GNU Rush NEWS -- history of user-visible changes. 2024-08-09
See the end of file for copying conditions.

Please send bug reports to <bug-rush@gnu.org.ua>

Version 2.4, 2024-08-09

* Use getgrouplist call, if available

* Fix in rush-po script

* Bugfixes


Version 2.3, 2022-07-16

* Fix invalid memory addressing in remopt command

* Fix building with flex >= 2.6.1 (EOF check)


Version 2.2, 2022-01-02

* File system tests

New predicates, designed after options to the "test" system command,
check for file types. modes and ownership.  For example

  rule
    match -d /var/lock/sd

will match if /var/lock/sd exists on diks and is a directory

* transform: fix replacement of numbered pattern instance

This fixes handling of transform expressions like "s/X/@/2".

Version 2.1, 2019-07-12

* Include updated wordsplit version (v1.0-7-g6ccb9ad)
* Allow for multiple EOLs and comments after the preface statement.
* Bugfix in the testcase 20.


Version 2.0, 2019-07-01

Configuration file support completely rewritten.  New configuration
file syntax is introduced that offers a large set of control
structures and transformation instructions for handling arbitrary
requests.  Please see the documentation for details.

Backward compatibility with prior releases is retained and old
configuration syntax is still supported.  This ensures that existing
installations will remain operational without any changes.
Nevertheless, system administrators are encouraged to switch to the
new syntax as soon as possible.

Version 1.9, 2019-04-24

* Backreference expansion

Arguments to tranformations, chroot and chdir statements can contain
references to parenthesized groups in the recent regular expression
match. Such references are replaced with the strings that matched the
corresponding groups. Syntactically, a backreference expansion is a
percent sign followed by one-digit number of the subexpression
(1-based, %0 refers to entire matched line). For example

 rule X
   command ^cd (.+) && (.+)
   chdir %1
   set %2

* User-defined variables

The configuration file can define new variables or redefine the
built-in ones using the "setvar" statement:

  setvar[VAR] PATTERN

Here, VAR is the variable name, and PATTERN is its new value. The
PATTERN is subject to variable and backreference expansion.

User-defined variables can be unset using the "unsetvar" statement:

  unsetvar[VAR]

Unsetting a built-in variable, previously redefined using the "setvar"
statement causes the user-supplied definition to be forgotten and the
built-in one restored.

* Shell-like variable expansion

The following shell-like notations are supported:

${VAR:-WORD}   Use Default Values
${VAR:=WORD}   Assign Default Values
${VAR:?WORD}   Display Error if Null or Unset
${VAR:+WORD}   Use Alternate Value

* New script rush-po for extracting translatable strings from the configuration

The script rush-po.awk that was used in prior versions has been withdrawn.


Version 1.8, 2016-10-01

* rushlast and rushwho

Select the most suitable time representation for the duration field,
depending on the requested width.

* chroot handling

If chroot is requested, re-read the password database after chrooting.

* Supplementary user groups

Set supplementary groups when switching to user privileges.

* Change provisions for interactive shell usage

Interactive rules are marked with the keyword "interactive".  Only
such rules are considered when rush is invoked without the -c option.
The support of the old (global) "interactive" keyword is discontinued.

* The env statement

The env statement can contain references to the unmodified environment
variables.  E.g. this is now valid:

  env PATH=/sbin:$PATH

* Testsuite is provided
  
* Minor fix in TXPMUX code.

* Fix CVE-2013-6889

* Manpages are provided


Version 1.7, 2010-07-07

* New configuration statements `acct-umask', `acct-dir-mode', `acct-file-mode'

These statements set the value of umask used when accessing accounting
database files, and permissions for the accounting directory and
database files, correspondingly.

* Conditions `uid' and `gid' accept symbolic user/group names as argument.

Both conditions now accept symbolic as well as numeric arguments,
e.g.:

  uid 1300
  uid smith
  uid < smith
  gid != 500

* The `newgrp' command

The `newgrp' command changes the current group ID to the one given as
its argument, which must be either a numeric GID or a name of an
existing group.

* Default regex flags affect the `transfer' statement.

* New translations

Dutch, by Koen Torfs.
Vietnamese, by Clytie Siddall.

* Bugfixes
** Fix memory allocation in make_file_name (puszcza#127).
** Fix handling of numeric options in `rushlast'.
** A single fall-through rule caused infinite loop (puszcza#127#comment7).
** Accounting mode is off by default, as described in the documentation.


Version 1.6, 2009-02-10

* Patterns in `transform' statement

The syntax of the `transform' statement has been extended to
allow for specifying transformation argument string:

 transform STRING REGEX
or
 transform[N] STRING REGEX

STRING may contain meta-variables, which are expanded before
performing the transformation. The following meta-variables are
defined: 

  ${user}             User name
  ${group}            Name of the user's principal group
  ${uid}              UID
  ${gid}              GID
  ${home}             User's home directory
  ${gecos}            User's GECOS field
  ${program}          Program name
  ${command}          Full command line
  $0 to $9            The value of the Nth command line argument
  ${N}                Same as above, useful if N > 9 or N < 0 (see
                      "Negative argument indexes", below).

Thus, for example:

  transform[0] s,.*/,/bin/,
  
is equivalent to:

  transform[0] $0 s,.*/,/bin/,
		      
* The `map' statement.

This statement sets a command line argument using a map file.

   map[N] FILE DELIM KEY K V [DEFAULT]

Each line in a map file FILE contains fields, separated by delimiter
DELIM. The `map' statement looks for the record whose Kth field has
the value of KEY. If such a record is found, its Vth field becomes a
new value of the Nth command line argument. Othervise, if DEFAULT is
given, it is used as a new value. Otherwise, the argument retains its
old value.

KEY may contain meta-variables described above (see "Patterns in
`transform' statement").

* The `set' statement.

The `set' statement replaces entire command line with the new value:

rule foo
  set /bin/scp -t /upload

In indexed form, it replaces the given argument:

  set[0] /bin/scp

The argument to `set' may contain meta-variables (see "Patterns in
`transform' statement").
  
* The `delete' statement.

This statement deletes the given argument, or range of arguments, from
the command line. It has two forms:

1. Delete the Nth argument:

  delete[N]

2. Delete all arguments between indexes N and M, inclusive:

  delete N M

* Modifying program name

To modify the program name (as opposed to argv[0]), use ^ pseudo-index, e.g.:

  set[^] /bin/scp

By default (unless [^] form is used) argv[0] is used as the program name.

* Negative argument indexes

Negative argument indexes refer to arguments numbered from the end of the
command line. E.g.:

  transform[-1]         is the same as transform[$]
  transform[-2]         will transform the last but one argument

* New statement `interactive'

This statement provides a replacement command line for interactive use
of rush. By default, such use is prohibited. However, using
`interactive' statement you can allow some users a limited interactive
access. For example:

interactive *shell*

rule login
  command \*shell\*
  group rshell
  map[^] /usr/local/etc/rush.shell : ${user} 1 2 none
  transform[0] ${program} s,^.*/,-r,

* Use of predefined error messages in `exit' statement.

Predefined error messages can be used in `exit' statements.
E.g., the statement:

  exit @nologin-message

will retrieve the text of the `nologin-message' and send it to the
remote party before exiting.

If the message text must begin with a `@' sign, duplicate it:

  exit @@special error message
  

Version 1.5, 2009-01-14

* Post-process notification

After completing a rule, Rush can send a notification
over a TCP/IP or UNIX socket.  

* Include statement

The include statement allows to inlcude contents of a file into the
main rush configuration file.

* Safety checks.

Before parsing, rush checks permissions and ownership of its
configuration file. The file is rejected if:

- It is not owned by root.
- It is group or world writable
- It resides in a group or world writable directory
- It is a symbolic link to a file residing in a group or world
  writable directory

The same checks are performed for any included file.  The safety
checks for included files can be changed using the global statement
`include-security'.

* Default configuration

Default configuration file can be built into the rush binary.  See
`Default Configuration' in README file.

* Internationalization


Version 1.4, 2008-10-20

* RUSHWHO_FORMAT and RUSHLAST_FORMAT environment variables.

These variables can be used to supply customized formats to
rushwho and rushlast utilities.

* Bugfixes in format parsing code.


Version 1.3, 2008-10-14 

* Implement accounting mode.

* New programs: rushwho and rushlast

These utilities display information from the Rush accounting database.



Version 1.2, 2008-09-06

* Test mode

Rush can be run from the command line to test its configuration file.
Examples:

1. Test default configuration file:

   rush --test

2. Test configuration file `sample.rc':

   rush --test sample.rc

3. Test the configuration file and emulate execution of the command
`cvs server'.  Set debugging level 2:

   rush --test --debug=2 -c "cvs server"


Version 1.1, 2008-08-30

* A condition can be negated.

Placing ! between the keyword and conditional expression indicates
its negation, e.g.:

  command ! ^cvs

matches any command line that does not begin with `cvs'  

* New action `exit'

The `exit' statement instructs rush to write a supplied error message
to specified file descriptor and exit immediately.  If file
descriptor is not given, 2 (standard error) is used.

Exit actions are useful for writing ``trap rules'', i.e. rules that
are intended to trap incorrect or prohibited command lines and to return
customized reply messages in such cases. 

* New statement `regexp'

Configures the style of regular expressions used in subsequent
`cmdline' and `match' clauses.  For example:

  regex +icase +extended

sets case-insensitive extended regular expressions.  


Version 1.0, 2008-08-26

Initial version.


=========================================================================
Copyright information:

Copyright (C) 2008-2024 Sergey Poznyakoff

   Permission is granted to anyone to make or distribute verbatim copies
   of this document as received, in any medium, provided that the
   copyright notice and this permission notice are preserved,
   thus giving the recipient permission to redistribute in turn.

   Permission is granted to distribute modified versions
   of this document, or of portions of it,
   under the above conditions, provided also that they
   carry prominent notices stating who last changed them.

Local variables:
mode: outline
paragraph-separate: "[	]*$"
eval: (add-hook 'write-file-hooks 'time-stamp)
time-stamp-start: "changes. "
time-stamp-format: "%:y-%02m-%02d"
time-stamp-end: "\n"
end: