\input texinfo @c -*-texinfo-*-
@smallbook
@c %**start of header
@setfilename rush.info
@settitle GNU Rush -- a restricted user shell
@c %**end of header
@setchapternewpage odd

@defcodeindex pr
@defcodeindex op
@defcodeindex kw
@defcodeindex fl

@syncodeindex fn cp
@syncodeindex vr cp
@syncodeindex ky cp
@syncodeindex pg cp
@syncodeindex tp cp
@syncodeindex op cp
@syncodeindex pr cp
@syncodeindex kw cp
@syncodeindex fl cp

@include version.texi
@include rendition.texi

@ifinfo
@dircategory System Administration Utilities
@direntry
* rush: (rush).              A restricted user shell.
* rushwho: (rush)Rushwho.    Show who is using GNU Rush currently.
* rushlast: (rush)Rushlast.  Show listing of recent GNU Rush sessions.
@end direntry
@end ifinfo

@copying
Published by the Free Software Foundation,
51 Franklin Street, Fifth Floor,
Boston, MA 02110-1301 USA 

Copyright @copyright{} 2008-2010, 2013-2014, 2016 Sergey Poznyakoff

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, and no specific Front- and Back-Cover texts.
A copy of the license is included in the section entitled ``GNU Free
Documentation License''. 
@end copying
                                   
@titlepage
@title GNU Rush -- a restricted user shell
@subtitle version @value{VERSION}, @value{UPDATED}
@author Sergey Poznyakoff
@page
@vskip 0pt plus 1filll
@insertcopying
@end titlepage

@ifnothtml
@page
@summarycontents
@end ifnothtml

@page
@contents

@ifnottex
@node Top
@top GNU Rush

This edition of the @cite{GNU Rush Manual}, last updated @value{UPDATED},
documents GNU Rush Version @value{VERSION}.

@end ifnottex

@menu
* Intro::
* Operation::
* Quick Start::
* Configuration File::
* Default Configuration::
* Usage Tips::
* Test Mode::
* Option Summary::
* Rushwho::              The @code{rushwho} utility.
* Rushlast::             The @code{rushlast} utility.
* Accounting Database::
* Reporting Bugs::       How to Report a Bug.

Appendices

* Time and Date Formats::
* Copying This Manual::  The GNU Free Documentation License.
* Concept Index::        Index of Concepts.

@detailmenu
 --- The Detailed Node Listing ---

Configuration File

* Syntax::                      
* Rule::                        
* Include::                     
* Debugging::                   
* Regex::                       
* Sleep Time::                  
* Error Messages::

Syntax

* Quoted Strings::

Rule

* Conditions::                  
* Transformations::             
* System Actions::              
* Environment::                 
* Fall-through::                
* Accounting and Forked Mode::  
* Notification::                
* Exit::
* Interactive::
* Localization::

Transformations

* set::
* delete::
* transform::
* map::

Localization

* Localization Directives::
* Writing Your Localization::

Usage Tips

* scp::
* rsync::
* sftp::
* cvs::
* svn::
* git::
* notification example::

The @code{rushwho} utility.

* Rushwho Options::
* Formats::

The @code{rushlast} utility.

* Rushlast Options::

Accounting Database

* wtmp::        The Structure of @file{wtmp} File.
* utmp::        The Structure of @file{wtmp} File.

@end detailmenu
@end menu

@node Intro
@chapter Introduction
  GNU Rush is a Restricted User Shell, designed for sites that provide
limited remote access to their resources, such as svn or git  
repositories, scp, or the like.  Using a sophisticated configuration
file, GNU Rush gives you complete control over the command lines that
users execute, as well as over the usage of system resources, such as 
virtual memory, CPU time, etc.

@node Operation
@chapter Operation
  GNU Rush is usually installed as a user shell.  When a user connects to
the server (e.g. by using using SSH protocol), the shell binary,
@command{rush}, is executed.  GNU Rush must be called with exactly two
arguments: the @option{-c} command line option and a command line to
be executed on the host machine@footnote{Starting from version 1.6, it
is possible to use GNU Rush for interactive shell
sessions.  @xref{Interactive}, for more information about it.}.  If
wrong arguments are supplied, the shell aborts.

@cindex request
  The third argument to @command{rush} supplies a command line to be
executed.  This command line along with the password database entry
for the user who executes @command{rush} are said to form a
@dfn{request}.

@cindex rule
@cindex conditions
@cindex actions
  After startup, @command{rush} reads a set of @dfn{rules} from its
configuration file.  Each rule consists of conditions
and actions.  @dfn{Conditions} are used to match the rule
with the request.  They can include regular expression matching
with entire command line or particular fields thereof, user name or
group comparisons, etc.  If all conditions match the request, 
actions are executed.  @dfn{Actions} allow to:

@itemize @bullet
@item Modify the command line;
@item Impose resource limits;
@item Set umask;
@item Change current working directory;
@item Modify the execution environment;
@item Run command in a special root directory (@samp{chroot}).
@end itemize

  Finally, after all actions have been executed successfully, @command{rush}
executes the requested command.  Notice, that the resulting command
line is not necessarily the same as was supplied to @command{rush} via
the @option{-c} option.

@cindex fall-through rule
@cindex rule, fall-through
  A special kind of rules, called @dfn{fall-through} ones, is
provided.  Fall-through rules differ from other rules in that they do
not execute the command.  After all actions in a fall-through rule
have been executed, GNU Rush continues to search for another matching rule
in its configuration and applies it, if found.  Fall-through rules
are useful to set default values for subsequent rules.

@node Quick Start
@chapter Quick Start
  To give you the feel of GNU Rush possibilities, let's consider the
following configuration file rule:

@smallexample
@group
rule sftp
  # Conditions:
  command ^.*/sftp-server
  uid >= 100
  # Actions:
  transform[0] s,.*,bin/sftp-server,
  umask 002
  chroot ~
  chdir /
@end group
@end smallexample

  The first clause, @code{rule}, defines a new rule.  Its argument
serves as a rule tag, used for diagnostic messages and for accounting.

  Lines beginning with @samp{#} are comments, they are intended for a
human reader and are ignored by @code{rush}.
 
  The two statements that follow the comment, @code{command} and
@code{uid}, define conditions that must be met for this rule to become
active.  The @code{command} statement introduces a regular expression
to match with the command line.  In this example, the command line must
begin with @samp{/sftp-server}, optionally preceded by arbitrary
directory components. 

  The @code{uid} statement tells that this rule applies only to users
whose @acronym{UID}s are greater than or equal to 100. 

  Subsequent clauses define actions associated with this rule.

  The @code{transform[0]} clause contains instructions on how to
modify the first argument of the command line (i.e. the command
name).  These instructions are in the form of @code{sed} replace
expression (@pxref{Transformations, transformation expression}).  The
expression in our example instructs GNU Rush to replace the command name with
@samp{bin/sftp-server}@footnote{In this particular case, the
@code{set} statement, introduced in GNU Rush version 1.6, is probably more
appropriate:

@smallexample
  set[0] bin/sftp-server
@end smallexample
}.

  The @code{umask} clause sets the file creation mask.

  The @code{chroot} clause instructs GNU Rush to chroot to the user home
directory before executing the command.

  Finally, the @code{chdir} statement sets the directory to change to
after installing the chroot.

@node Configuration File
@chapter Configuration File
@flindex rush.rc
  The configuration file is called @file{rush.rc} and is located in
@file{/usr/local/etc} by default.@footnote{The exact location of the
configuration file is defined when configuring the package.  See the
file @file{INSTALL} in the GNU Rush source directory for more information}.

  The configuration file is read and parsed right after start up.  Any
errors occurred in parsing are reported using @code{syslog} facility
@samp{authpriv} and priority @samp{notice}.  When run in @samp{test}
mode, all diagnostics is displayed on standard error
output.  @xref{Test Mode}, for a detailed description of ways to debug
and test your configurations.

@anchor{security checks}
  Before parsing, @command{rush} checks the ownership and permissions
of the configuration file for possible security breaches.  The
configuration file is considered unsafe if any of the following
conditions are met:

@enumerate 1
@item It is not owned by root.
@item It is group writable.
@item It is world writable.
@item It resides in a group writable directory.
@item It resides in a world writable directory.
@item It is a symbolic link to a file residing in a group or world
writable directory.
@end enumerate

If the file is considered unsafe, @command{rush} rejects it and aborts
execution.

Any of these tests can be disabled using the
@command{--security-check} option (@pxref{--security-check}).

@menu
* Syntax::                      
* Rule::                        
* Include::                     
* Debugging::                   
* Regex::                       
* Sleep Time::                  
* Error Messages::
@end menu

@node Syntax
@section Syntax
@cindex syntax, configuration files
@cindex configuration file syntax
  Configuration file consists of statements and comments.  

  A @dfn{comment} is any line whose first non-whitespace character is
@samp{#}.  Empty lines and comments are ignored.

  A @dfn{statement} consists of a keyword and optional argument,
separated by any amount of whitespace.  Depending on the keyword, the
statement may treat its argument as a single value or as multiple values.
For example, the @code{command} instruction takes a single 
value as its argument, so parsing the statement

@smallexample
command ^scp -t /incoming/
@end smallexample

@noindent
results in keyword @samp{command} and value @samp{^scp -t /incoming/}.

If the keyword requires multiple values, its argument is split into
words using the following algorithm:

@enumerate 1
@item Any sequence of one or more non-whitespace characters is a word.
@item Any sequence of characters enclosed in single (@samp{'}) or
double-quotes (@samp{"}) is a word.
@item Words are separated by any amount of white space.
@item If the keyword expects s-expressions (@pxref{s-expression}),
these are treated as words, even if they contain white space.
@end enumerate

Arguments, obtained as a result of rules (1) and (2) are subject to
@dfn{backslash interpretation}, during which the following @dfn{escape
sequences} are replaced with single characters, as described in the
table below:  

@float Table, backslash-interpretation
@caption{Backslash escapes}
@multitable @columnfractions 0.30 .5
@item Sequence @tab Replaced with
@item \a @tab Audible bell character (@acronym{ASCII} 7)
@item \b @tab Backspace character (@acronym{ASCII} 8)
@item \f @tab Form-feed character (@acronym{ASCII} 12)
@item \n @tab Newline character (@acronym{ASCII} 10)
@item \r @tab Carriage return character (@acronym{ASCII} 13)
@item \t @tab Horizontal tabulation character (@acronym{ASCII} 9)
@item \v @tab Vertical tabulation character (@acronym{ASCII} 11)
@end multitable
@end float

  Any escape sequence not listed in this table is replaced with its
second character.

  Statements are delimited by newline characters.  Length of a
statement line is not limited.  To improve readability, long
statements may be split over several lines by using backslash
(@samp{\}) as a last character on line.  Thus, the following statement:

@smallexample
usage-error Contact your\
 system administrator
@end smallexample

@noindent
is equivalent to:

@smallexample
usage-error Contact your system administrator
@end smallexample

@menu
* Quoted Strings::
@end menu

@node Quoted Strings
@subsection Notes on Quoted Strings
@cindex quoted strings

  The syntax of GNU Rush configuration file was designed so as to
implement minimum amount of syntactic mark up.  Most statements
treat their argument as a single value, even if it contains embedded
white space.  However, leading and trailing whitespace is always
removed.  Consider, for example, the following
statement@footnote{@xref{match}, for information about
@code{match} statement.}:

@smallexample
  match[1] ^/sources/[^ ]+\.git$
@end smallexample

@noindent
Here, the argument is @samp{^/sources/[^ ]+\.git$}.  Note, that you
must not quote it, because quotation marks would be considered part of
the argument.

There are, however, statements that take several arguments.  In these
statements, arguments that contain embedded white space must be
quoted.  For example, in the statement below@footnote{@xref{map}, for
a description of @command{map} statement.} the second argument is a
single space character.  It is quoted to prevent it from being treated
as a delimiter:

@smallexample
  map[0] /etc/passwd.rush " " $@{user@} 1 7
@end smallexample

Notice also, that arguments to these statements are subject to
backslash interpretation (@pxref{backslash-interpretation}).

The table below lists all statements that take multiple arguments,
with cross references to more in-depth explanations in the body of the
manual.

@table @asis
@item user
@xref{Conditions, user}.
@item group
@xref{Conditions, group}.
@item transform @var{pattern} @var{expr}
@itemx transform[@var{n}] @var{pattern} @var{expr}
@xref{transform}.  
@item map
@xref{map}.
@item env
@xref{Environment}.
@item regexp
@xref{Regex}.
@item include-security
@xref{include-security}.
@end table

@node Rule
@section Rule
@cindex @code{rule} statement
  The @code{rule} statement configures a GNU Rush rule.  This is a
@dfn{block} statement, which means that all statements located between
it and the next @code{rule} statement (or end of file, whichever
occurs first) modify the definition of the rule.

@kwindex rule
  The syntax of the @code{rule} statement is:

@deffn {Configuration} rule @var{tag}
@end deffn

@cindex rule tag
@cindex tag, rule
The @var{tag} argument is optional.  If it is given, it supplies a
@dfn{tag} for the rule, i.e. a (presumably unique) identifier, which
is used to label this rule.  @command{Rush} uses this tag in its diagnostic
messages.  For rules without explicit @var{tag}, @command{Rush} supplies a
default tag, which is constructed by concatenating @samp{#} character
and the ordinal number of rule in the configuration file, in decimal
notation.  Rule numbering starts from @samp{1}.

The following sub-sections describe statements that can be used
within a @code{rule}.

@menu
* Conditions::                  
* Transformations::             
* System Actions::              
* Environment::                 
* Fall-through::                
* Accounting and Forked Mode::  
* Notification::                
* Exit::
* Interactive::
* Localization::
@end menu

@node Conditions
@subsection Conditions
@cindex conditions
  These statements define conditions that are used to match the rule with
the request.  A rule may contain any number of conditions.  All
conditions are tested in order of their appearance in the rule and are
tied together using boolean shortcut @samp{and} evaluation: if any of
them yields false, the rest is not evaluated and control is
transferred to the subsequent rule. 

@deffn {Rule Config} command @var{regex}
True, if the current command line matches regular expression
@var{regex}.  

For example:

@smallexample
command ^scp (-v )?-t /incoming/(alpha|ftp)
@end smallexample

By default, @acronym{POSIX} extended regular expressions are used.
This, however can be changed using @code{regex} statement (@pxref{Regex}).
@end deffn

@anchor{match}
@deffn {Rule Config} match[@var{n}] @var{regexp}
True, if @var{n}th @dfn{word} from the command line matches
regular expression @var{regexp}.  Notice, that square brackets form
part of the statement syntax.  A special value @samp{$} can be used
instead of @var{n} to denote the last word.  Unless changed by
previous @code{regex} statement (@pxref{Regex}), @acronym{POSIX}
extended regular expressions are used. 

The command line is split into words using the same rules as used in
@code{/bin/sh}.

For example, the condition below yields true if the last argument is
an absolute path name:

@smallexample
match[$] ^/.*
@end smallexample
@end deffn

@deffn {Rule Config} argc @var{op} @var{num}
Compare the number of command line arguments to @var{num}.
The comparison operator is given by @var{op}, which can be one 
of the following: @samp{=} (or @samp{==}), @samp{!=}, @samp{<},
@samp{<=}, @samp{>}, @samp{>=}.

For example, the following condition matches if the number of
arguments is less than 3:

@smallexample
argc < 3
@end smallexample
@end deffn

@deffn {Rule Config} uid [@var{op}] @var{user-id}
Compare current @acronym{UID} to @var{user-id}.  The latter may be
either a numeric UID or a name of an existing user.

The comparison operator is given by optional @var{op}, which can be one 
of the following: @samp{=} (@samp{==}), @samp{!=}, @samp{<},
@samp{<=}, @samp{>}, @samp{>=}.  If @var{op} is not given, equality
(@samp{==}) is assumed.

Examples:

@smallexample
uid smith
@end smallexample

@end deffn

@deffn {Rule Config} gid @var{op} @var{group-id}
Compare current @acronym{GID} to @var{group-id}, which is either a
numeric value or a name of an existing group.

The comparison operator is given by @var{op}, which can be one
of the following: @samp{=} (@samp{==}), @samp{!=}, @samp{<},
@samp{<=}, @samp{>}, @samp{>=}.  If @var{op} is not given, equality
(@samp{==}) is assumed.
@end deffn

@deffn {Rule Config} user @var{names}
Argument is a whitespace-separated list of user names.  This condition
yields true, if the user name matches one of the listed names.
String comparisons are case-sensitive.
@end deffn

@deffn {Rule Config} group @var{names}
Argument is a whitespace-separated list of group names.  This condition
yields true, if the the name of any group the user is a member of
matches one of listed names.  String comparisons are case-sensitive.

For example, to match users from groups @samp{admin} and @samp{root}:

@smallexample
group admin root
@end smallexample
@end deffn

  Each condition allows for a negated form, by placing an exclamation
sign between the condition keyword and expression.  For example:

@table @code
@item command ^scp
True, if the command line begins with @samp{scp}.

@item command ! ^scp
True if the command line does not begin with @samp{scp}.
@end table

@node Transformations
@subsection Transformations
@cindex transformations
  Special actions that allow to rewrite command line are called
@dfn{transformations}.  GNU Rush supports five kinds of
transformations: @samp{set}, @samp{transform}, @samp{delete}, 
@samp{map}.  All of them operate on command line split into
@dfn{words}.  Additionally, @samp{set} and @samp{transform} can
operate on the entire command line.

@anchor{indexing}
@cindex word splitting
@cindex indexing, words in command line
  Rush performs word splitting using the same rules as @command{sh}.
Transformation actions refer to words by their @dfn{index}.  Three
kinds of indexes are supported.  First of all, a word may be referred
to by its ordinal number in the command line.  The command name itself
has index @samp{0}.  For example, given the command line:

@smallexample
/bin/scp -t /upload
@end smallexample

one gets:

@multitable @columnfractions 0.3 0.7
@headitem Index @tab Value
@item 0 @tab /bin/scp
@item 1 @tab -t
@item 2 @tab /upload
@end multitable

  Negative indexes can also be used.  They refer to words in the
backward order, as illustrated in the following table:

@multitable @columnfractions 0.3 0.7
@headitem Index @tab Value
@item -1 @tab /upload
@item -2 @tab -t
@item -3 @tab /bin/scp
@end multitable

  Finally, the last word may be referred to as @samp{$}, and the
command name itself as @samp{^}.  There is a subtle difference between
@samp{0} and @samp{^}.  The notation @samp{^} refers to the name of
the program that @command{rush} will execute at the end of the
matching rule, whereas the notation @samp{0} refers to the 0th
argument that will be passed to that program (@samp{argv[0]}).  Most
of the time the two values coincide.  Unless the rule modifies @samp{^},
@samp{0}th word will be used as the program name.  There exist some
cases when you need to explicitly set @samp{^}.  @xref{Interactive},
for a possible use of this feature.

@anchor{patterns}
@cindex patterns
@cindex meta-variables
  Some of the transformations implement @dfn{patterns}.  A pattern is
a string which may contain @dfn{meta-variables}.  Before using, these
meta-variables are expanded using the following rules:

@multitable @columnfractions 0.3 0.7
@headitem Meta-variable  @tab Expansion
@vindex user
@item $@{user@}          @tab User name
@vindex group
@item $@{group@}         @tab Name of the user's principal group
@vindex uid
@item $@{uid@}           @tab UID
@vindex gid
@item $@{gid@}           @tab GID
@vindex home
@item $@{home@}          @tab User's home directory
@vindex gecos
@item $@{gecos@}         @tab User's @acronym{GECOS} field
@vindex program
@item $@{program@}       @tab Program name (@samp{^})
@vindex command
@item $@{command@}       @tab Full command line
@vindex $@var{n}
@item $0 to $9           @tab Corresponding word from the command line
@vindex $@{@var{n}@}
@item $@{@var{N}@}       @tab @var{N}th word (see above for the
allowed values of @var{N})
@end multitable

@menu
* set::
* delete::
* transform::
* map::
@end menu

@node set
@subsubsection Set
@kwindex set
  The @samp{set} transformation allows to replace entire command line,
or any of its arguments, with the given value.

@deffn {Rule Config} set @var{pattern}
Command line is replaced with the expansion of @var{pattern}
(@pxref{patterns}).  E.g.:

@smallexample
set /bin/echo "Command forbidden: $@{command@}"
@end smallexample

@anchor{set-command}
  As another example, the following rule uses @code{transform} to
ensure that @file{/usr/bin/cvs} binary is used:

@smallexample
@group
rule cvs
  command ^cvs server
  set[0] /usr/bin/cvs
@end group
@end smallexample

In versions of GNU Rush prior to 1.6, it was common to use the
@code{transform} action for this purpose.
@end deffn

@deffn {Rule Config} set[@var{n}] @var{pattern}
Replace @var{n}th argument with the expansion of @var{pattern}.
Notice, that square brackets are part of the statement syntax.

@xref{indexing}, for a description of @var{n}.  @xref{patterns}, for
a description of @var{pattern}.  E.g.:

@smallexample
set[0] /bin/echo
@end smallexample
@end deffn

@node delete
@subsubsection Delete
@kwindex delete
  The @samp{delete} action deletes the given word, or range of words,
from the command line.  It has two forms.
  
@deffn {Rule Config} delete[@var{n}]
Delete @var{n}th word.  @xref{indexing}, for a detailed description of
@var{n} and its syntax.  However, see the note below.
@end deffn

@deffn {Rule Config} delete @var{n} @var{m}
Delete words from @var{n} to @var{m}, inclusive.  For example, the
following action removes all arguments, except the command name:

@smallexample
delete 1 $
@end smallexample
@end deffn

Neither form can be used to delete the command name, i.e.  @samp{[0]}
or @samp{[^]}. 

@node transform
@subsubsection Transform
@kwindex transform

  The @code{transform} action modifies the value of the command line,
or any particular word of it, according to a sed @dfn{s-expression}.
S-expressions are described in more detail below (@pxref{s-expression}).
This action has several forms.

@deffn {Rule Config} transform @var{expr}
Apply expression @var{expr} to entire command line.  For example, the
action below adds a @option{-t} option after the command name:

@smallexample
transform s,^[^ ]+,& -t,
@end smallexample
@end deffn

@deffn {Rule Config} transform @var{pattern} @var{expr}
Expand @var{pattern} as described in @ref{patterns}, apply @var{expr}
to the expansion, and replace the command line with the result.
@end deffn

@deffn {Rule Config} transform[@var{n}] @var{expr}
Apply expression @var{expr} to @var{n}th @dfn{word} from the
command line.  Notice, that square brackets are part of the statement
syntax.  @xref{indexing}, for a detailed description of @var{n} and
its syntax.
@end deffn

@deffn {Rule Config} transform[@var{n}] @var{pattern} @var{expr}
Apply expression @var{expr} to the expanded @var{pattern} and assign
the result to @var{n}th word.  @xref{patterns}, for a description of
patterns and their expansion.  @xref{indexing}, for a detailed
description of @var{n} and its syntax.

The example below replaces the 0th argument with the base name of the
command, prefixed by a dash:

@smallexample
transform[0] $@{^@} s,.*/,-
@end smallexample

For instance, if the command name is @samp{/bin/bash}, @samp{argv[0]} will
become @samp{-bash}.
@end deffn

@cindex s-expression
@anchor{s-expression}
The transformation expression, @var{expr}, is a @command{sed}-like
replace expression of the form:

@smallexample
s/@var{regexp}/@var{replace}/[@var{flags}]
@end smallexample

@noindent
where @var{regexp} is a @dfn{regular expression}, @var{replace} is a
replacement for each part of the input that matches @var{regexp}.  Both
@var{regexp} and @var{replace} are described in detail in
@ref{The "s" Command, The "s" Command, The `s' Command, sed, GNU sed}.

As in @command{sed}, you can give several replace expressions,
separated by a semicolon.

Supported @var{flags} are:

@table @samp
@cindex g, @option{transform} flag
@item g
Apply the replacement to @emph{all} matches to the @var{regexp}, not
just the first.

@cindex i, @option{transform} flag
@item i
Use case-insensitive matching

@cindex x, @option{transform} flag
@item x
@var{regexp} is an @dfn{extended regular expression} (@pxref{Extended
regexps, Extended regular expressions, Extended regular expressions,
sed, GNU sed}).

@item @var{number}
Only replace the @var{number}th match of the @var{regexp}.

Note: the @acronym{POSIX} standard does not specify what should happen
when you mix the @samp{g} and @var{number} modifiers.  @command{Rush}
follows the GNU @command{sed} implementation in this regard, so
the interaction is defined to be: ignore matches before the
@var{number}th, and then match and replace all matches from the
@var{number}th on.
@end table

Any delimiter can be used in lieue of @samp{/}, the only requirement being
that it be used consistently throughout the expression.  For example,
the following two expressions are equivalent:

@smallexample
@group
transform s/one/two/
transform s,one,two,
@end group
@end smallexample

  Changing delimiters is often useful when the @var{regex} contains
slashes.  For instance, it is more convenient to write @code{s,/,-,} than
@code{s/\//-/}.

  For example, the following rule uses @code{transform} to ensure that
@file{/usr/bin/cvs} binary is used:

@smallexample
@group
rule cvs
  command ^cvs server
  transform[0] s|.*|/usr/bin/cvs|
@end group
@end smallexample

 The same effect can be achieved with a @code{set} statement, as shown in
@ref{set-command}. 

 As a more complex example, consider the following rule:

@smallexample
@group
rule svn
  command ^svnserve -t
  transform s|-r *[^ ]*||;s|^svnserve |/usr/bin/svnserve -r /svnroot |
@end group
@end smallexample

  This transform expression first removes all occurrences of
@option{-r} option and its arguments from the command line, and then
adds its own @option{-r} option and replaces @samp{svnserve} with the
full program file name.

@node map
@subsubsection Map
@kwindex map
  The @samp{map} statement uses file lookup to find a new value for
the command line word.

@deffn {Rule Config} map[@var{n}] @var{file} @var{delim} @var{pattern} @
        @var{kn} @var{vn}
@deffnx {Rule Config} map[@var{n}] @var{file} @var{delim} @var{pattern} @
         @var{kn} @var{vn} @var{default}
Arguments are:

@table @var
@item n
Argument index, as in @ref{indexing}.

@item file
Name of the @dfn{map file}.  It must begin with @samp{/} or
@samp{~/}.  Before using, the file permissions and ownership are
checked using the procedure described in @ref{security checks}.

@item delim
A string containing allowed field delimiters.

@item pattern
The value of the lookup key.  Before using, it is expanded as
described in @ref{patterns}.

@item kn
Number of the key field in @var{file}.  Fields are numbered starting
from 1.

@item vn
Number of the value field.

@item default
If supplied, this value is used as a replacement value, when the key
was not found in @var{file}.
@end table
@end deffn

  The map file consists of @dfn{records}, separated by newline
characters (in other words, a record occupies one line).  Each record
consists of fields, separated by delimiters, given in @var{delim}
argument.  If @var{delim} contains a space character, then fields may
be delimited by any amount of whitespace characters (spaces and/or
tabulations).  Otherwise, exactly one delimiter delimits fields.

  Fields are numbered starting from 1.

  The @code{map} action works as follows:

@enumerate 1
@item
The @var{pattern} argument is expanded as described in @ref{patterns}
and the resulting value is used as lookup key.

@item
The @var{file} is scanned for a record whose @var{kn}th field
matches the lookup key.

@item
If such a record is found, the value of its @var{vn}th field is
assigned to the @var{n}th command line word (@pxref{indexing}, for a
description of @var{n}).

@item
Otherwise, if @var{default} is supplied, it becomes the new value of the
@var{n}th word.

@item
Otherwise, the @var{n}th word remains unchanged.
@end enumerate

  For example, suppose that the file @file{/etc/passwd.rush} has the
same syntax as the system @file{passwd} file (@pxref{passwd, Password
File,,passwd(5), passwd(5) man page}).  Then, the following statement
will replace @samp{argv[0]} with the value of @samp{shell} field,
using the current user name as a key:

@smallexample
map[0] /etc/passwd.rush : $@{user@} 1 7
@end smallexample

See also @ref{Interactive}, for another example of using this
statement.

@node System Actions
@subsection System Actions
@cindex system actions
@cindex actions, system

System actions provide an interface to the operating system.

@deffn {Rule Config} umask @var{mask}
Set the umask.  The @var{mask} must be an octal value not greater than
@samp{0777}.  The default umask is @samp{022}.
@end deffn

@deffn {Rule Config} newgrp @var{group-id}
@deffnx {Rule Config} newgroup @var{group-id}
Changes the current group ID to @var{group-id}, which is either a
numeric value or a name of an existing group.
@end deffn

@deffn {Rule Config} chroot @var{dir}
@cindex tilde expansion
Change the root directory to that specified in @var{dir}.  This
directory will be used for file names beginning with @samp{/}.
A tilde (@samp{~}) at the start of @var{dir} is replaced with
the user's home directory.
@end deffn

The directory @var{dir} must be properly set up to execute the 
commands.  For example, the following rule defines execution of
@command{sftp-server} in an environment, chrooted to the user's home
directory:

@smallexample
@group
rule sftp
  command ^.*/sftp-server
  set[0] bin/sftp-server
  chroot ~
@end group
@end smallexample

For this to work, each user's home must contain the directory
@file{bin} with a copy of @file{sftp-server} in it, as well as all 
directories and files that are needed for executing it, in particular
@file{lib}.

@deffn {Rule Config} chdir @var{dir}
Change to the directory @var{dir}.  The argument is subject to
tilde-expansion (see @code{chroot}, above).  If both @code{chdir} and
@code{chroot} are specified, then @code{chroot} is executed first.
@end deffn

@deffn {Rule Config} limits @var{res}
Impose limits on system resources, as defined by @var{res}.  The
argument consists of @dfn{commands}, optionally separated by any
amount of whitespace.  A command is a single command letter followed
by a number, that specifies the limit.  The command letters are
case-insensitive and coincide with those used by the shell @code{ulimit}
utility:

@multitable @columnfractions 0.3 0.6 
@headitem Command @tab  The limit it sets
@item     A       @tab  max address space (KB)
@item     C       @tab  max core file size (KB)
@item     D       @tab  max data size (KB)
@item     F       @tab  maximum file size (KB)
@item     M       @tab  max locked-in-memory address space (KB)
@item     N       @tab  max number of open files
@item     R       @tab  max resident set size (KB)
@item     S       @tab  max stack size (KB)
@item     T       @tab  max CPU time (MIN)
@item     U       @tab  max number of processes
@item     L       @tab  max number of logins for this user (see below)
@item     P       @tab  process priority -20..20 (negative = high priority)
@end multitable

For example:

@smallexample
limits T10 R20 U16 P20
@end smallexample

@cindex simultaneous sessions
@cindex limiting number of simultaneous sessions
@anchor{L limit}
If some limit cannot be set, execution of the rule aborts.  In
particular, @samp{L} limit can be regarded as a condition, rather than
action.  The setting @code{limit L@var{n}} succeeds only if no
more than @var{n} @code{rush} instances are simultaneously running for
the same user.  This can be used to limit the number of simultaneously
open sessions. 

The use of @samp{L} resource automatically enables @dfn{forked mode}.
@xref{Accounting and Forked Mode}, for more information about it.
@end deffn

@node Environment
@subsection Environment
@cindex Environment

The @code{env} action allows to modify the environment in which the
program will be executed.

@deffn {Rule Config} env @var{args}
Modify the environment.
@end deffn

Its argument is a whitespace-delimited list of specifiers.  The
following specifiers are understood: 

@table @asis
@item - (a dash)
Clear the environment.  This is understood only when used as a first
word in @var{args}.

@item -@var{name}
Unset the environment variable @var{name}.

@item -@var{name}=@var{val}
Unset the environment variable @var{name} only if its value is @var{val}.

@item @var{name}
Retain the environment variable @var{name}.

@item @var{name}=@var{value}
Define environment variable @var{name} to have given @var{value}.

@item @var{name}+=@var{value}
Retain variable @var{name} and append @var{value} to its value.  If no
such variable is present in the environment, it is created and
@var{value} is assigned to it.  However, if @var{value} starts with a
punctuation character, this character is removed from it before the
assignment.  This is convenient for using this construct with 
environment variables like @env{PATH}, e.g.:

@smallexample
PATH+=:/sbin
@end smallexample

In this example, if @env{PATH} exists, @samp{:/sbin} will be appended
to it.  Otherwise, it will be created and @samp{/sbin} will be
assigned to it.

@item @var{name}=+@var{value}
Retain variable @var{name} and prepend @var{value} to its value.  If
no such variable is present in the environment, it is created and
@var{value} is assigned to it.  However, if @var{value} ends with a
punctuation character, this character is removed from it before
assignment.
@end table

@node Fall-through
@subsection Fall-through
@cindex fall-through rule
A @dfn{fall-through} rule is a special rule that does not execute the
requested command.  When a matching fall-through rule is encountered,
@command{rush} evaluates it and continues scanning its configuration
for the next matching rule.  Any transformation and @code{env}
actions found in the fall-through rule take effect immediately, which
means that subsequent rules will see modified command line and
environment.  Execution of any other actions found in the fall-through rule
is delayed until a usual rule is found.

A fall-through rule is declared using the following statement:

@deffn {Rule Config} fall-through
Declare a fall-through rule.
@end deffn

Usually this statement is placed as the last statement in a rule, e.g.:

@smallexample
@group
rule default
  umask 002
  env - HOME USERNAME PATH
  fall-through
@end group
@end smallexample

Fall-through rules provide a way to set default values for subsequent
rules.  For example, any rules that follow the @samp{default} rule
shown above, will inherit the umask and environment set there.

One can also use fall-through rules to ``normalize'' command lines.
For example, consider this rule:

@smallexample
@group
rule default
  transform[0] s|.*/||;
  fall-through
@end group
@end smallexample

It will remove all path components from the first command line argument.
As a result, all subsequent rules may expect a bare binary name as the
first argument.

Yet another common use for such rules is to enable accounting (see the
next subsection), or set resource limits for the rest of rules:

@smallexample
@group
rule default
  limit l1
  fall-through
@end group
@end smallexample

@node Accounting and Forked Mode
@subsection Accounting and Forked Mode
@cindex accounting
  GNU Rush is able to operate in two modes, which we call default and
forked.  When operating in the default mode, the process image of
@command{rush} itself is overwritten by the command being executed.
Thus, when it comes to launching the requested command,
the running instance of @command{rush} ceases to exist.

@cindex forked mode
  There is also another operation mode, which we call @dfn{forked
mode}.  When running in this mode, @command{rush} executes the
requested command in a subprocess, and remains in memory supervising
its execution.  Once the command terminates, @command{rush} exits.

  One advantage of the forked mode is that it allows to run
@dfn{accounting}, i.e. to note who is doing what and to keep a
history of invocations.  The accounting, in turn, can be used to limit
simultaneous executions of commands (@dfn{logins}, in
GNU Rush terminology), as requested by @samp{L} command to @code{limit}
statement (@pxref{L limit}).

  The forked mode is enabled on a per-rule basis, for rules that
contain either @samp{L} command in the @code{limit} statement, or
@samp{acct on} command:

@deffn {Rule Config} acct @var{bool}
Turn accounting mode on or off, depending on @var{bool}.  The argument
can be one of the following: @samp{yes}, @samp{on}, @samp{t}, 
@samp{true}, or @samp{1}, to enable accounting, and @samp{no},
@samp{off}, @samp{nil}, @samp{false}, @samp{0}, to disable it.

Notice, that there is no need in explicit @code{acct on} command, if
you use @command{limit L}.
@end deffn

The notion @samp{rule contains}, used above, means that either the
rule in question contains that statement, or inherits it from one
of the above fall-through rules (@pxref{Fall-through}).  In fact, in
most cases the accounting should affect all rules, therefore we
suggest to enable it in a fall-through rule at the beginning of the
configuration file, e.g.:

@smallexample
rule default
  acct on
  fall-through 
@end smallexample

If the need be, you can disable it for some of the subsequent rules by
placing @code{acct off} in it.  Notice, that this will disable
accounting only, the forked mode will remain in action.  To disable it
as well and enforce default mode for a given rule, use @code{fork off}
statement:

@deffn {Rule Config} fork @var{bool}
Enable or disable forked mode.  This statement is mainly designed as a
way of disabling the forked mode for a given rule.
@end deffn

  Once the accounting enabled, you can view the list of currently
logged in users using @code{rushwho} command (@pxref{Rushwho}) and
view the history of last logins using @code{rushlast} command
(@pxref{Rushlast}).

@node Notification
@subsection Post-process Notification

  @command{Rush} can be configured to send a @dfn{notification} over
@acronym{INET} or @acronym{UNIX} sockets, after completing user
request.  It is done using the @code{post-socket} statement:

@deffn {Rule Config} post-socket @var{url}
Notify @acronym{URL} about completing the user request.  This statement
implies forked mode (@pxref{Accounting and Forked Mode}). 

Allowed formats for @var{url} are:

@table @asis
@item inet://@var{hostname}[:@var{port}]
@cindex tcpmux

Connect to remote host @var{hostname} using TCP/IP.  @var{Hostname} is the
host name or IP address of the remote machine.  Optional @var{port}
specifies the port number to connect to.  It can be either a decimal
port number or a service name from @file{/etc/services}.  If
@var{port} is absent, @samp{tcpmux} (port 1) is assumed.

@item unix://@var{filename}
@itemx local://@var{filename}

Connect to a @acronym{UNIX} socket @var{filename}.
@end table

For example:

@smallexample
@group
rule default
  post-socket inet://localhost
@end group
@end smallexample
@end deffn

  The GNU Rush notification protocol is based on @acronym{TCPMUX}
(@uref{http://www.rfc-editor.org/rfc/rfc1078.txt, RFC 1078}).

  After establishing connection, @command{rush} sends the rule tag
followed by a CRLF pair.  The rule tag acts as a service name.  The
remote party replies with a single character indicating positive
(@samp{+}) or negative (@samp{-}) acknowledgment, immediately followed
by an optional message of explanation, terminated with a CRLF. 

  If positive acknowledgment is received, @command{rush} sends a
single line, consisting of the user name and the executed command
line, separated by a single space character.  The line is terminated
with a CRLF.

  After sending this line, @command{rush} closes the connection.

  The post-process notification feature can be used to schedule
execution of some actions after certain rules.  

  @xref{notification example}, for an example of how to use this
feature.  

@node Exit
@subsection Exit rule
@cindex exit rule
  An @dfn{exit} rule does not execute any commands.  Instead, it writes
the supplied error message to the specified file descriptor and exits
immediately.  An exit rule is defined using the following statement:

@deffn {Rule Config} exit @var{fd} @var{message}
@deffnx {Rule Config} exit @var{message}
Write textual message @var{message} to a file descriptor, given by the
optional argument @var{fd}.  If @var{fd} is absent, @samp{2} (standard
error) is used.
@end deffn

The @var{message} argument is subject to backslash interpretation
(@pxref{backslash-interpretation}).

For example (note the use of line continuation character):

@smallexample
exit \
    \r\nYou are not allowed to execute that command.\r\n\
    \r\nIf you think this is wrong, ask <foo@@bar.com> for assistance.\r\n
@end smallexample

  If @var{message} begins with a @samp{@@} sign, the remaining
characters are treated as the name of a predefined error message
(@pxref{Error Messages}).  The corresponding message text is retrieved
and used instead of @var{message}.  For example:

@smallexample
  exit @@nologin-message
@end smallexample

  If the characters after @samp{@@} do not correspond to any
predefefined error message name, an error of type @samp{config-error}
is signalled and @command{rush} exits.

  If you need to begin your exit message with a @samp{@@} sign,
duplicate it, as in this example:

@smallexample
  exit @@@@Special error message
@end smallexample

  This example will produce @samp{@@Special error message}.
  
@cindex trap rule
Exit actions are useful for writing @dfn{trap rules}, i.e. the rules that
are intended to trap incorrect or prohibited command lines and to return
customized reply messages in such cases.  Consider the following
rule:

@smallexample
@group
rule git
  command ^git-.+
  match[1] ^/sources/[^ ]+\.git$
  transform s|.*|/usr/bin/git-shell -c "&"|
@end group
@end smallexample

It allows to use only those Git repositories that are located under
@file{/sources} directory@footnote{@xref{git}, for a better way to
handle Git accesses.}.  If a user tries to access a repository
outside this root, he will be returned a default error message, saying
@samp{You are not permitted to execute this command} (@pxref{Error
Messages, usage-error}).  You can, however, provide a more convenient
message in this case.  To do so, place the following after the
@samp{git} rule: 

@smallexample
@group
rule git-trap
  command ^git-.+
  exit fatal: Use of this repository is prohibited.
@end group
@end smallexample

This rule will trap all git invocations that do not match the
@samp{git} rule.

@node Interactive
@subsection Interactive Access
@cindex interactive access
  Sometimes it may be necessary to allow some group of users limited
access to interactive shells.  GNU Rush contains provisions for such
usage.  When @command{rush} is invoked without @option{-c} it assumes
interactive usage.  In this case only rules explicitly marked as
interactive are considered, the rest of rules is ignored.

@deffn {Rule Config} interactive
This statement marks the rule it appears in as interactive.  This rule
will match only if @command{rush} is invoked without command line
arguments.
@end deffn

Unless command line transformations are applied, interactive rule
finishes by executing @command{/bin/sh}.  The first word in the
command line (@code{argv[0]}) is normally set to the basename of
the command being executed prefixed by a dash sign.

Consider the following example:

@smallexample
rule login
  interactive
  group rshell
  map[^] /etc/rush.shell : $@{user@} 1 2
  transform[0] $@{program@} s,^,-r,

rule nologin
  interactive
  exit You don't have interactive access to this machine.
@end smallexample

The @samp{login} rule will match interactive user requests if the user
is a member of the group @samp{rshell}.  It uses
@file{/etc/rush.shell} to select a shell to use for that user
(@pxref{map}).  This map file consists of two fields, separated by a
colon.  If the shell is found, its base name, prefixed with @samp{-r},
will be used as @samp{argv[0]} (this indicates a restricted login shell).
Otherwise, the trap rule @samp{nologin} will be matched, which will
output the given diagnostics message and terminate @command{rush}. 

To test interactive access, use the @option{-i} option:

@smallexample
rush --test -i 
@end smallexample

@node Localization
@subsection Localization
@cindex i18n
@cindex internationalization
@cindex l10n
@cindex localization
  GNU Rush is internationalized, which means that it is able to
produce log and diagnostic messages in any language, if a
corresponding translation file is provided.  This file is called a
@dfn{localization} or @dfn{domain} file.  To find an appropriate
localization file, @command{rush} uses the following parameters:

@table @var
@cindex locale name
@item locale
@dfn{Locale name} is a string that describes the language, territory
and optionally, the character set to use.  It consists of the language
(ISO 639) and country (ISO 3166) codes, separated by an underscore
character, e.g.  @samp{en_US} or @samp{pl_PL}.  If a character set is
specified, its name follows the country code and is separated from it
by a @samp{@@} character.

There are two special locale names: @samp{C} or @samp{POSIX} mean to
use the default @acronym{POSIX} locale, and @samp{""} (an empty
string), means to use the value of the environment variable
@env{LC_ALL} as the locale name.

@cindex locale directory
@item locale_dir
Directory where localization files are located.  If not specified, a
predefined set of directories is searched for the matching file.

@cindex domain, localization
@cindex textual domain
@item domain
@dfn{Text domain} defines the base name of the localization file.
@end table

@anchor{mo-name}
Given these parameters, the name of the full pathname of the
localization file is defined as:

@smallexample
@var{locale_dir}/@var{locale}/LC_MESSAGES/@var{domain}.mo
@end smallexample

GNU Rush produces three kinds of messages:

@table @asis
@item diagnostics
These are diagnostics messages that GNU Rush produces to its log output
(syslog, unless in test mode).

@item error messages
Messages sent to the remote party when @command{rush} is not able to
execute the request (@pxref{Error Messages}).

@item exit messages
These are messages sent to the remote party by @code{exit} rules
(@pxref{Exit}). 
@end table

These messages use different domain names (and may use different
locale directories).  The diagnostics and error messages use textual
domain @samp{rush}.  The corresponding locale directory is defined at
compile time and defaults to @file{@var{prefix}/share/locale}, where
@var{prefix} stands for the installation prefix, which is
@file{/usr/local}, by default.

GNU Rush is shipped with several localization files, which are installed
by default.  As of version @value{VERSION}, these files cover the
following locales:

@table @asis
@item C
@itemx POSIX
This is default domain, it is always supported and does not require
any special handling.  It is roughly equivalent to @samp{en_US}
(English). 

@item pl
Polish messages. 

@item uk
Ukrainian messages.
@end table

If the localization you need is not in this list, visit
@uref{http://translationproject.org/domain/rush.html}.  If it is not
there either, consider writing it (see @ref{Translators,,,gettext, GNU
gettext utilities}, for a detailed instructions on how to do that).

Exit messages use custom domain files.  It is responsibility of
the system administrator to provide and install such files.

@menu
* Localization Directives::
* Writing Your Localization::
@end menu

@node Localization Directives
@subsubsection Localization Directives
@cindex localization directives

The following configuration directives control localization.  They
are available for use in @code{rule} statements:

@deffn {Configuration} locale @var{name}
Sets the locale name.  To specify empty locale, use @samp{""} as
@var{name} (recall that empty locale name means use the value of the
environment variable @env{LC_ALL} as locale name).
@end deffn

@deffn {Configuration} locale-dir @var{name}
Sets the name of the locale directory.
@end deffn

@deffn {Configuration} text-domain @var{name}
Sets the textual domain name.
@end deffn

The following configuration fragment illustrates their use:

@smallexample
@group
rule l10n
  locale pl_PL
  text-domain rush-config
  fall-through
@end group
@end smallexample

Different users may have different localization
preferences.  @xref{per-user l10n}, for a description of how to
implement this.
  
@node Writing Your Localization
@subsubsection Writing Your Localization
  You need to write a localization file for your configuration script
if it implements exit rules (@pxref{Exit}) and changes user locale
(@pxref{Localization Directives, locale}).

  Preparing localization consists of three stages: extracting exit
messages and forming a @acronym{PO} file, editing this file, compiling and
installing it.  The discussion below describes these stages in detail.

@enumerate 1
@item Creating a @samp{po} file.

  A @acronym{PO} (@dfn{Portable Object}) file is a plain text file,
containing original messages and their translations for a particular
language.  @xref{PO Files, The Format of PO Files,,gettext, GNU
gettext utilities}, for a description of its format.

@cindex rush-po.awk
  The script @command{rush-po.awk} serves for extracting messages from
the configuration file and forming a @acronym{PO} file.  This script
is installed in the @file{@var{prefix}/share/rush}
directory@footnote{To be precise, it is installed in
@file{@var{dataroot}/rush}, where @var{dataroot} is a directory for
read-only architecture-independent data, which is set by the
@option{--datarootdir} option to @command{configure}.  Unless that
option is used, this directory defaults to
@file{@var{prefix}/share/rush}}, where @var{prefix} stands for your
installation prefix. 

  Supposing the package is installed in the default prefix, the
following command will create a @acronym{PO} file from your
configuration file:

@smallexample
@group
  awk -f /usr/local/share/rush/rush-po.awk \
         /usr/local/etc/rush.rc > myconf.po
@end group
@end smallexample

  Please note, that @command{rush-po.awk} does not handle
@code{include} directives (@pxref{Include}).  If your configuration
file uses these directives, you need to specify each include file in
the @command{rush-po.awk} command line, e.g.:

@smallexample
@group
  awk -f /usr/local/share/rush/rush-po.awk \
         /usr/local/etc/rush.rc /home/*/.rush > myconf.po
@end group
@end smallexample

@item Editing the @acronym{PO} file

Open the created @acronym{PO} file with your favorite editor and supply
message translations after @code{msgstr} keywords.  Although you can
use any editor, capable of handling plain text files, we recommend to
use GNU Emacs, which provides a special @dfn{po-mode}.  @xref{Basics,
PO Files and PO Mode Basics,,gettext, GNU gettext utilities}, for guidelines
on editing @acronym{PO} files and using the po-mode.

@item Compiling the @acronym{PO} file

@pindex msgfmt
When ready, the @acronym{PO} file needs be compiled into a
@acronym{MO} (@dfn{Message Object}) file, which is directly readable
by @command{rush}.  This is done using @command{msgfmt} utility from
GNU gettext:

@smallexample
  msgfmt -o myconf.mo myconf.po
@end smallexample

@xref{msgfmt Invocation,,,gettext, GNU gettext utilities}, for a
detailed description of the @command{msgfmt} utility.

After creating the @acronym{MO} file, copy it into appropriate
directory.  It is important that the installed @acronym{MO} file uses
the naming scheme described in @ref{mo-name, localization file
naming}.
@end enumerate
  
@node Include
@section Include
@cindex include
  The @code{include} statement forces inclusion of the named file in
that file location:

@deffn {Configuration} include @var{file}
  Include file @var{file}
@end deffn

@cindex tilde expansion
If @var{file} starts with a tilde character, followed by
a slash (@samp{~/}), these two characters are replaced with the
full path name of current user's home directory.

If @var{file} is a directory, that directory is searched for a file
whose name coincides with the current user name.  If such a file is
found, it is included.

In any case, if the file named by @var{file} (after tilde expansion)
does not exist, no error is reported, and parsing of the configuration
file continues.

Before including the file, @command{rush} checks if it is secure, using
the same rules as for the main configuration file (@pxref{security
checks}).  The exact list of checks can be tuned using the
@code{include-security} statement:

@anchor{include-security}
@deffn {Configuration} include-security @var{list}
Configure the security checks for include files.  This statement takes
a list of arguments, separated by white space.  The following
arguments are recognized:

@table @code
@item all
Enable all checks.

@item owner
The file is not owned by root.

@item iwgrp
@itemx groupwritablefile
The file is group writable.

@item iwoth
@itemx worldwritablefile
The file is world writable.

@item dir_iwgrp
@itemx groupwritabledir
The file resides in a group writable directory.

@item dir_iwoth
@itemx worldwritabledir
The file resides in a world writable directory.

@item link
The file is a symbolic link to a file residing in a group or world
writable directory.
@end table

Each of the above keywords may be prefixed by @samp{no}, which
reverses its meaning.  The special keyword @samp{none} is synonymous
to @samp{noall}, i.e. it disables all checks.  Each keyword adds or
removes a particular test to the existing check list, which is
initialized as described in @ref{security checks}.  Thus, the foll
owning statement results in all checks, except for the file ownership:

@smallexample
include-security noowner
@end smallexample

In the example below, the check list is first cleared by using the
@code{noall} statement, and then a set of checks is added to it:

@smallexample
include-security noall owner iwoth iwgrp
@end smallexample

The @code{include-security} statement is global, i.e. it affects all
@code{include} statements appearing below it, up to the next
@code{include-security} statement, or end of configuration file,
whichever occurs first.
@end deffn

The @code{include} statement can appear in any place of the
configuration file, both within or outside a rule.

This statement provides a convenient way for user-dependent
@command{rush} configuration.  For example, the following fall-through
rule (@pxref{Fall-through}) allows to keep each user's configuration
in a file named @file{.rush}, located in the user's home directory:

@smallexample
@group
rule user
  inlcude ~/.rush
  fall-through
@end group
@end smallexample

Of course, it is supposed that such a per-user file, if it exists, is
writable only for super-user and does not contain any @code{rule}
statements.

@anchor{per-user l10n}
The use of include files may be especially useful for per-user
localization (@pxref{Localization}).  It suffices to provide a
fall-through rule, similar to the one above, and to place a
@code{locale} directive in @file{~/.rush} files, according to the
users' preferences.

@node Debugging
@section Debugging
@cindex debugging
  The @code{debug} statement sets the @dfn{debugging level} -- an
integer value that controls the verbosity of @command{rush}:

@deffn {Configuration} debug @var{num}
Set the debugging level to @var{num}.
@end deffn

  The greater @var{num} is, the more verbose is the logging.  The
debugging information is reported via @code{syslog} at facility
@samp{authpriv}, priority @samp{debug}.  As of version @value{VERSION},
the following debugging levels are supported: 

@cindex debugging levels
@table @asis
@item 1
A minimum debugging level, and the only one whose messages are logged
using the priority @samp{notice}.  At this level, @command{rush} only
logs requests and rules selected to handle them.  For example:

@smallexample
rush[16821]: Serving request "/usr/libexec/sftp-server"
for sergiusz by rule sftp-savane
@end smallexample

@item 2
List all actions executed when serving requests.

@item 3
Verbosely describe parsing of the configuration file.
@end table

  More debugging levels may be implemented in future.  

@node Regex
@section Regex
@cindex regular expressions
@cindex extended regular expressions
@cindex basic regular expressions

The @code{regex} statement configures the flavor of regular
expressions for use by subsequent @code{command}, @code{match} and
@code{transform} statements.

@deffn {Configuration} regex @var{regex-flags}
Configure the type of regular expressions.
@end deffn

@var{Regex-flags} is a whitespace-separated list of flags.
Each flag is a word specifying some regular expression 
feature.  It can be preceded by @samp{+} to enable this feature (this
is the default), or by @samp{-} to disable it.  Valid flags are:

@table @samp
@item extended
Use @acronym{POSIX} Extended Regular Expression syntax when
interpreting regex.  This is the default.

@item basic
Use basic regular expressions.  Equivalent to @samp{-extended}.

@item icase
Do not differentiate case.  Subsequent regex matches will be case
insensitive. 
@end table

For example, the following statement enables @acronym{POSIX} extended,
case insensitive matching:

@smallexample
regex +extended +icase
@end smallexample

The @code{regex} settings affect subsequent @code{command} and
@code{match} statements (@pxref{Conditions}), and remain in effect
until next @code{regex} statement or the end of configuration file,
whichever occurs first.

@node Sleep Time
@section Sleep Time

@deffn {Configuration} sleep-time @var{number}
Set the time in seconds to sleep before exiting on error.  
@end deffn

This statement is intended as a measure against brute-force attacks.
Default sleep time is 5 seconds.

@node Error Messages
@section Error Messages
@cindex error messages

A set of statements configures textual messages which GNU Rush
returns to the user if an error of some class occurs.  All of them
take a single argument which is subject to backslash interpretation,
as described in @ref{Exit, backslash interpretation}. 

@deffn {Configuration} usage-error @var{text}
Define a textual message which is returned to the remote party if a
usage error occurs.  

Default is:

@smallexample
You are not permitted to execute this command.
@end smallexample
@end deffn

@deffn {Configuration} nologin-error @var{text}
Define a textual message which is returned to the remote user if
there is no such user name in the password database.  

Default is:

@smallexample
You do not have interactive login access to this machine.
@end smallexample
@end deffn

@deffn {Configuration} config-error @var{text}
Define a textual message which is returned to the remote party on
Rush configuration errors.  

Default is:

@smallexample
Local configuration error occurred.
@end smallexample
@end deffn

@deffn {Configuration} system-error @var{text}
Define a textual message which is returned to the remote party if
a system error occurs. 

Default message is:

@smallexample
A system error occurred while attempting to execute command.
@end smallexample
@end deffn

@node Default Configuration
@chapter Default Configuration

You can compile @command{rush} with the default configuration built in
the binary.  Such a binary can then be run without configuration file.
However, if a configuration file is present, it takes priority over
the built-in configuration.

To compile @command{rush} with the built-in configuration, first
compile the package as usual.  Then, prepare a configuration file, and
test it using @command{rush --lint}.  If the test shows no errors,
reconfigure the package, using the @option{--with-default-config}
option:

@smallexample
  ./configure --with-default-config=@var{file}
@end smallexample

@noindent
where @var{file} is the name of your configuration file.  Then,
recompile and install the package.

@opindex --show-default
You can inspect the built-in configuration using the
@option{--show-default} option:

@smallexample
  rush --show-default
@end smallexample

@node Usage Tips
@chapter Usage Tips
In this chapter we will explain how to write GNU Rush configuration rules
for several popular remote copy and version control system
utilities.  For this purpose, we assume the following setup:

@itemize @bullet
@item Users are allowed to use @code{scp} and @code{rsync} to upload
files to the @file{/incoming} directory and to copy files to and from
their @file{~/public_html} directory.  
The @file{/incoming} directory is located on server in @file{/home/ftp}
directory, but that is transparent to users, i.e. they use
@code{scp @var{file} @var{host}:/incoming} (not
@code{@var{host}:/home/ftp/incoming}) to upload files.

@item Additionally, users may use @command{sftp} to manage their
@file{~/public_html} directory.  In this case, to prevent users from
accessing other directories, @command{sftp-server} is executed in a
chrooted environment. 

@item The server runs three version control system repositories, whose
corresponding repositories are located in the following directories:

@multitable @columnfractions 0.3 0.7
@headitem VCS @tab Repository Root
@item cvs     @tab /cvsroot
@item svn     @tab /svnroot
@item git     @tab /gitroot
@end multitable
@end itemize

@menu
* scp::
* rsync::
* sftp::
* cvs::
* svn::
* git::
* notification example::
@end menu

@node scp
@section scp
@cindex scp
The @code{scp} utility is executed on the server side
with option @option{-t}, when copying files to server, and with
@option{-f} when copying from it.  Thus, the basic templates for
@code{scp} rules are:

@smallexample
# Copying to server:
rule scp-to
  command ^scp -t
  ...

# Copying from server:  
rule scp-from
  command ^scp -f
  ...
@end smallexample

You may also wish to allow for @option{-v} (@samp{verbose}) command
line option.  In this case, the @samp{scp-to} rule will become:

@smallexample
rule scp-to
  command ^scp (-v )?-t
  ...
@end smallexample

First, we want users to be able to upload files to
@file{/home/ftp/incoming} directory.  Moreover, the @file{/home/ftp}
directory prefix must be invisible to them.  We must also make sure
that the user cannot get outside the @file{incoming} directory by using
@file{../} components in his upload path.  So, our first rule for
@code{scp} uploads will be:

@smallexample
rule scp-to-incoming
  command ^scp (-v )?-t /incoming/
  match[$] ! \.\./
  set[0] /bin/scp
  transform[$] s|^|/home/ftp/|
@end smallexample

The @code{match[$]} statement ensures that no relative components are
used.  Two transform rules ensure that the right @command{scp} binary
is used and that @file{/home/ftp} prefix is prepended to the upload
path.

Other than uploading to @file{/incoming}, users must be able to use
@command{scp} to manage @file{public_html} directories located in
their homes.  They should use relative paths for that, i.e., the
command:

@smallexample
$ scp file.html server:
@end smallexample

@noindent
will copy file @file{file.html} to @file{~/public_html/file.html} on
the server.  The corresponding rule is:

@smallexample
rule scp-home
  command ^scp (-v )?-[tf] [^/].*
  match[$] ! \.\./
  set[0] /bin/scp
  transform[$] s|^|public_html/|
  chdir ~
@end smallexample

Finally, we provide two trap rules for diagnostic purposes:

@smallexample
rule scp-to-trap
  command ^scp (-v )?-t
  exit Error: Uploads to this directory prohibited

rule scp-from  
  command ^scp (-v )?-f
  exit Error: Downloads from this directory prohibited
@end smallexample

@node rsync
@section rsync
@cindex rsync
On the server side, @command{rsync} is executed with the
@option{--server} command line option.  In addition, when copying
files from the server, the @option{--sender} option is used.  This
allows to discern between incoming and outgoing requests.

In our setup, @command{rsync} is used the same way as @command{scp}, so
the two rules will be:

@smallexample
rule rsync-incoming
  command ^rsync --server
  command ! --sender
  match[$] /incoming/
  match[$] ! \.\./
  transform[0] s|^|/usr/bin/|
  transform[$] s|^|/home/ftp/|

rule rsync-home
  command ^rsync
  match[$] ! ^[^/]
  match[$] ! \.\./
  transform[0] s|^|/usr/bin/|
  transform[$] s|^|public_html/|
  chdir ~
@end smallexample

The trap rules for @command{rsync} are trivial:

@smallexample
rule rsync-to-trap
  command ^rsync
  command --sender
  exit Error: Downloads from this directory prohibited

rule rsync-from-trap
  command ^rsync
  exit Error: Uploads to this directory prohibited
@end smallexample

@node sftp
@section sftp
@cindex sftp
Executing @command{sftp} on the client machine invokes
@command{sftp-server}, without arguments, on the server. 

We want to allow our users to use @command{sftp} to manage their
@file{public_html} directories.  The @command{sftp-server} will be
executed with the user's home directory as root, in a chrooted
environment.  For this to work, each user's home must contain a copy
of @command{sftp-server} (which we'll place in @file{~/bin}
subdirectory) and all files it needs for normal execution: 
@file{/etc/group} and @file{/etc/passwd} with one entry
(for the user and his group), and, unless the binary is linked
statically, all the shared libraries it is linked with, in the
subdirectory @file{~/lib}.

Given these prerequisites, the following rule will ensure proper
@command{sftp} interaction:

@smallexample
rule sftp-incoming
  command ^.*/sftp-server
  set[0] /bin/sftp-server
  chroot ~
  chdir public_html
@end smallexample

Notice the last action.  Due to it, users don't have to type @code{cd
public_html} at the beginning of their sftp sessions.

@node cvs
@section cvs
@cindex cvs
Using @command{cvs} over @code{ssh} invokes @command{cvs server} on
the server machine.  In the simplest case, the following rule will do
to give users access to @acronym{CVS} repositories:

@smallexample
@group
rule cvs
  command ^cvs server
  transform s|^cvs|/usr/bin/cvs -f
@end group
@end smallexample

However, @command{cvs} as of version 1.12.13 does not allow to limit root
directories that users are allowed to access.  It does have
@option{--allow-root} option, but unfortunately this option is ignored when
invoked as @command{cvs server}.  To restrict possible roots, we have
to run @command{cvs} in a chrooted environment.  Let's suppose we
created an environment for @command{cvs} in directory @file{/var/cvs},
with the @command{cvs} binary located in @file{/var/cvs/bin} and
repository root directory being @file{/var/cvs/cvsroot}.  Then, we can
use the following rule: 

@smallexample
rule cvs
  command ^cvs server
  set[0] /bin/cvs
  chroot /var/cvs
@end smallexample

@node svn
@section svn
@cindex svn
Remote access to @acronym{SVN} repositories is done via
@command{svnserve} binary.  It is executed on server with @option{-t}
option.  The @option{-r} option can be used to restrict access to a
subset of root directories.  So, we can use the following rule:

@smallexample
@group
rule svn
  command ^svnserve -t
  transform s|-r *[^ ]*||;s|^svnserve |/usr/bin/svnserve -r /svnroot|
@end group
@end smallexample

The @code{transform} action removes any @option{-r} options the user
might have specified and enforces a single root directory.  A more
restrictive action can be used to improve security:

@smallexample
  transform s|.*|/usr/bin/svnserve -r /svnroot|
@end smallexample

@node git
@section git
@cindex git
@cindex git-receive-pack
@cindex git-upload-pack
@cindex git-shell
Remote access to Git repositories over ssh causes execution of
@code{git-receive-pack} and @code{git-upload-pack} on the server.
The simplest rule for Git is:

@smallexample
@group
rule git
  command ^git-(receive|upload)-pack
  transform[0] s|^|/usr/bin/|
@end group
@end smallexample

The @code{transform} action is necessary to ensure the proper location
of Git binaries to use.  This example supposes they are placed in
@file{/usr/bin}, you will have to tailor it if they are located
elsewhere on your system.

To limit Git accesses to repositories under @file{/gitroot} directory, use
@code{match[1]} construct, as shown in the example below:

@smallexample
@group
rule git
  command ^git-(receive|upload)-pack
  match[1] ^/gitroot[^ ]+\.git$
  transform[0] s|^|/usr/bin/|
@end group
@end smallexample

To provide more helpful error messages, you may follow this rule by a
trap rule (@pxref{Exit, trap rules}):

@smallexample
@group
# @r{Trap the rest of Git requests:}
rule git-trap
  command ^git-.+
  exit fatal: access to this repository is denied.
@end group
@end smallexample

@node notification example
@section Notification
  In this section we will show how to set up a mail notification for
Rush rules.  Let's suppose we wish to receive emails for each upload
by @code{scp-to} rule (@pxref{scp}).  To do so, we add the following
fall through rule to the beginning of @file{rush.rc}:
  
@smallexample
rule default
  post-socket inet://localhost
  fall-trough
@end smallexample

This will enable notifications for each rule located below this one.
Missing port in @code{post-socket} statement means @command{rush} will
be using the default @samp{tcpmux} port.

To receive and process these requests, you will need an
@command{inetd} capable to handle @acronym{TCPMUX}.  We recommend the
one from GNU Inetutils package
(@uref{http://www.gnu.org/software/inetutils, GNU Inetutils}).  In
@file{/etc/inetd.conf} file, we add:

@smallexample
# @r{Enable @acronym{TCPMUX} handling}.
tcpmux          stream  tcp  nowait root  internal
# @r{Handle @samp{scp-to} service}.
tcpmux/+scp-to  stream  tcp  nowait root  /usr/sbin/tcpd  /bin/rushmail
@end smallexample

The program @command{/bin/rushmail} does the actual notification.
Following is its simplest implementation:

@smallexample
#! /bin/sh

read user command

/usr/sbin/sendmail -oi -t <<EOT
From: GNU Rush Notification <devnull@@localhost>
To: <root@@localhost>
Subject: GNU Rush notification

Be informed that $user executed $command.
EOT
@end smallexample

@node Test Mode
@chapter Test Mode
@cindex test mode
@cindex testing configuration file
@cindex configuration file, testing
@opindex --test
@opindex --lint
@opindex -c
  GNU Rush provides a special @dfn{test mode}, intended to test
configuration files and to emulate execution of commands.  The test
mode is enabled by @option{--test} command line option (aliases:
@option{--lint}, @option{-t}).  When @command{rush} is given this option, the 
following occurs:

@enumerate 1
@item All diagnostic messages are redirected to standard error, instead of
syslog.

@item If a single non-option argument is present, it is taken as a
name of the configuration file to use.

@item The configuration file is parsed.  If parsing fails, the program
exits with the code 1.

@item If the @option{-c} option is present, @command{rush} processes
its argument as usual (@pxref{Operation}), except that the command
itself is not executed.

@item Otherwise, if @option{-i} option is present, @command{rush}
emulates interactive usage, but does not execute the final command.
@end enumerate

An exit status of 0 means no errors, 1 means an error has occurred.

@opindex --user
@opindex -u
You may also emulate access by a particular user, by supplying his
user name via the @option{--user} (@option{-u}) option.  This option
implies @option{--test}.

@opindex --debug
@opindex -d
In test mode, you may set debugging level (@pxref{Debugging}) from the
command line, using the @option{--debug} (@option{-d}) command line
option.  It expects a single number specifying debugging level as its
argument.  The debugging level set this way overrides settings
from the configuration file.

  Following are several examples that illustrate the use of test mode
in various cases:

@enumerate 1
@item Test default configuration file:

@smallexample
$ rush --test
@end smallexample

@item Test configuration file @file{sample.rc}:

@smallexample
$ rush --test sample.rc
@end smallexample

@item Test interactive access

@smallexample
$ rush --test -i sample.rc
@end smallexample

@item Test the configuration file and emulate execution of the command
@command{cvs server}.  Use debugging level 2:

@smallexample
$ rush --test --debug=2 -c "cvs server"
@end smallexample

@item Same, but for user @samp{jeff}:

@smallexample
$ rush --user=jeff --debug=2 -c "cvs server"
@end smallexample

Note, that you don't need to specify @option{--test} along with
@option{--user} or @option{-i} options.

@item Same, but use @file{sample.rc} instead of the default
configuration file:

@smallexample
$ rush --test --debug=2 -c "cvs server" sample.rc
@end smallexample
@end enumerate

@node Option Summary
@chapter Option Summary
@cindex options, command line
This chapter provides a short summary of @command{rush} command line options.

@table @option
@opindex -c, @r{rush}
@item -c @var{command}
Specify the command to run.

@anchor{--security-check}
@opindex -C, @r{rush}
@opindex --security-check, @r{rush}
@item -C @var{test}
@itemx --security-check=@var{test}
Configure security checks for the main configuration file.
@xref{include-security}, for the description of @var{test} argument.
@xref{security checks}, for the discussion of the available security tests.

@opindex -d, @r{rush}
@opindex --debug, @r{rush}
@item -d @var{number}
@itemx --debug=@var{number}
Set debugging level.

@opindex -i, @r{rush}
@item -i
Emulate interactive access.  @xref{Test Mode}.

@opindex --show-default, @r{rush}
@item --show-default
Display the default built-in configuration.  @xref{Default
Configuration}, for more information.

@opindex -t, @r{rush}
@opindex --test, @r{rush}
@opindex --lint, @r{rush}
@item -t
@itemx --test
@itemx --lint
Run in test mode.  An optional argument may be used with this option
to specify alternative configuration file name, e.g.:

@smallexample
$ rush --lint ./test.rc
@end smallexample

If the @option{-c} option is also specified, @command{rush} emulates the
normal processing for the command, but does not execute it.

@opindex -u, @r{rush}
@opindex --user, @r{rush}
@item -u @var{name}
@itemx --user=@var{name}
Emulate access by user @var{name}.  This option implies
@option{--test} and is valid only when used by root and in conjunction
with the @option{-c} option.

@opindex -v, @r{rush}
@opindex --version, @r{rush}
@item -v
@itemx --version
Display program version.

@opindex -h, @r{rush}
@opindex --help, @r{rush}
@item -h
@itemx --help
Display a short help message.

@opindex --usage, @r{rush}
@item --usage
Display a concise usage summary.
@end table

@node Rushwho
@chapter The @code{rushwho} utility.
@prindex rushwho
The @command{rushwho} utility displays a list of users who are
currently using @command{rush}.  The utility operates
on default Rush database, which is maintained if @command{rush}
runs in accounting mode (@pxref{Accounting and Forked Mode}).  The following
is a sample output from @code{rushwho}:

@smallexample
Login      Rule     Start     Time       PID      Command
jeff       sftp     Sun 12:17 00:58:26   10673    bin/sftp-server
@end smallexample

The information displayed is:

@table @asis
@item Login
The login name of the user.

@item Rule
The tag of the rule he is served under (@pxref{Rule, tag}).  

@item Start
Time when the rule began execution.

@item Time
Duration of the session.

@item PID
PID of the running command.

@item Command
Command line being executed.
@end table

@vrindex RUSHWHO_FORMAT
This format is a built-in default.  It may be changed either by
setting the @env{RUSHWHO_FORMAT} environment variable to the desired
format string, or by using @option{--format} command line option.

@menu
* Rushwho Options::
* Formats::
@end menu

@node Rushwho Options
@section Rushwho Options
@cindex rushwho, command line options

This section summarizes the command line options understood by
@command{rushwho} utility.

@table @option
@anchor{format option}
@opindex -F, @r{rushwho}
@opindex --format, @r{rushwho}
@item -F @var{string}
@itemx --format=@var{string}
Use @var{string} instead of the default format, described in
@ref{Rushwho}.  @xref{Formats}, for a detailed description of the
output format syntax.  If @var{string} begins with a @samp{@@}, then
this character is removed from it, and the resulting string is
regarded as a name of the file to read.  The contents of this file is
the format string.  The file is read literally, except that lines
beginning with @samp{;} are ignored (they can be used to introduce
comments).  For example, @command{rushwho --format=@@formfile} reads
in the contents of the file named @file{formfile}.

@opindex -f, @r{rushwho}
@opindex --file, @r{rushwho}
@item -f @var{dir}
@itemx --file=@var{dir}
Use database directory @var{dir}, instead of the default.
By default, database files are located in @file{/usr/local/var/rush}.

@opindex -H, @r{rushwho}
@opindex --no-header, @r{rushwho}
@item -H
@itemx --no-header
Do not display header line.

@opindex -v, @r{rushwho}
@opindex --version, @r{rushwho}
@item -v
@itemx --version
Display program version.

@opindex -h, @r{rushwho}
@opindex --help, @r{rushwho}
@item -h
@itemx --help 
Display a short help message.

@opindex --usage, @r{rushwho}
@item --usage
Display a concise usage summary.
@end table

@node Formats
@section Output Formats
@cindex output formats

A format string controls the output of every record from GNU Rush
accounting database.  It may contain following four types of objects:

@table @asis
@item Ordinary characters
These are copied to the output verbatim.

@item Escapes
An escape is a backslash (@samp{\\}), followed by a single character.
It is interpreted as follows:

@multitable @columnfractions 0.30 .5
@item Escape @tab Output
@item \a @tab Audible bell character (@acronym{ASCII} 7)
@item \b @tab Backspace character (@acronym{ASCII} 8)
@item \e @tab Escape character (@acronym{ASCII} 27)
@item \f @tab Form-feed character (@acronym{ASCII} 12)
@item \n @tab Newline character (@acronym{ASCII} 10)
@item \r @tab Carriage return character (@acronym{ASCII} 13)
@item \t @tab Horizontal tabulation character (@acronym{ASCII} 9)
@item \v @tab Vertical tabulation character (@acronym{ASCII} 11)
@item \\ @tab A single backslash (@samp{\})
@item \" @tab A double-quote.
@end multitable

Any escape not listed in the table above results in its second
character being output.

@item Quoted strings
Strings are delimited by single or double quotes.  Within a string
any escape sequences are interpreted as described above.

@item Format specifications
A @dfn{format specification} is a kind of function, which outputs
a particular piece of information from the database record.
@end table

Each format specification starts with an opening brace and ends with
a closing brace.  The first word after the brace is the name of the
format specification.  The rest of words are @dfn{positional arguments}
followed by @dfn{keyword arguments}.  Both are optional.  When
specified, keyword arguments must follow positional ones.  A keyword
argument begins with a colon.  For example:

@table @code
@item (time)
A single format specification.

@item (time 10)
The same format specification with the output width limited to 10
characters.

@item (time 10 Duration)
The @samp{time} format specification, with the output width limited to 10
characters and @samp{Duration} as a header title.

@item (time 10 "Session Duration" :right :format %H:%M)
The same with two keyword arguments: @samp{:right} and
@samp{:format}.  The latter takes the string @samp{%H:%M} as its
argument.  Notice the use of quoted string to preserve the
whitespace.
@end table

The full list of format specifications follows.

@deffn {Format Spec} newline [@var{count}]
Causes the newline character to be output.  If the optional @var{count}
is supplied, that many newlines will be printed
@end deffn

@deffn {Format Spec} tab [@var{num}]
Advance to the next tab stop in the output stream.  If optional @var{num}
is present, then skip @var{num} tab stops.  Each tab stop is eight
characters long.
@end deffn

The following specifications output particular fields of a database
record.  They all take two positional arguments: @var{width} and
@var{title}.

The first argument, @var{width} sets the maximum output
length for this specification.  If the number of characters actually output
is less than the width, they will be padded with whitespace either to
the left or to the right, depending on the presence of the @code{:right}
keyword argument.  If the number of characters is greater than
@var{width}, they will be truncated to fit.  If @var{width} is
not given, the exact data are output as is.

The second argument, @var{title}, gives the title of this column for
the heading line.  By default no title is output.

Every field specification accepts at least two keyword arguments.
The keyword @code{:right} may be used to request alignment to the right
for the data.  This keyword is ignored if @var{width} is not given.

The keyword @code{:empty} followed by a string causes @command{rushwho}
to output that string if the resulting value for this specification
would otherwise be empty.

@deffn {Format Spec} user @var{width} @var{title} [:empty @var{repl}][:right]
Print the user login name.
@end deffn

@deffn {Format Spec} time @var{width} @var{title} @
       [:empty @var{repl}][:right][:format @var{date-format}]
@deffnx {Format Spec} start-time @var{width} @var{title} @
       [:empty @var{repl}][:right][:format @var{date-format}]
       
Date and time when the session started.

The @code{:format} keyword introduces the @code{strftime} format string
to be used when converting the date for printing.  The default value is
@samp{%a %H:%M}.  @xref{Time and Date Formats}, for a detailed
description of @code{strftime} format strings.
@end deffn

@deffn {Format Spec} stop-time @var{width} @var{title} @
        [:empty @var{repl}][:right][:format @var{date-format}]
Time when the command finished.  This specifier has sense only for
@command{rushlast} (@pxref{Rushlast}).  If the command is still
running, the word @samp{running} is output.
@end deffn

@deffn {Format Spec} duration @var{width} @var{title} @
       [:empty @var{repl}][:right]
Total time of the session duration.
@end deffn

@deffn {Format Spec} rule @var{width} @var{title} [:right]
The tag of the rule used to serve the user.  @xref{Rule, tag}, for a
detailed description of rules and tags.
@end deffn

@deffn {Format Spec} command @var{width} @var{title} @
       [:empty @var{repl}][:right]
Command line being executed.
@end deffn

@deffn {Format Spec} pid @var{width} @var{title} [:right]
PID of the process.
@end deffn

For example, the following is the default format for the
@command{rushwho} utility.  It is written in a form, suitable for use
in a file supplied with the @option{--format=@@@var{file}} command
line option (@pxref{format option}):

@smallexample
(user 10 Login)" "
(rule 8 Rule)" " 
(start-time 0 Start)" " 
(duration 9 Time)" "
(pid 10 PID)" "
(command 28 Command)
@end smallexample

@node Rushlast
@chapter The @code{rushlast} utility.
@prindex rushlast
The @command{rushlast} utility searches back through the GNU Rush database
and displays a list of all user sessions since the database was
created.  By default, it displays the following information:

@smallexample
Login      Rule     Start     Stop      Time    Command
sergiusz   rsync    Sun 20:43 Sun 20:43 05:57   /usr/bin/rsync /upload
jeff       sftp-sav Sun 20:09 running   07:17   /bin/sftp-server
@end smallexample

@table @asis
@item Login
The login name of the user.

@item Rule
The tag of the rule he is served under (@pxref{Rule, tag}).

@item Start
Time when the rule began execution.

@item Start
Time when the command finished, or the word @samp{running} if it is
still running.

@item Time
Duration of the session.

@item Command
Command line being executed.
@end table

@vrindex RUSHLAST_FORMAT
This format is a built-in default.  It may be changed either by
setting the @env{RUSHLAST_FORMAT} environment variable to the desired
format string, or by using @option{--format} command line option
(@pxref{Rushlast Options}).

@menu
* Rushlast Options::
@end menu

@node Rushlast Options
@section Rushlast Options

This section summarizes the command line options understood by
@command{rushlast} utility.

@table @option
@opindex -F, @r{rushlast}
@opindex --format, @r{rushlast}
@item -F @var{string}
@itemx --format=@var{string}
Use @var{string} instead of the default format, described in
@ref{Rushwho}.  @xref{Formats}, for a detailed description of the
output format syntax.  If @var{string} begins with a @samp{@@}, then
this character is removed from it, and the resulting string is
regarded as a name of a file to read.  The contents of this file is
the format string.  The file is read literally, except that lines
beginning with @samp{;} are ignored (they can be used to introduce
comments).  For example, @command{rushwho --format=@@formfile} reads
in the contents of the file named @file{formfile}.

@opindex -f, @r{rushlast}
@opindex --file, @r{rushlast}
@item -f @var{dir}
@itemx --file=@var{dir}
Use database directory @var{dir}, instead of the default.
By default, database files are located in @file{/usr/local/var/rush}.

@opindex --forward, @r{rushlast}
@item --forward
Display entries in chronological order, instead of the reverse
chronological one, which is the default.

@opindex -n, @r{rushlast}
@opindex --count, @r{rushlast}
@item -n @var{number}
@itemx --count=@var{number}
@itemx -@var{number}
Show at most @var{number} records.  The form @option{-@var{number}} is
provided for compatibility with the @cite{last(1)} utility.

@opindex -H, @r{rushlast}
@opindex --no-header, @r{rushlast}
@item -H
@itemx --no-header
Do not display header line.

@opindex -v, @r{rushlast}
@opindex --version, @r{rushlast}
@item -v
@itemx --version
Display program version.

@opindex -h, @r{rushlast}
@opindex --help, @r{rushlast}
@item -h
@itemx --help 
Display a short help message.

@opindex --usage, @r{rushlast}
@item --usage
Display a concise usage summary.
@end table

@node Accounting Database
@chapter Accounting Database
@cindex accounting database
  Rush accounting database is stored in the directory
@file{@var{localstatedir}/rush}, where @var{localstatedir} stands for
the name of the local state directory, defined at compile time.  By
default, it is @file{@var{prefix}/var}, where @var{prefix} is the
installation prefix, which defaults to @file{/usr/local}.  Thus, the
default database directory is @file{/usr/local/var/rush}.  You can
change this default by using @option{--localstatedir} option to
@command{configure} before compiling the package.  The
@option{--prefix} option affects it as well.

@cindex @file{utmp} file, accounting database
@cindex @file{wtmp} file, accounting database
  As of version @value{VERSION}, the database consists of two files,
called @file{utmp} and @file{wtmp}.  The @file{wtmp} file keeps
information about all user sessions, both finished and still active.
The @file{utmp} file contains indices to those records in @file{wtmp},
which represent active sessions.

  The @file{wtmp} grows continuously, while @file{utmp} normally
grows the first day or two after enabling accounting mode, and from then on
its size remains without changes.  If you set up log file rotation,
e.g. by using @command{logrotate} (@pxref{logrotate,,logrotate,logrotate(8),
logrotate man page}), or a similar tool, it is safe to rotate
@file{wtmp} without notifying @command{rush}.  The only requirement is
to truncate @file{utmp} to zero size after rotating @file{wtmp}, as
shown in the following @file{logrotate.conf} snippet:

@smallexample
/var/run/rush/wtmp @{
    monthly
    create 0640 root svusers
    postrotate
      cat /dev/null > /var/run/rush/utmp
    endscript
@}
@end smallexample

  Accounting files are owned by @samp{root} and normally have permissions
@samp{600}.  You may change the default permissions using the
following configuration file statements:

@deffn {Rule Config} acct-umask @var{mask}
Set umask used when accessing accounting database files.  Default
value is @samp{022}.
@end deffn

@deffn {Rule Config} acct-dir-mode @var{mode}
Set mode bits for the accounting directory.  The @var{mode} argument
is the mode in octal.
@end deffn

@deffn {Rule Config} acct-file-mode @var{mode}
Set mode bits for @file{wtmp} and @file{utmp} files.
@end deffn

  Notice, that these statements affect file and directory modes only
when the corresponding file or directory is created.  @command{Rush}
will not change modes of the existing files.

  The following sections contain a detailed description of the
structure of these two files.  You may skip them, if you are not
interested in technical details.

@menu
* wtmp::        The Structure of @file{wtmp} File.
* utmp::        The Structure of @file{wtmp} File.
@end menu

@node wtmp
@section The @file{wtmp} file
@cindex @file{wtmp}
  The @file{wtmp} file consists of variable-size entries.  It is
designed so that it can easily be read in both directions.

  Each record begins with a fixed-size header, which is followed by
three zero-terminated strings, and the record size in @code{size_t}
representation.  The three strings are, in that order: the user login
name, the rule tag, and the full command line.

  The header has the following structure:

@smallexample
@group
struct rush_wtmp @{
        size_t reclen;
        pid_t pid;
        struct timeval start;
        struct timeval stop;
        char *unused[3];
@};
@end group
@end smallexample

@noindent
where:

@table @code
@item reclen
is the length of the entire record, including the size of this
header.  This field is duplicated at the end of the record.

@item pid
is the PID of the command executed for the user.

@item start
represents the time of the beginning of the user session.

@item stop
represents the time when the user session finished.  If the session is
still running, this field is filled with zeros.

@item unused
The three pointers at the end of the structure are used internally by
@command{rush}.  On disk, these fields are always filled with zeros.
@end table

@node utmp
@section The @file{utmp} file
@cindex @file{utmp}
  The @file{utmp} file consists of a fixed-size records of the
following structure:

@smallexample
@group
struct rush_utmp @{
        int status;
        off_t offset;
@};
@end group
@end smallexample

The fields have the following meaning:

@table @code
@item status
Status of the record: @samp{0} if the record is unused, and @samp{1}
if it represents an active session.

@item offset
Offset to the corresponding record in @file{wtmp} (see previous
section).
@end table

@node Reporting Bugs
@chapter How to Report a Bug

  Email bug reports to @email{bug-rush@@gnu.org}.  Please include a
detailed description of the bug and information about the conditions
under which it occurs, so we can reproduce it.  To facilitate the
task, the following list shows the basic set of information that is
needed in order to find the bug:

@itemize
@item Package version you use.  
@item A detailed description of the bug.
@item Conditions under which the bug appears.
@item It is often helpful to send the contents of @file{config.log}
file along with your bug report.  This file is created after running
@command{./configure} in the GNU Rush source root directory.
@end itemize

@node Time and Date Formats
@appendix Time and Date Formats
@include strftime.texi

@node Copying This Manual
@appendix GNU Free Documentation License
@include fdl.texi

@node Concept Index
@unnumbered Concept Index

This is a general index of all issues discussed in this manual.

@printindex cp

@bye

