by the shell **ulimit **utility: **A **max address space (KB) **C **max core file size (KB) **D **max data size (KB) **F **maximum file size (KB) **M **max locked-in-memory address space (KB) **N **max number of open files **R **max resident set size (KB) **S **max stack size (KB) **T **max CPU time (MIN) **U **max number of processes **L **max number of logins for this user (see below) **P **process priority -20..20 (negative = high priority) If some limit cannot be set, execution of the rule aborts. In particular, the **L **limit can be regarded as a condition, rather than an action. Setting **limit L5 **succeeds only if no more than 5 **rush **instances are simultaneously running for the same user. This can be used to lim‐ it the number of simultaneously open sessions. The use of **L **resource automatically enables _forked_ _mode_. See the subsection **Accounting and** **forked mode **for details. **fall-through **or **fallthrough** Declare a fall-through rule. After evaluating such a rule, **rush **continues rule match‐ ing process from the next rule in the configuration. Any modifications to the request found in the fall-through rule take effect immediately, which means that subsequent rules will see modified command line and environment. Execution of any other actions found in the fall-through rule is delayed until a matching rule is found. Fall-through rules are often used to set default values for subsequent rules. ### Accounting and forked mode GNU **rush **is able to operate in two modes, which we call default and forked. When operating in the default mode, the process image of **rush **itself is overwritten by the command being ex‐ ecuted. Thus, when it comes to launching the requested command, the running instance of **rush** ceases to exist. There is also another operation mode, which we call _forked_ _mode_. When running in this mode, **rush **executes the requested command in a subprocess, and remains in memory supervising its execution. Once the command terminates, **rush **exits. One advantage of the forked mode is that it allows you to keep _accounting_, i.e. to note who is doing what and to keep a history of invocations. The accounting, in turn, can be used to limit simultaneous executions of commands, as requested by the **L **command to **limit **statement (see above). **acct _**BOOL_ Turn accounting mode on or off, depending on _BOOL_. The argument can be one of the following: **yes**, **on**, **t**, **true**, or **1**, to enable accounting, and **no**, **off**, **nil**, **false**, **0**, to disable it. **fork _**BOOL_ Enable or disable forked mode. See **acct **for a description of _BOOL_. Enabling account‐ ing turns the fork mode as well. This statement is mainly designed as a way of dis‐ abling the forked mode for a given rule. ### Post-process notification **Rush **can be configured to send a _notification_ over INET or UNIX sockets, after completing user request. It is done using the following statement: **post-socket _**URL_ Notify _URL_ about completing the user request. This statement implies forked mode. Allowed formats for _URL_ are: **inet://_**HOSTNAME_[**:_**PORT_] Connect to remote host _HOSTNAME_ using TCP/IP. _HOSTNAME_ is the host name or IP address of the remote machine. Optional _PORT_ specifies the port number to connect to. It can be either a decimal port number or a service name from **/etc/services**. If _PORT_ is ab‐ sent, **tcpmux **(port 1) is assumed. **unix://_**FILENAME_ or **local://_**FILENAME_ Connect to a UNIX socket _FILENAME_. The notification protocol is based on TCPMUX (RFC 1078). After establishing connection, **rush** sends the rule tag followed by a CRLF pair. The rule tag acts as a service name. The remote party replies with a single character indicating positive (**+**) or negative (**-**) acknowledgment, optionally followed by a message of explanation, and terminated with a CRLF. If positive acknowledgment is received, **rush **sends a single line, consisting of the user name and the executed command line, separated by a single space character. The line is terminated with a CRLF. After sending this line, **rush **closes the connection. The post-process notification feature can be used to schedule execution of some actions after certain rules. ### Exit rule **exit _**FD_ _TEXT_ Write textual message _TEXT_ to file descriptor _FD_. **exit _**TEXT_ Write textual message _TEXT_ to standard error. Similar to **exit 2 _**TEXT_ In both cases the _TEXT_ argument can be either a quoted string, or an identifier. If it is a quoted string, it is subject to backreference interpretation and variable expan‐ sion. If _TEXT_ is an identifier, it must be the name of a predefined error message (see the list in the discussion of the **message **statement in **global **section, above). ### Interactive access Sometimes it may be necessary to allow some group of users limited access to interactive shells. GNU **rush **contains provisions for such usage. When it is invoked without '-c' it as‐ sumes interactive usage. In this case only rules explicitly marked as interactive are con‐ sidered, the rest of rules is ignored. **interactive _**BOOL_ If BOOL is true (see the **acct **statement above for allowed values), this statement marks the rule it appears in as interactive. This rule will match only if **rush **is in‐ voked without command line arguments. Unless command line transformations are applied, interactive rule finishes by executing **/bin/sh**. The first word in the command line (**argv[0]**) is normally set to the base name of the command being executed prefixed by a minus character. An example rule login interactive true group rshell map program /etc/rush.shell : ${user} 1 2 set [0] = ${program} ~ "s|^.*/||;s,^,-r," rule nologin interactive true exit You don't have interactive access to this machine. The **login **rule will match interactive user requests if the user is a member of the group **rshell**. It looks up the shell to use for this in the file **/etc/rush.shell**. This map file consists of two fields, separated by a colon. If the shell is found, its base name, prefixed with **-r**, will be used as **argv[0] **(this indicates a restricted login shell). Otherwise, the trap rule **nologin **will be matched, which will output the given diagnostics message and termi‐ nate **rush**. ### Localization The following statement allow you to provide translations (localizations) for the messages in your **rush **configuration: **locale _**NAME_ Set the locale name. To specify empty locale, use "" as _NAME_ (recall that empty lo‐ cale name means to use the value of the environment variable 'LC_ALL' as locale name). **locale-dir _**NAME_ Set the name of the locale directory. **text-domain _**NAME_ Set the textual domain name. An example: rule l10n locale "pl_PL" text-domain "rush-config" fall-through ### include The **include **statement forces inclusion of the named file in that file location: **include _**FILE_ The statement is evaluated when parsing the configuration file, which means that _FILE_ under‐ goes only tilde expansion: the two characters **~/ **appearing at the beginning of file name are replaced with the full path name of the current user's home directory. If _FILE_ is a directory, that directory is searched for a file whose name coincides with the current user name. If such a file is found, it is included. In any case, if the named file does not exist, no error is reported, and parsing of the con‐ figuration file continues. Before including the file **rush **checks if it is secure, using the criteria set in the **in‐** **clude-security **statement. See its description in the **global **section, above. The **include **statement can be used only within a rule. The included file may not contain **rule** and **global **statements. ## SEE ALSO [**rush**(8)](https://www.chedong.com/phpMan.php/man/rush/8/markdown), [**rushlast**(1)](https://www.chedong.com/phpMan.php/man/rushlast/1/markdown), [**rushwho**(1)](https://www.chedong.com/phpMan.php/man/rushwho/1/markdown). ## AUTHORS Sergey Poznyakoff ## BUG REPORTS Report bugs to <>. ## COPYRIGHT Copyright © 2016-2019 Sergey Poznyakoff License GPLv3+: GNU GPL version 3 or later <> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. RUSH.RC July 1, 2019 [_RUSH.RC_(5)](https://www.chedong.com/phpMan.php/man/RUSH.RC/5/markdown)